Three Lines of Defence = No Defence
We seem to have become obsessed with the concept of three lines of defence.
If you can demonstrate to your regulators that you have such a framework they will breathe a sigh of relief.
The bad news is that it does not work.
Firstly the first line of defence just does not see its role as thinking defensively.
Secondly the second line of frequently sees its role as proposing policy, monitoring implementation but never being accountable for any mishaps.
If you don’t believe me try a test in your organisation.
Concoct a hypothetical case study of a disaster (It is important that it is hypothetical).
Ask each line of defence to consider an admission of accountability.
I would be shocked if there are any volunteers.
I yearn for the days of segregation of duties and dual control.