Beyond the three lines: Building the links for integrated assurance

Contemporary risks move readily across functions, systems, and legal entities, yet the Three Lines Model is still commonly read as a diagram of separation. The result can be paradoxical: an organization may have several competent assurance providers and still lack a coherent view of cybersecurity, artificial intelligence, operational resilience, or third-party dependency. Drawing on the Institute of Internal Auditors’ 2026 Statements of Position on the Three Lines Model and enterprise risk management, the Global Internal Audit Standards, and research on boundary work and cross-functional cyber risk assessment, this conceptual article develops a “lines-to-links” framework for integrated assurance. Its vertical architecture preserves accountability, management ownership, and internal audit independence. Across those lines, five horizontal links connect knowledge through shared risk language, aligned assessment and challenge, explicit response ownership, coordinated monitoring and reliance, and synthesized reporting. Rather than equating integration with role blending, the framework treats it as disciplined connection. It also identifies safeguards for objectivity and offers a four-stage maturity model and implementation roadmap. Within this design, internal audit becomes an assurance integrator—not the owner of enterprise risk management, but the function best placed to assess whether governance, risk management, compliance, and control operate as a coherent system.