Home > News and Advocacy > Our Presence > Past Events > Year 2026 Events > Beyond the Three Lines: Rewiring Assurance for Risks That Refuse to Stay in One Box

Beyond the Three Lines: Rewiring Assurance for Risks That Refuse to Stay in One Box

As risks become more interconnected and increasingly difficult to assess in isolation, organisations need assurance approaches that bring together different areas of expertise and provide a clearer picture of the risks they face. This calls for closer coordination across risk management, compliance and internal audit, while maintaining the distinct responsibilities of each.

This was the focus of IIA Singapore’s recent webinar, “Beyond the Three Lines: Rewiring Assurance for Risks That Refuse to Stay in One Box”, featuring Dr Matej Drascek, President of IIA Slovenia.

The discussion examined how different assurance providers may assess risks using different rating scales, reporting approaches and review cycles. While each provides an important perspective, these differences can make it difficult to connect findings, understand how risks interact and identify gaps in coverage. In some instances, several teams may review the same controls while overlooking the dependencies and exposures between them.

The Three Lines Model remains an important foundation for defining responsibilities and maintaining accountability. Building on this foundation, the session explored how stronger connections between the lines, supported by better coordination and information-sharing, can provide a more coordinated view of risk. This does not mean blurring responsibilities. Management retains ownership of risks and responses, while internal audit maintains its independence and objectivity in providing assurance.

Participants were also introduced to a four-stage approach to integrated assurance, from parallel work to adaptive integrated assurance. The discussion highlighted that integration need not look the same across an organisation. Highly interconnected and fast-evolving risks may benefit from closer coordination, while more stable and well-understood risks may require a different approach.

Ultimately, the focus is not on achieving the highest level of integration across the board, but on finding the right degree of connection for each risk. This helps ensure that assurance efforts remain relevant and that boards and management have a clearer view of the risks that require their attention.