TIAPS Module 1 Audit and Assurance workbook

defensive aspects to minimize negative impacts. The model also stresses the importance of
all key elements working together rather than operating in silos.
Governance is described as comprising three types of roles:
• Accountability.
• Actions.
• Assurance.
Figure: IIA Three Lines Model
This does not imply these roles need to be fully disaggregated and often teams and
individuals may have responsibilities combining two of these areas.
Accountability: The governing body is regarded as having ultimate accountability to
stakeholders for all aspects of the organization and its people. It must engage with
stakeholders to ensure clarity of purpose and provide honest reporting of performance,
position, and prospects. The governing body is also responsible for ensuring
management has the resources and structures needed to achieve the goals of the entity
and manage risks effectively. Lastly, the governing body must ensure there is
appropriate provision for independent assurance and advice through an internal audit
function.
Actions: The chief executive officer (CEO) leads the execution of actions and application
of resources in pursuit of organizational goals. In doing so, the CEO must take account
of risk by enabling risk management and internal control. First line roles are those
focused on providing products and services to clients as well as the enabling "back
office" support. Second line roles (such as risk management, compliance, legal counsel,
security, and financial control) are those with a specific focus on risk and control,
providing senior management with specialist support, expertise, monitoring, and
challenge on such matters. How resources and roles are allocated between first and
17