Combined Assurance
Three Lines of Defence Maturity
Maturity of each defence line under the IIA model, scored across role-clarity dimensions.
Why three lines of defence maturity matters
The IIA's Three Lines model clarifies who owns risk, who oversees it and who provides independent assurance, and King IV draws on it to structure accountability across the institution. Scoring the maturity of each line across role-clarity dimensions reveals whether the model is genuinely operating or merely described in a policy. AuditPro Core rates each defence line's maturity so the audit committee can confirm that risk ownership, oversight and assurance are real, distinct and functioning.
The Numbers
AuditPro Core renders this view from your tenant's live, tamper-evident records. The figures below are illustrative sample data.
Lines assessed
3
Avg maturity
3.0 / 5
Strongest line
Third line
3.6
Weakest line
First line
2.5
Maturity by line and dimension
Line maturity summary
| Line of defence | Maturity | Target | Gap |
|---|---|---|---|
| First line (management) | 2.5 | 3.5 | 1 |
| Second line (risk & compliance) | 3.3 | 3.5 | 0.2 |
| Third line (internal audit) | 3.6 | 4 | 0.4 |
Figures shown are illustrative sample data for demonstration. AuditPro Core renders these views from your own tenant's live, tamper-evident records.
The three lines
The first line owns and manages risk, the second provides oversight and challenge through risk and compliance functions, and the third gives independent assurance through internal audit. Confusing the lines weakens the whole structure.
Role clarity
The model works only when each line understands its distinct role and the boundaries between them are respected. Blurred roles, such as internal audit owning controls, compromise independence and assurance.
Maturity assessment
Scoring maturity recognises that lines develop over time from informal to well-established. A low maturity score flags where a line exists on paper but operates weakly in practice.
Independence of the third line
Internal audit's value depends on its independence and objectivity from the activities it reviews. Erosion of that independence undermines the assurance the governing body relies upon.
How AuditPro Core Bridges the Gap
- Per-line scoring: each defence line is rated across role-clarity dimensions on a maturity scale.
- Boundary checks: overlaps or gaps between lines are surfaced where roles blur or independence is at risk.
- Traceability to evidence: each maturity rating links to the assessments supporting it for review.
- Audit-ready maturity profile: the three-lines view exports as committee evidence of a functioning governance structure.
Key Takeaways
- Each line has a distinct role: own, oversee, assure.
- Blurred roles compromise independence and weaken assurance.
- Maturity scoring flags lines that exist on paper but operate weakly.
- Internal audit's independence is foundational to its assurance value.
See This on Your Own Data
AuditPro Core renders this dashboard from your tenant's live, tamper-evident records — every figure traceable to source.