Operational risk and the three lines of defence in UK financial institutions: is three really the magic number?

Research output: Contribution to journal › Article



View graph of relations

Original languageEnglish
Pages (from-to)53-69
Number of pages17
JournalJournal of Operational Risk
Issue number1
Early online date14 Feb 2017
StatePublished - Mar 2017


Interest in financial services firms developing and implementing robust systems and structures to manage operational risk has been growing. While there now appears to be some consensus in terms of definitions, quantification and modeling, firms are struggling with the qualitative side of operational risk management (ORM). This is particularly the case for financial institutions’ operational risk governance, where the three lines of defence model has become standardized. At the same time, corporate scandals post-financial crisis continue to indicate deficiencies in operational risk governance. Our paper examines the three lines of defence in the context of ORM in UK financial institutions. It focuses on roles and responsibilities and then analyzes the effectiveness of the traditional three lines of defence model. We find a lack of common understanding of the lines of defence in financial institutions, which leads to the duplication of roles and gaps in coverage. This is concerning for the industry, the economy and regulators.


  • operational risk, financial services firms