The IIA's Three Lines Model (2020)

The IIA's Three Lines Model (2020) — 38% of in-scope requirements covered.

6 requirements · 6 in scope (3 designed · 3 advisory). The 38% is weighted over the in-scope base.

The IIA's Three Lines Model (2020): requirement → the KYE™ artefact that enforces it

Demo data

You learn: Which requirements KYE™ enforces at runtime and with which artefact. You can: Walk the requirements.

  1. principle-1 · designed

    Principle 1 — Governance: accountability, assurance and structures

    Constitution: 12 purpose permission, 36 governedui

  2. principle-4 · designed

    Principle 4 — Third line role: independent and objective assurance

    Constitution: 21 delegated auditability

  3. principle-6 · designed

    Principle 6 — Creating and protecting value: aligned, coordinated assurance

    Constitution: 13 resilience loop, 12 purpose permission

  4. principle-2 · advisory

    Principle 2 — Governing body roles: oversight with integrity and transparency

    Constitution: 13 resilience loop · Audit events: kye.evidence.pack.v1

  5. principle-3 · advisory

    Principle 3 — First and second line roles: operational authority and risk/compliance

    Constitution: 12 purpose permission · Audit events: kye.evidence.decision_map.v1

  6. principle-5 · advisory

    Principle 5 — Third line independence: verifiable without dependence on the first/second line

    Constitution: 13 resilience loop · Audit events: kye.replay.proof.v1

How this widget is built
Demonstrates
KYE™ Compliance Mapping Rail™
Components
  • Framework requirement (clause)
  • Coverage status
  • KYE™ enforcement artefact (event, decision-record field, Evidence Pack™ entry)
Flow
Clause → status → the KYE™ artefact that enforces it, enforced requirements first. Architecture diagram
Used on

Source: The Institute of Internal Auditors — The IIA's Three Lines Model (2020 update of the Three Lines of Defence). KYE Protocol™ maps each of the six principles to the authority, evidence and assurance primitives that make AI-agent actions governable across the first line (operational management), second line (risk and compliance), and third line (internal audit). KYE™ supplies the runtime authority + evidence layer the model assumes; it does not replace any line's people or mandate. · License: IIA — model text is copyrighted; KYE™ registry paraphrases each principle's intent and cites the principle number for mapping purposes only.

By category

CategoryReqsEnforcedDesignedAdvisoryDeferredCoverage
Governance2011038%
Roles2011038%
Assurance and value2011038%

Every requirement → the KYE™ artefact that enforces it

IDTitleStatusKYE™ enforcement
three-lines.principle-1Principle 1 — Governance: accountability, assurance and structuresdesignedconstitution_refs: constitution/12-PURPOSE-PERMISSION.md, constitution/36-GOVERNEDUI.md
three-lines.principle-2Principle 2 — Governing body roles: oversight with integrity and transparencyadvisoryconstitution_refs: constitution/13-RESILIENCE-LOOP.md
audit_events: kye.evidence.pack.v1
three-lines.principle-3Principle 3 — First and second line roles: operational authority and risk/complianceadvisoryconstitution_refs: constitution/12-PURPOSE-PERMISSION.md
audit_events: kye.evidence.decision_map.v1
three-lines.principle-4Principle 4 — Third line role: independent and objective assurancedesignedconstitution_refs: constitution/21-DELEGATED-AUDITABILITY.md
three-lines.principle-5Principle 5 — Third line independence: verifiable without dependence on the first/second lineadvisoryconstitution_refs: constitution/13-RESILIENCE-LOOP.md
audit_events: kye.replay.proof.v1
three-lines.principle-6Principle 6 — Creating and protecting value: aligned, coordinated assurancedesignedconstitution_refs: constitution/13-RESILIENCE-LOOP.md, constitution/12-PURPOSE-PERMISSION.md

Canonical KYE™ surfaces referenced on this page: KYE Protocol™.