Operational risk and the three lines of defence in UK financial institutions: is three really the magic number?

Kumbirai Mabwe, Patrick John Ring, Robert Webb

    Research output: Contribution to journalArticle

    131 Downloads (Pure)


    Interest in financial services firms developing and implementing robust systems and structures to manage operational risk has been growing. While there now appears to be some consensus in terms of definitions, quantification and modeling, firms are struggling with the qualitative side of operational risk management (ORM). This is particularly the case for financial institutions’ operational risk governance, where the three lines of defence model has become standardized. At the same time, corporate scandals post-financial crisis continue to indicate deficiencies in operational risk governance. Our paper examines the three lines of defence in the context of ORM in UK financial institutions. It focuses on roles and responsibilities and then analyzes the effectiveness of the traditional three lines of defence model. We find a lack of common understanding of the lines of defence in financial institutions, which leads to the duplication of roles and gaps in coverage. This is concerning for the industry, the economy and regulators.
    Original languageEnglish
    Pages (from-to)53-69
    Number of pages17
    JournalJournal of Operational Risk
    Issue number1
    Early online date14 Feb 2017
    Publication statusPublished - Mar 2017



    • operational risk
    • financial services firms

    Cite this