As credit cycles shift and portfolios grow more volatile, regulators, boards, and executive teams are placing renewed emphasis on how credit risk is governed and not just how it is underwritten. At the center of that conversation is the Three Lines of Defense framework.
While often discussed at a high level, the Three Lines of Defense is not an abstract risk concept. In practice, it shapes how financial institutions originate credit, monitor risk, challenge decisions, and demonstrate control effectiveness to regulators. Institutions that clearly define and execute each line are better positioned to identify emerging risk early, respond consistently, and withstand regulatory scrutiny. The Three Lines of Defense include the following:
First Line of Defense: Owning & Managing Credit Risk
The first line of defense consists of the business units that originate, approve, and manage credit exposure on a daily basis. This typically includes relationship managers, lenders, underwriters, credit analysts, and portfolio management teams.
In a credit risk context, the first line is responsible for:
- Structuring and underwriting loans in accordance with credit policy
- Assigning and maintaining accurate risk ratings
- Monitoring borrower performance and collateral
- Identifying early warning signs and escalating concerns
- Initiating risk rating changes and corrective actions in a timely manner
Importantly, the first line owns the risk it creates. Risk management doesn’t begin after a loan is approved. It begins at origination and continues throughout the life of the credit.
Second Line of Defense: Independent Credit Risk Oversight
The second line of defense provides independent oversight and challenges the first line. This role typically includes credit risk management, credit administration, chief credit officers, and related committees.
Key responsibilities of the second line include:
- Establishing and maintaining the credit risk framework and risk rating methodology
- Reviewing and challenging underwriting decisions and risk grades
- Monitoring portfolio‑level trends, concentrations, and emerging risks
- Enforcing adherence to credit policy and board‑approved risk appetite
- Providing senior management and the board with independent risk reporting
An effective second line does not duplicate the work of lenders. However, it ensures that credit decisions are consistent, supportable, and aligned with the institution’s risk tolerance.
Third Line of Defense: Independent Assurance
The third line of defense provides independent assurance that the credit risk framework is functioning as intended. This role is typically performed by loan review professionals.
In the credit risk environment, third‑line activities focus on:
- Gauging the accuracy and timeliness of risk ratings
- Evaluating underwriting quality and policy compliance
- Testing the effectiveness of credit administration and monitoring practices
- Identifying systemic issues across portfolios or lines of business
- Reporting findings independently to senior management and the board
A strong third line doesn’t directly manage credit risk. Instead, it confirms whether the first and second lines are operating effectively, and whether weaknesses are being identified and addressed in a timely manner.
Why the Three Lines of Defense Matter Right Now
During periods of economic stress or transition, gaps between the lines of defense tend to widen. Common issues that regulators, loan review, and auditors identify include overreliance on the first line without adequate challenge, second-line oversight that is informal or inconsistently documented, loan review focused on technical exceptions rather than risk outcomes, and lack of clear accountability for emerging or deteriorating credits.
When the Three Lines of Defense aren’t well aligned, institutions may miss early warning signs, delay risk rating changes, or struggle to explain credit decisions under regulatory review.
On the other hand, institutions with a clearly defined and well‑executed Three Lines framework tend to demonstrate timelier identification of emerging credit risk, more consistent risk ratings across portfolios, stronger governance and board reporting, and greater confidence during examinations and audits.
Aligning the Lines: Practical Considerations
Effective use of the Three Lines of Defense is more about clarity of roles and expectations than organizational charts. Leading practices include clear documentation of responsibilities across all three lines, defined escalation and challenge protocols, consistent use of risk rating definitions and performance indicators, loan review scope that assesses risk judgment and not just compliance, and open communication while maintaining appropriate independence.
Alignment doesn’t mean everyone always agrees. In fact, constructive challenge between the lines is a hallmark of strong credit risk governance.
How Forvis Mazars Can Help
Forvis Mazars supports financial institutions across all three lines of defense through our Loan Review and Credit Risk Services. Our professionals understand how regulators evaluate credit risk governance and how institutions can strengthen oversight without compromising efficiency.
Whether through independent loan reviews, co‑sourced credit risk support, or assessments of credit administration practices, we help institutions bridge gaps between policy, practice, and regulatory expectation. If you have any questions or need assistance, please reach out to a professional at Forvis Mazars.