Picture a bank branch. A cashier opens an account and asks for ID: the rule, followed at the desk. Down the corridor a compliance officer checks a sample of the week's new accounts. Once a year a team from head office, which answers to nobody in the branch, checks the compliance officer. Three people, three lines.
First line: the work→Second line: compliance→Third line: audit→The board
People call this the three lines. The first line is everyone doing the job; the rule is theirs to follow. The second line is the compliance team: policy, training, checking. The third line is internal audit, which reports to the board and to no manager it checks. Banks and insurers are built this way; others copy it.
Tap the line that reports to the board and to no manager it checks.
Tap the part of the picture that answers it.
First line
++
Second line
++
Third line
Third line
Right. Audit. It is built to be outside the chain it checks: its boss is the board, so no manager can shorten its list.
First line
Not yet. The first line is the people doing the work, and they report to their managers. The rule is theirs to follow; they do not check their own bosses.
Second line
Not yet. Compliance checks the first line, and usually sits inside the company's management. It can be told what to look at, which is why a third line exists.
Branch managerwants the account
↓→
Compliance officerreports to him?
Why three and not two? Because a checker who reports to the person being checked is not a checker. If the compliance officer's boss is the branch manager, and the branch manager wants the account opened, the sample gets smaller. The third line exists so that somebody checks the second without needing its permission.
The managerten accounts, no ID
++
Compliancereports to him
++
Auditreports to the board
The compliance officer finds the branch manager approved ten accounts with no ID. The manager is the officer's boss. Which line is built for this?
The third. Audit answers to the board, so it can report the manager without asking him.
Right. The third line's whole design is a reporting line that skips every manager. The officer can tell audit, and audit can tell the board, and the manager is not in that chain.
The first. The cashiers should refuse.
Not yet. The cashiers did what the manager told them, which is the problem. The first line owns the rule; it is not built to police its own boss.
The second. Compliance can just report him.
Not yet. It can, and it should. But the officer's boss is the manager, so the complaint lands on the desk of the person it is about. That is exactly why a third line exists.
Picture 1,000 new accounts a year, 50 of them opened wrongly. Move how many lines are checking and see how many of the 50 are caught. Made up to show the shape.
Caught0 of 50, made up
Wrong accounts50 of 50, made up
Lines checking: No checks
No checks: 0 of 50. The wrong accounts sit in the system until someone outside finds them.
Caught10 of 50, made up
Wrong accounts50 of 50, made up
Lines checking: First line only
First line only: 10. Cashiers notice some of their own mistakes, and none of their manager's.
Caught35 of 50, made up
Wrong accounts50 of 50, made up
Lines checking: First and second
First and second: 35. The weekly sample finds most of the rest.
Caught45 of 50, made up
Wrong accounts50 of 50, made up
Lines checking: All three
All three: 45. Audit finds the ones the second line was not looking for.
Why does the third line add fewer catches than the second?
It only looks once a year, so it is not worth having.
Not yet. Once a year is the design, and the frames show the yearly look still moved the number from 35 to 45. The ones it finds are the ones the weekly sample could not see.
There were only fifteen left, so it did little.
Not yet. It caught ten of those fifteen. A line that finds two in three of what everyone else missed is the line doing the hardest job, not the least.
It checks the checkers, not every account. Its catch is the second line's blind spots.
Right. Ten more out of the fifteen the second line missed: two in three of the hardest ones. Audit looks once a year at whether the sampling is honest, not at every account.
Move the control.
The three linesinside
++
Outside auditonce a year
++
The watcherany time
Outside the building are two more. An outside audit firm, paid to check the accounts once a year and put its name to them in public. And the watcher, who can ask for anything the three lines wrote. The three lines are the company checking itself. The two outside are the reason it does: somebody outside can ask to see.
Each card is a person. Which line?
One card at a time. Tap the pile it belongs to.
Card 1 of 6
A nurse who double-checks the drug chart before giving a dose
The officer who writes the gifts policy and runs the training
The team that reports to the board on whether the gifts policy is working
A trader who records every deal before lunch
The person who samples twenty trades a week and queries the odd one
The team that tests whether the sampling itself is done
A nurse who double-checks the drug chart before giving a dose → First: the work
Not yet. First line. She is doing the job, and the check is part of the job; the rule is hers to follow.
The officer who writes the gifts policy and runs the training → Second: compliance
Not yet. Second line. Writing the rule for others and teaching it is compliance's job, not the doing and not the independent check.
The team that reports to the board on whether the gifts policy is working → Third: audit
Not yet. Third line. Reporting to the board, and on the second line's own work, is what makes it audit.
A trader who records every deal before lunch → First: the work
Not yet. First line. Recording the deal is part of doing the deal; the proof is made by the hand that did the work.
The person who samples twenty trades a week and queries the odd one → Second: compliance
Not yet. Second line. A sample taken by someone whose job is the checking, inside the company's management, is compliance.
The team that tests whether the sampling itself is done → Third: audit
Not yet. Third line. Checking the checker, by a team outside the chain, is audit's one job.
2First
++
2Second
++
2Third
Right. Two each. Ask who the person answers to and what they are looking at. The first line does the work. The second line checks the work from inside the company. The third line checks the checkers and answers to the board.
The bookkeeperfirst line
↓→
The treasurersecond line
↓→
Third line?
A small charity has twelve staff and no audit team. The treasurer checks the bookkeeper. From this lesson, what is missing, and what could stand in?
A second line. The staff can check each other.
Not yet. Staff checking each other is still the first line: people doing the work, looking sideways. The second line is someone whose job is the checking, and the charity has one: the treasurer.
A third line. The trustees, or an outside firm, can check the person who checks.
Right. The lines are roles, not departments. A charity has a board called the trustees, and a treasurer that nobody checks is a second line with no third.
Nothing. Three lines are for banks.
Not yet. The treasurer is checking the bookkeeper, and nobody is checking the treasurer. That is the exact gap the third line fills, in a bank or a charity of twelve.
Lesson complete
The people doing the work are the first line. Compliance checks them. Audit checks everyone, and answers to the board.