The three lines of defence model is well established across financial services.

• First line owns and manages risk.
• Second line provides oversight, challenge and compliance.
• Third line provides independent assurance.

For a large bank, with thousands of employees and multiple business divisions, those lines can translate naturally into separate teams. But does the same organisational structure make sense for a smaller Isle of Man Corporate Service Provider or Trust Service Provider?

Perhaps we should focus less on the number of lines and more on what those lines are actually intended to achieve. The regulatory requirement is about effective governance.

For Class 4 and Class 5 licenceholders, the Financial Services Rule Book requires effective corporate governance arrangements appropriate to the size of the licenceholder and the nature of its business.

It also requires appropriate segregation of key duties and functions.

Those are important requirements.

But proportionality is equally important.

A smaller fiduciary business should have controls which reflect its activities, clients, risk profile and organisational structure. It should not create additional layers simply so that its organisation chart resembles that of a much larger financial institution.

What could an effective two-line model look like?

For a smaller CSP or TSP, the first line would normally consist of the directors, managers and administrators responsible for delivering services to clients.

• They make the decisions.
• They manage the relationships.
• They identify and manage the risks arising from the work they undertake.

Crucially, they also own those risks.

Compliance should not assume ownership of every regulatory risk simply because a matter has a compliance element. The second line should provide genuine oversight and challenge.

The Financial Services Rule Book requires the Head of Compliance to have appropriate independence, direct access to the responsible officers, unfettered access across the business and sufficient time and resources to perform the role properly. The FSA’s Licensing Policy also expects the Head of Compliance role to be separated from operational roles.

It is intended to be capable of challenging the first.

Where does the Board fit?

The Board remains responsible for the governance of the licenceholder.

A two-line operating model should not result in responsibility drifting towards Compliance.

Directors should understand the risks being taken by the business, satisfy themselves that controls remain effective and respond appropriately when Compliance identifies weaknesses.

For smaller businesses, good resilient governance often depends more on the clarity of responsibility than on creating another department.

But who checks Compliance?

This is probably the most important challenge to a two-line model. If Compliance monitors the business, who independently tests whether Compliance itself is working effectively?

The answer should not be “nobody”.

A two-line operating model still needs credible independent assurance. For a smaller CSP or TSP, however, that assurance does not necessarily have to be delivered through a permanent internal audit department.

Depending upon the size, nature and risk profile of the business, independent assurance might include:

• Periodic external compliance reviews.
• Independent AML/CFT testing.
• Targeted reviews of higher-risk areas.
• Independent file sampling.
• Specialist reviews following regulatory change.
• Board-commissioned testing of specific controls.
• Periodic reviews of the Compliance function itself.

The important issue is whether the testing is genuinely independent and sufficiently robust. This is particularly relevant for smaller businesses.

A firm may describe itself as having three lines of defence, but if the same two or three individuals move between those lines, the apparent separation may provide little genuine challenge.

Adding another box to an organisation chart does not automatically improve governance. It may simply create an artificial distinction between functions which the business does not have the resources to operate independently.

A well-designed two-line structure can sometimes be clearer.

• The first line owns and manages the risk.
• The second line independently challenges and monitors it.
• The Board oversees both.

Additional independent assurance is brought in where necessary to test whether the framework is actually working.

That model may be more transparent than trying to manufacture a permanent third line simply because the terminology is familiar.

Proportionality should not mean reduced standards

There is an important qualification.

A two-line structure cannot be used to justify weaker controls.

• It cannot mean that Compliance reviews its own work.
• It cannot mean that directors delegate regulatory responsibility.
• It cannot mean that independent testing disappears.
• The question is not whether assurance is necessary.

It is how that assurance should be delivered proportionately.

For a smaller Class 4 or Class 5 business, the answer may be to retain two effective operational lines while commissioning genuinely independent assurance according to the risks faced by the business.

What should Boards ask?

Rather than asking:

•       “Do we have three lines of defence?”

A Class 4 or Class 5 Board might ask:

• Who owns each material risk?
• Who challenges the person taking that risk?
• Does Compliance have sufficient independence and authority?
• Are operational and Compliance responsibilities properly separated?
• Can Compliance escalate concerns directly to the Board?
• Who independently tests whether our controls work?
• Who tests the effectiveness of Compliance itself?
• Does the level of assurance reflect the size, complexity and risk profile of our business?
• Can we demonstrate the effectiveness of our structuring to the FSA?

Those questions tell us considerably more about the quality of governance than the number of boxes on an organisation chart. Good governance should be proportionate.

Three lines of defence is a useful framework. But it is a framework, not an objective in itself.

For smaller CSPs and TSPs, the regulatory objective should be an effective control environment with clear accountability, genuine challenge, appropriate segregation and credible independent assurance. If two strong lines, supported by independent testing, achieve that more effectively than three artificial ones, that deserves serious consideration.

The objective is not to reduce compliance.

It is to make compliance work properly for the business. That protects clients, supports the Board and allows smaller regulated businesses to direct their resources towards the risks that operationally matter.