This document discusses the three lines of defense model for risk management and internal controls. The first line of defense comprises operational management who implement controls on a daily basis. The second line involves risk management and compliance functions that assess risks and monitor control implementation. The third line provides independent assurance through internal audit functions on the effectiveness of governance, risk management and controls, including the work of the first two lines. The document also notes challenges in aligning risk, control and assurance practices in Indonesia and how COBIT 5 can provide frameworks to address these challenges.

1. Discussion Material
The Three Lines of Defence
H.S. Widhanto, CIA, CISA, CRISC, CRMA

2. H.S. Widhanto, CIA, CISA, CRISC, CRMA
IT Governance, Risk Management, Internal Control and Assurance Pratitioner
• Independent Commissioner and Audit Committee Chairman
PT. Bina Artha Ventura (Microfinance)
• Risk Management Adviser
PT. Perusahaan Gas Negara (Persero) Tbk,
• Risk Management Committee Member
PT. Petrokimia Gresik
• Partner and Director
PT. Centria Integrity Advisory
1

3. Three Lines of Defence: The Generic Model2
1st Line 2nd Line 3rd Line
Executive: Senior Management
Oversight Body
Audit
Committee
Risk Management
Committee
Operational
Management Function
Risk Management -
Compliance Function
Internal Audit Function
• Maintain and
implement controls on
a day-to-day basis
• Assess, communicate,
and mitigate risks
• Facilitate and monitor the
implementation of risk
management practices by
the operational
management function
• Report adequate risk-
related information
throughout the
organization
• Monitong compliance to
regulations
Provides assurance
on the effectiveness of
governance, risk
management, and internal
controls, including the
effectiveness of the first and
second lines of defence

4. Today’s Challenges in Indonesia
Unaligned risk, control, assurance practices within and organisation
Symptom:
1. No common language and framework
2. No common framework
3. Unaligned policies and procedures pertaining to risk management,
control and assurance
Capacity building paradox
Symptom:
The first line of defence experiences the least amount of risk
management (and control) training
Low (unacceptable) level of risk management maturity in place
Symptom:
The Internal Audit function could not rely on the risk management reports
produced by the Risk Management function
3

5. The Three Lines of Defence (for IT) :
Using COBIT 5 as Reference Framework
4
Lines of
Defence
Main Concerns What does COBIT 5 provide ? Remarks
Adequate IT processes
and controls design
A set of common IT processes and
controls as the basis for designing
an integrated IT policies and
procedures
• Adequate and
implementable IT risk
management
framework, policies and
procedures
• Enhance maturiy level
COBIT 5 For Risk
(currently under developmment)
Risk IT:
• End-to-end implementation
framework
• Maturity level enhancement
programmes
COBIT 5 builds on
previous versions of
COBIT, Val IT and
Risk IT so
organisations can
also refer to Risk IT
for this purpose
Effective risk based IT
audit process and audit
programmes (audit
procedures)
Assurance guide that provides the
basis for practical audit
programmes ( IT control
effectiveness testing procedures)
1st Line
2nd Line
3rd Line