---
type: GlossaryTerm
id: https://w3id.org/ktl/knowledge/glossary/three-lines-of-defence
title: Three lines of defence
description: The model regulated industries use to say who owns a risk, who keeps the rules and who checks independently, whose reference version is the IIA's Three Lines Model. In Knowledge Trust Ladder the librarian and the curator are the first line, the registrar the second, and the bundle holds the evidence a third line would need.
definition: The model regulated industries use to say who owns a risk, who keeps the rules, and who checks independently.
genre: reference
resource: docs/three-lines.md
sources:
  - resource: docs/three-lines.md
  - resource: docs/architecture.md
relatedTo:
  - https://w3id.org/ktl/knowledge/explanation/three-lines-of-defence
  - https://w3id.org/ktl/knowledge/glossary/librarian
  - https://w3id.org/ktl/knowledge/glossary/curator
  - https://w3id.org/ktl/knowledge/glossary/registrar
generated:
  by: process:ktl-librarian
  at: "2026-10-13T15:08:54Z"
status: draft
verified:
  - by: process:ktl-librarian
    at: "2026-10-29T00:48:33Z"
---

# Overview

Regulated industries use the **three lines of defence** to say who owns a risk, who keeps the rules, and who checks independently. The reference version is the Three Lines Model of The Institute of Internal Auditors (IIA), updated in 2020.

In Knowledge Trust Ladder the [librarian](librarian.md) and the [curator](curator.md) are the first line, the [registrar](registrar.md) the second, and the bundle holds the evidence a third line would need ([three lines of defence](../explanation/three-lines-of-defence.md)).