By Anthony Fitzsimmons A ‘Three lines of Defence’ risk management model sounds reassuring, but it contains a flaw.   The model was implicitly endorsed by the UK’s now defunct Financial Services Authority in 2003 and is still characterised as “sound operational risk governance” by the Basel Committee on Banking Supervision, failed to prevent the recent financial sector crisis. ‘Three lines of defence’, ubiquitous in financial services and widespread elsewhere, actually has four layers.  Line managers deal with risks as they take them. Centralised teams monitor and report on risk to the CEO’s team and to the board. Internal and external auditors should bring an independent […]