Last week I blogged about Overstepping the 3 Lines, where I highlight the biggest criticism of the Three Lines Model, (my opinion and that of many practitioners), it does nothing to build TRUST between the Risk Team as advisers to the business and those making the decisions to take risk.

Unfortunately, it is the model of choice of many regulators, including the Australian regulator of the finance sector, APRA. Check out the Industry Dynamics figure below. You can see that for all three players, the regulators, the risk function and the business itself, they all want the same thing. They want “good” customer outcomes. However, that is where the similarities end.

What do regulators want? They want to be an effective regulator. They don’t want organisations failing on their watch and they don’t want poor behaviour by organisations they regulate.

What does the risk function want? It wants to be heard and to become a trusted adviser to the business.

And the business? The leaders of the business want the organisation to be an industry leader. In the for-profit sector, that means great returns for shareholders in a financially and environmentally sustainable fashion while being socially responsible. In the not-for-profit and public sectors, it means impact while maintaining integrity with all key stakeholders. Whether that be through sound fiscal, ethical or any other area of management.

In order to achieve their goals, the regulator demands red tape. The risk and compliance functions duly answer the call and create red tape. And the business? Well they spend the rest of the time trying to avoid red tape. That is, to avoid processes they see as non-value adding.

The result? Despite decades of trying to implement the predecessor to the Three Lines Model we had a Royal Commission into the finance sector here in Australia with damning story after damning story about poor conduct, poor controls and poor decision making around vulnerable customers. Has the shift to the revised Three Lines Model made a difference? You could argue it’s too early to tell, however, let me quote one of my readers in response to my blog last week:

“The so called 3 lines model is not risk management, it is compliance, especially in Financial Institutions. We have lost the plot along the way. But …… some of us push on regardless trying to get risk back into management.”