The three lines of defence is a model for dividing risk responsibilities in a regulated firm. The first line owns and runs risk in daily operations. The second line sets policy and oversees independently. The third line, internal audit, gives assurance on both. Once AI agents act, each agent must be placed in one line, and only one.
Why do the three lines matter once agents act?
The model works because each line checks work it did not do. An agent that prepares payments sits in the first line. An agent that tests whether payments followed policy sits in the second. If the same agent, with the same sources and the same owner, does both, the check is the work marking itself.
This is the separation regulators and auditors look for first. It is also why we describe compliance agents as second line, never the last word: the agent can read, test and draft, but the judgement and the sign-off stay with accountable people in that line.
How does the model work in practice?
| Line | Who | What they do | Where agents help |
|---|---|---|---|
| First | Business and operations teams | Own the process, run controls, take the risk | Prepare, draft and execute routine work within bounds |
| Second | Risk and compliance | Set policy, monitor, challenge | Test samples, read alerts, draft findings for a person |
| Third | Internal audit | Independent assurance to the board | Pull evidence from the record, draft working papers |
Each line keeps its own reporting route. The second line reports to a chief risk or compliance officer, the third to the audit committee, so neither can be overruled by the people whose work they review.
What does it look like with agents in each line?
Take a mid-sized lender. In the first line, a collections agent drafts payment plan offers and a team leader approves them. In the second line, a monitoring agent samples those offers each week and flags any that breach the forbearance policy, for a compliance analyst to review. In the third line, auditors read the filed record of both agents' actions to test whether the controls ran as designed.
Three agents, three owners, three sets of bounds. The monitoring agent cannot edit collections cases, and the collections agent cannot see the monitoring findings until a person releases them. Our three lines of defence matrix for AI agents sets this out capability by capability.
How are the three lines different from segregation of duties?
Segregation of duties splits a single process so that no one person can start and finish a sensitive transaction alone: one person raises a payment, another releases it. It works inside the first line.
The three lines model works across the organisation. It separates doing from overseeing from assuring. A firm can have perfect segregation of duties in payments and still fail the three lines test if the people checking payment controls report to the head of payments. With agents, you need both: no agent raises and releases the same payment, and no agent oversees work done in its own line.
Which terms sit next to the three lines?
- The second line of defence is where compliance agents usually sit, and where independence is most often eroded.
- Control owner: the named person in the first line accountable for a control working.
- Assurance: the third line's independent opinion on whether controls are designed and operating well.
Questions people ask
Can one agent platform serve all three lines?
Yes, if each line's agents have separate briefs, owners, sources and permissions, and each line can only see the other's work through the filed record. The platform is shared infrastructure; the agents and their authority are not.
Does an agent count as a line of defence by itself?
No. An agent is a tool used inside a line. Accountability for a line's work stays with the people in it, and the agent's actions are attributed to the line and the owner that deployed it.