Leveraging COSO Across the Three Lines of Defense

By Douglas J. Anderson and Gina Eubanks · Committee of Sponsoring Organizations of the Treadway Commission · 2015 · CFE101-102-25

Study guide: Exam CFE-101

A July 2015 paper by The Institute of Internal Auditors, commissioned by COSO, that relates the COSO Internal Control – Integrated Framework to the Three Lines of Defense Model. It aims to help organizations articulate and assign specific roles and responsibilities for internal control, so that there are neither gaps in addressing risk and control nor unnecessary duplication of effort.

On the syllabus

• Exam CFE-101 — CFE101-102-25: Leveraging COSO Across the Three Lines of Defenses; outcomes 1.2a-1.2d, 1.3a.

Introduction

Executive Summary

I The Three Lines of Defense Model

• Roles of Senior Management and the Board of Directors in the Three Lines of Defense Model
• The First Line of Defense: Operational Management
• The Second Line of Defense: Internal Monitoring and Oversight Functions
• The Third Line of Defense: Internal Audit
• External Auditors, Regulators, and Other External Bodies

II Structuring and Coordinating the Three Lines of Defense

• Structuring the Three Lines of Defense
• Coordinating the Three Lines of Defense

III Leveraging COSO across the Three Lines of Defense

IV Conclusion

• Key Observations

Appendix

About the Authors

About COSO

About The IIA

Sources

• Leveraging COSO Across the Three Lines of Defense (COSO and The Institute of Internal Auditors, July 2015) — the document: title page, authors, contents page, and the executive summary and introduction for the lead
• CFE 101 Syllabus, Nov 2026/Mar 2027/Jul 2027 (SOA) — the reading code, its title in the SOA's wording and the learning outcomes
• CFE 101 Study Note appendix (SOA, 2026) — lists CFE101-102-25 under its former code ERM-131-18