{"id":290,"date":"2025-12-14T01:09:31","date_gmt":"2025-12-14T01:09:31","guid":{"rendered":"https:\/\/www.epw.com\/blog\/?p=290"},"modified":"2026-08-24T08:25:31","modified_gmt":"2026-08-24T08:25:31","slug":"how-to-train-employees-on-risk-management","status":"publish","type":"post","link":"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management","title":{"rendered":"Three Lines Model for Internal Audit Managers"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_82_2 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd0808;color:#dd0808\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd0808;color:#dd0808\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 eztoc-toggle-hide-by-default' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management\/#What_is_the_three_lines_model_for_internal_audit_managers\" >What is the three lines model for internal audit managers?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management\/#What_should_the_first_and_second_lines_actually_do\" >What should the first and second lines actually do?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management\/#Where_does_internal_audit_sit_and_what_must_stay_independent\" >Where does internal audit sit, and what must stay independent?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management\/#How_should_an_audit_manager_use_the_model_in_the_annual_plan\" >How should an audit manager use the model in the annual plan?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management\/#What_usually_fails_when_organisations_say_they_use_three_lines\" >What usually fails when organisations say they use three lines?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management\/#FAQ\" >FAQ<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management\/#Is_the_three_lines_model_the_same_as_three_lines_of_defence\" >Is the three lines model the same as three lines of defence?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management\/#Can_internal_audit_also_do_second-line_work\" >Can internal audit also do second-line work?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management\/#Does_every_organisation_need_three_separate_departments\" >Does every organisation need three separate departments?<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"What_is_the_three_lines_model_for_internal_audit_managers\"><\/span>What is the three lines model for internal audit managers?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The three lines model for internal audit managers is a way of splitting risk work so internal audit stays independent. First line owns and manages risk in the business. Second line advises, monitors, and challenges. Third line, internal audit, gives the board independent assurance. The 2020 IIA update treats these as roles, not three departments on a chart.<\/p>\n<p>That last point is the one that trips teams. Many organisations still run \u201cthree lines of defence\u201d as an org chart: operations, a risk\/compliance unit, and audit. The 2020 model keeps three kinds of responsibility, but it puts the governing body in the picture and drops the idea that risk work exists only to defend against threat. For an audit manager, the practical test is not whether the boxes exist. It is whether first line actually owns risk, second line can still say no, and you can still report what the executive would rather not hear.<\/p>\n<p>This post is for people who run or sit in the third line. It is not a history of the IIA paper.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"What_should_the_first_and_second_lines_actually_do\"><\/span>What should the first and second lines actually do?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>First line is management that delivers the work and owns the risk that comes with it. They design controls, run them, and fix them when they fail. They are not \u201cthe people audit inspects.\u201d They are the control owners.<\/p>\n<p>Second line is specialist support and challenge: risk, compliance, quality, information security, and similar functions. They set frameworks, test whether first line is using them, and escalate when it is not. They do not take ownership away from the business, and they are not a substitute for internal audit.<\/p>\n<p>If second line writes the control, performs it, and then \u201cassures\u201d it, you no longer have three lines. You have a second-line operation wearing two hats. That is a finding, not a footnote.<\/p>\n<p>For managers building <a href=\"https:\/\/www.epw.com\/blog\/courses\/what-is-risk-assessment-training-course\">risk assessment training<\/a> into first-line teams, the aim is identification and ownership in the job, not a once-a-year workshop that leaves the register with risk.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Where_does_internal_audit_sit_and_what_must_stay_independent\"><\/span>Where does internal audit sit, and what must stay independent?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Internal audit is the third line. You provide independent assurance to the board (or audit committee) on whether governance, risk management, and controls are designed and working. You do not own the risk. You do not run the control. You do not sign off first-line work so that management can treat the file as closed.<\/p>\n<p>Independence is operational, not a sentence in the charter. Watch for:<\/p>\n<ul>\n<li>Management setting the audit plan without committee challenge<\/li>\n<li>The CAE reporting through the CFO for both pay and scope<\/li>\n<li>Audit being asked to \u201chelp implement\u201d a control it will later review<\/li>\n<li>Combined assurance that quietly lets second line mark its own homework<\/li>\n<\/ul>\n<p>Combined assurance is useful when it is a map of who tested what. It is harmful when it is a reason not to look.<\/p>\n<p>This is also why <a href=\"https:\/\/www.epw.com\/blog\/courses\/risk-control-self-assessment-training\">control self-assessment<\/a> belongs in first and second line. RCSA is management\u2019s view of its own controls. Internal audit may use it as evidence. It is not third-line work.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"How_should_an_audit_manager_use_the_model_in_the_annual_plan\"><\/span>How should an audit manager use the model in the annual plan?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Use the lines to decide what you will not audit as if you owned it.<\/p>\n<p>Start with the board\u2019s questions, not last year\u2019s universe. Where is residual risk highest? Where is first-line ownership weak? Where is second-line challenge decorative? Those are third-line priorities.<\/p>\n<p>Then be explicit in the plan:<\/p>\n<ul>\n<li>What first line is expected to evidence (KRIs, incidents, control performance)<\/li>\n<li>What second line will have already tested, and how you will re-perform or not<\/li>\n<li>Where you will go in depth because nobody else is independent enough to do it<\/li>\n<\/ul>\n<p>Do not fill the plan with low-risk process audits because they are easy to staff. A three-line structure that never touches strategy, culture, or model risk is a filing system.<\/p>\n<p>The same logic applies when you train people, not only when you audit them. Live practice still beats a module when the skill is judgement, which is why <a href=\"https:\/\/www.epw.com\/blog\/courses\/why-instructor-led-training-still-works-for-adults\">instructor led training vs e-learning for managers<\/a> matters for audit teams as much as for operations.<\/p>\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1536\" height=\"1024\" src=\"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/08\/29130232\/04-3lod-inline.png\" alt=\"Audit planning board showing first-line ownership, second-line challenge, and third-line assurance\" class=\"wp-image-2042\" srcset=\"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/08\/29130232\/04-3lod-inline.png 1536w, https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/08\/29130232\/04-3lod-inline-300x200.png 300w, https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/08\/29130232\/04-3lod-inline-1024x683.png 1024w, https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/08\/29130232\/04-3lod-inline-768x512.png 768w, https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/08\/29130232\/04-3lod-inline-600x400.png 600w\" sizes=\"auto, (max-width: 1536px) 100vw, 1536px\" \/><\/figure>\n\n<h2><span class=\"ez-toc-section\" id=\"What_usually_fails_when_organisations_say_they_use_three_lines\"><\/span>What usually fails when organisations say they use three lines?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The failures are familiar, and they are managerial rather than theoretical.<\/p>\n<p>First line treats the risk register as a reporting chore. Second line produces frameworks nobody uses. Internal audit is late, polite, and crowded out of the issues that would actually move the board. Everyone assumes someone else has the risk. The diagram looks complete.<\/p>\n<p>A useful test, as an audit manager, is blunt:<\/p>\n<ul>\n<li>Has second line ever changed a first-line decision this year?<\/li>\n<li>Has internal audit reported something the executive did not want reported?<\/li>\n<li>Can a process owner name the control they own without looking at a slide?<\/li>\n<\/ul>\n<p>If the answers are no, the model is on the wall and not in the work. Training that only recites the three boxes will not fix that. Training that makes first-line managers identify and escalate risk, and audit managers plan against residual risk, might.<\/p>\n<p>If you need to put this into an annual plan, a control matrix, and fieldwork rather than another governance slide, review EPW\u2019s five-day <a href=\"https:\/\/www.epw.com\/training\/risk-based-auditing-and-internal-controls\">Risk Based Auditing and Internal Controls<\/a> course. It is built for audit and risk managers who have to evidence the third line, not just name it.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"FAQ\"><\/span>FAQ<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3><span class=\"ez-toc-section\" id=\"Is_the_three_lines_model_the_same_as_three_lines_of_defence\"><\/span>Is the three lines model the same as three lines of defence?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>No. The IIA\u2019s 2020 model keeps three kinds of role but drops the \u201cdefence\u201d framing, treats the lines as responsibilities rather than three departments, and includes the governing body. Many firms still use the older name in conversation.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Can_internal_audit_also_do_second-line_work\"><\/span>Can internal audit also do second-line work?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Only with a clear, time-limited mandate and a plan to restore independence. If audit designs or runs the control, it cannot later give independent assurance on that control.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Does_every_organisation_need_three_separate_departments\"><\/span>Does every organisation need three separate departments?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>No. Small organisations often combine first- and second-line tasks. What you cannot combine is independent assurance. If the same person owns the risk and \u201cassures\u201d it, you do not have a third line.<\/p>","protected":false},"excerpt":{"rendered":"<p>What is the three lines model for internal audit managers? The three lines model for internal audit managers is a way of splitting risk work so internal audit stays independent. First line owns and manages risk in the business. Second line advises, monitors, and challenges. Third line, internal audit, gives the board independent assurance. The&#8230;<\/p>\n","protected":false},"author":2,"featured_media":2041,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-290","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-courses"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.7 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Three Lines Model for Internal Audit Managers | EPW<\/title>\n<meta name=\"description\" content=\"How the three lines model works for internal audit managers: first-line ownership, second-line challenge, and independent third-line assurance to the board.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Three Lines Model for Internal Audit Managers | EPW\" \/>\n<meta property=\"og:description\" content=\"How the three lines model works for internal audit managers: first-line ownership, second-line challenge, and independent third-line assurance to the board.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management\" \/>\n<meta property=\"og:site_name\" content=\"Blog Categories - EPW Training\" \/>\n<meta property=\"article:published_time\" content=\"2025-12-14T01:09:31+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-24T08:25:31+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.epw.com\/blog\/wp-content\/uploads\/2026\/08\/03-3lod-featured.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1536\" \/>\n\t<meta property=\"og:image:height\" content=\"1024\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"has\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"has\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management\"},\"author\":{\"@type\":\"Organization\",\"name\":\"EPW Training Blog\",\"url\":\"https:\/\/www.epw.com\/blog\/\",\"@id\":\"https:\/\/www.epw.com\/blog\/#organization\"},\"headline\":\"Three Lines Model for Internal Audit Managers\",\"datePublished\":\"2025-12-14T01:09:31+00:00\",\"dateModified\":\"2026-08-24T08:25:31+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management\"},\"wordCount\":1031,\"publisher\":{\"@id\":\"https:\/\/www.epw.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management#primaryimage\"},\"thumbnailUrl\":\"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/08\/29130233\/03-3lod-featured.png\",\"articleSection\":[\"Courses\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management\",\"url\":\"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management\",\"name\":\"Three Lines Model for Internal Audit Managers | EPW\",\"isPartOf\":{\"@id\":\"https:\/\/www.epw.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management#primaryimage\"},\"thumbnailUrl\":\"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/08\/29130233\/03-3lod-featured.png\",\"datePublished\":\"2025-12-14T01:09:31+00:00\",\"dateModified\":\"2026-08-24T08:25:31+00:00\",\"description\":\"How the three lines model works for internal audit managers: first-line ownership, second-line challenge, and independent third-line assurance to the board.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management#primaryimage\",\"url\":\"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/08\/29130233\/03-3lod-featured.png\",\"contentUrl\":\"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/08\/29130233\/03-3lod-featured.png\",\"width\":1536,\"height\":1024,\"caption\":\"Internal audit managers mapping first, second, and third line roles on a governance diagram\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.epw.com\/blog\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Three Lines Model for Internal Audit Managers\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.epw.com\/blog\/#website\",\"url\":\"https:\/\/www.epw.com\/blog\/\",\"name\":\"Blog Categories - EPW Training\",\"description\":\"Expert Insights and Updates in Professional Training\",\"publisher\":{\"@id\":\"https:\/\/www.epw.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.epw.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.epw.com\/blog\/#organization\",\"name\":\"Blog Categories - EPW Training\",\"url\":\"https:\/\/www.epw.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.epw.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.epw.com\/blog\/wp-content\/uploads\/2025\/08\/epw-training-blog-logo.png\",\"contentUrl\":\"https:\/\/www.epw.com\/blog\/wp-content\/uploads\/2025\/08\/epw-training-blog-logo.png\",\"width\":746,\"height\":256,\"caption\":\"Blog Categories - EPW Training\"},\"image\":{\"@id\":\"https:\/\/www.epw.com\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.epw.com\/blog\/#person\",\"name\":\"EPW Training Blog\",\"url\":\"https:\/\/www.epw.com\/blog\/\",\"sameAs\":[\"https:\/\/www.epw.com\/blog\/\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Three Lines Model for Internal Audit Managers | EPW","description":"How the three lines model works for internal audit managers: first-line ownership, second-line challenge, and independent third-line assurance to the board.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management","og_locale":"en_US","og_type":"article","og_title":"Three Lines Model for Internal Audit Managers | EPW","og_description":"How the three lines model works for internal audit managers: first-line ownership, second-line challenge, and independent third-line assurance to the board.","og_url":"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management","og_site_name":"Blog Categories - EPW Training","article_published_time":"2025-12-14T01:09:31+00:00","article_modified_time":"2026-08-24T08:25:31+00:00","og_image":[{"width":1536,"height":1024,"url":"https:\/\/www.epw.com\/blog\/wp-content\/uploads\/2026\/08\/03-3lod-featured.png","type":"image\/png"}],"author":"has","twitter_card":"summary_large_image","twitter_misc":{"Written by":"has","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management#article","isPartOf":{"@id":"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management"},"author":{"@type":"Organization","name":"EPW Training Blog","url":"https:\/\/www.epw.com\/blog\/","@id":"https:\/\/www.epw.com\/blog\/#organization"},"headline":"Three Lines Model for Internal Audit Managers","datePublished":"2025-12-14T01:09:31+00:00","dateModified":"2026-08-24T08:25:31+00:00","mainEntityOfPage":{"@id":"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management"},"wordCount":1031,"publisher":{"@id":"https:\/\/www.epw.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management#primaryimage"},"thumbnailUrl":"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/08\/29130233\/03-3lod-featured.png","articleSection":["Courses"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management","url":"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management","name":"Three Lines Model for Internal Audit Managers | EPW","isPartOf":{"@id":"https:\/\/www.epw.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management#primaryimage"},"image":{"@id":"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management#primaryimage"},"thumbnailUrl":"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/08\/29130233\/03-3lod-featured.png","datePublished":"2025-12-14T01:09:31+00:00","dateModified":"2026-08-24T08:25:31+00:00","description":"How the three lines model works for internal audit managers: first-line ownership, second-line challenge, and independent third-line assurance to the board.","breadcrumb":{"@id":"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management#primaryimage","url":"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/08\/29130233\/03-3lod-featured.png","contentUrl":"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/08\/29130233\/03-3lod-featured.png","width":1536,"height":1024,"caption":"Internal audit managers mapping first, second, and third line roles on a governance diagram"},{"@type":"BreadcrumbList","@id":"https:\/\/www.epw.com\/blog\/courses\/how-to-train-employees-on-risk-management#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.epw.com\/blog"},{"@type":"ListItem","position":2,"name":"Three Lines Model for Internal Audit Managers"}]},{"@type":"WebSite","@id":"https:\/\/www.epw.com\/blog\/#website","url":"https:\/\/www.epw.com\/blog\/","name":"Blog Categories - EPW Training","description":"Expert Insights and Updates in Professional Training","publisher":{"@id":"https:\/\/www.epw.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.epw.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.epw.com\/blog\/#organization","name":"Blog Categories - EPW Training","url":"https:\/\/www.epw.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.epw.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.epw.com\/blog\/wp-content\/uploads\/2025\/08\/epw-training-blog-logo.png","contentUrl":"https:\/\/www.epw.com\/blog\/wp-content\/uploads\/2025\/08\/epw-training-blog-logo.png","width":746,"height":256,"caption":"Blog Categories - EPW Training"},"image":{"@id":"https:\/\/www.epw.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.epw.com\/blog\/#person","name":"EPW Training Blog","url":"https:\/\/www.epw.com\/blog\/","sameAs":["https:\/\/www.epw.com\/blog\/"]}]}},"_links":{"self":[{"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/posts\/290","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/comments?post=290"}],"version-history":[{"count":7,"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/posts\/290\/revisions"}],"predecessor-version":[{"id":2059,"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/posts\/290\/revisions\/2059"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/media\/2041"}],"wp:attachment":[{"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/media?parent=290"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/categories?post=290"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/tags?post=290"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}