ACCT5919 Chap.2 Governance Frameworks and the Three Lines
Governance Frameworks and the Three Lines
Governance frameworks can rely on values for ethical direction, principles for observable standards, or a combination fitted to organisational context. The Three Lines Model then separates operating risk ownership, specialist monitoring and challenge, and independent assurance.
This chapter teaches role allocation: management cannot outsource ownership to a risk function, and assurance cannot remain independent if it designed and operated the control it later reviews.
What this chapter covers
- 01
Values-based frameworks as ethical direction with flexibility and interpretive risk
- 02
Principles-based frameworks as specific guidance, benchmarks and compliance evidence
- 03
Context, culture, regulation, size and goals as drivers of governance design
- 04
First-line responsibility for owning risk and operating day-to-day controls
- 05
Second-line responsibility for policy, expertise, monitoring and challenge
- 06
Third-line independent assurance and reporting to governance bodies
Worked example · free
Allocate a control failure across the Three Lines
- +1The marks shown for this assurance exercise are not a published university assessment scheme. Keep containment, permission correction and day-to-day control operation with the accountable operations manager.
- +1Assign access standards, cross-business monitoring and challenge of root-cause analysis to the specialist risk function.
- +1Ask internal audit to test revised control design and operation after management implements the response.
- +1Route the combined operating, challenge and assurance picture to the appropriate governance committee.
Key terms
- Values-based framework
- A governance approach that uses ethical values to guide judgement across changing contexts.
- Principles-based framework
- A governance approach that supplies specific standards and common benchmarks for practice and review.
- First line
- Operating functions that own exposure and manage risks created by their activities.
- Second line
- Specialist functions that set policy, advise, monitor and challenge operating risk management.
- Third line
- An independent assurance function that tests governance, risk management and controls.
- Independent assurance
- Objective evaluation performed without responsibility for designing or operating the work being reviewed.
- Role separation
- An allocation that keeps operating ownership, specialist challenge and independent testing distinguishable while allowing useful coordination. It protects accountability by showing who decides and acts, who questions the response and who evaluates the system without reviewing work that the same function designed or operated.
Governance Frameworks and the Three Lines FAQ
Are values and principles competing approaches?
Not necessarily. Values provide ethical direction where rules cannot predict every case, while principles translate expectations into more specific and reviewable practices. Many organisations need both. The analysis should explain which decisions require contextual judgement and which recurring activities need standardisation and evidence.
Can the risk function own every major risk?
No. Operating management controls the processes, people and resources that create most exposures and therefore remains accountable for ownership. The specialist risk function can advise, set standards, monitor and challenge. Taking over the operating decision blurs accountability and weakens later challenge.
Why must internal audit remain independent?
Independent assurance is credible because the reviewer did not design, approve or operate the control being tested. If internal audit manages the response and later certifies it, the same function evaluates its own work. Management should implement; internal audit should later test and report objectively.
Assessment move
Practise framework questions in two layers. First, compare values and principles by flexibility, specificity, ethical direction and reviewability. Second, trace one operational decision through the Three Lines. Use a verb test: the first line owns and operates; the second line advises, monitors and challenges; the third line independently assures.
Build short scenarios in which a role is blurred, then repair the allocation and explain why independence or ownership matters. Always identify the governance recipient for reporting. The strongest response does not merely name three roles; it shows how different evidence from each line supports a board or committee decision.
End by testing whether the written framework is implemented through incentives, capability and culture. Draw a role ledger with columns for decision, owner, control, challenge, assurance and escalation. Populate it from the scenario before naming departments, because the function performed matters more than the title.
Challenge every assurance claim by asking who designed and operated the subject of review, what evidence was tested and where unresolved findings travel. For framework design, pair each stated value with a recurring decision and a concrete principle that makes behaviour reviewable. Then identify one risk of over-specification and one risk of excessive discretion.
This comparison helps you recommend a balanced design rather than describing values and principles as competing slogans.
Working through Governance Frameworks and the Three Lines in ACCT5919? Sia is AskSia’s AI Accounting tutor — ask any ACCT5919 Governance Frameworks and the Three Lines question and get a clear, step-by-step explanation grounded in how ACCT5919 is taught and assessed. Read this chapter free, then take your hardest questions to Sia.
