1. 2017 Administration and Finance Conference
Lines of Defense Model
Scott Lawlor, Senior Internal Auditor, Office of University Audit

2. Understanding the Lines of Defense Model
Internal controls are a set of systems and processes that help to ensure that the University achieves its:
Operational goals
Internal and external financial reporting goals
Legal and regulatory compliance goals
In order to achieve these goals, we need to have in place an effective model across the institution and this is the Lines of Defense Model

3. Lines of Defense Model

4. Lines of Defense Model
Board of Trustees, Audit and Risk Committees & Executive Management
Perform an essential role in the Lines of Defense model
Ensures model is reflected in the University’s risk management and control processes
Responsible and accountable for:
Setting objectives
Defining strategies to achieve those objectives
Establishing governance structures and processes to best manage the risks in accomplishing those objectives
Implementing an Enterprise Risk Management function
Provides active support and guidance when implementing the model

5. Lines of Defense Model
1st Line of Defense - Business Operations: Departmental, Operational and Functional Management
Maintain effective internal controls within a defined area; risks are owned
Execute risk and control procedures on a day-to-day basis
Identify, assess, control and mitigate risks
Guide the development and implementation of internal policies and procedures
Ensure activities are consistent with goals and objectives
Managerial and Supervisory review

6. Lines of Defense Model
2nd Line of Defense - Oversight Functions: Risk Assurance Functions (Academic and Medical)
Ensure Business Operation controls are properly designed, in place and operating as intended. Typically include:
Internal Control Assurance Processes
Controllership for financial risks and reporting
Provide guidance and training on the risk management process
Monitor the adequacy and effectiveness of internal control, accuracy of reporting, compliance and timely remediation of deficiencies
Program Audits of grants and contributions
Management oversight committees (IT, HR, Program)
Report risk-related information organization-wide

7. Lines of Defense Model
3rd Line of Defense - Independent and Objective Assurance: Internal Audit
Act in accordance with recognized audit standards
Perform duties independently and objectively
Active and effective reporting line to the Governing Body
Ethics, Investigations, Whistleblower, etc.
Key is independence and reporting lines
Must report internally to the Governing Body
Utilize “best practices” approach based on assessing risks to focus audits
Flexible process to adapt to the specific of each engagement

8. Lines of Defense Model Key Takeaways
Not a standalone solution to effective risk management, but rather a component of the overall process.
Enhances the University’s risk management strategy with greater efficiency and effectiveness
Model needs to be supported by an active, ongoing initiative and an appropriate organizational mandate
Appropriate leadership, accountability, clearly articulated objectives and active performance measures
Oversight by both Executive Management, the Board of Trustees and Audit/Risk Committees
Continuous fine tuning and improvements must be implemented