First-Line Controls
Definition
Controls owned and operated by the business units and IT functions that process or store information. The first line is accountable for day-to-day control effectiveness and for reporting upward when controls fail or gaps are identified.
- Owner
- Business units and IT functions
- Model
- Three lines of defence
- Responsibility
- Day-to-day control operation and effectiveness
- Escalation duty
- Report failures or gaps upward
Common questions
How do first-line controls differ from second-line oversight?+
First-line controls are operated directly by the people doing the work, such as an IT administrator applying a patch or an analyst approving a transaction. Second-line functions like risk or compliance do not perform the control themselves but monitor and challenge whether first-line controls are working.
What happens when a first-line control fails silently?+
If the business unit does not report the failure, the gap only surfaces later through second-line testing or an incident, by which point exposure has already accumulated. This is why the first line's reporting duty is treated as part of the control itself, not an optional extra.
Related terms
- Audit Committee
- A sub-committee of the board of directors composed principally of independent non-executive directors, responsible for overseeing financial reporting, internal controls, and the...
- CISO (Chief Information Security Officer)
- The senior executive responsible for developing and maintaining the information security programme. The CISO reports to the board or a board committee...
- Second-Line Oversight
- The risk management and compliance functions, including the CISO office and the risk function, that set policy, monitor control effectiveness across the...
- Security Steering Committee
- A cross-functional management body, typically chaired by the CISO or Chief Risk Officer, that coordinates security priorities across business units, approves major...
- Three Lines of Defence
- A governance model that separates security responsibility into three distinct layers: operational management that owns controls (first line), risk and compliance functions...