I recently spoke on a panel session at the 1LoD Conference in Hong Kong. The title of the session was ‘The Role of the 1stline within the evolving 3 lines of defence’ and as part of this I was asked what Asia could learn from the experience of implementing the Three Lines of Defence (3LoD) in Europe.
It is easy to give piecemeal answers to a question like this, and provide an eclectic list of issues like a lack of coordination and duplication between the lines of defence. Useful though these soundbites might be, they do not provide much of a context for thinking about how to design an effective 3LoD framework. In thinking about how to give a more useful answer it struck me that the 3LoD model bears a strong resemblance to the engineering control systems I worked with earlier in my career. As we did not have time to explore this in detail during the panel I thought it would be useful to provide more details in a follow up note.
In this note we consider a simple ‘control system’ view of the 3LoD and how it helps to provide a context for some of the current challenges of 3LoD implementations. In a later note we consider how this view can be used to guide the design of a 3LoD model which better fulfils the various objectives.
What is a control system?
In engineering terms a control system regulates the behavior of other devices or systems using one or more control loops. These control loops contain the following elements (see figure 1):
A simple example of a control loop is regulating the temperature of a room with a thermostat and heater. Say we want to hold the temperature of the room at 20°C (set-point). The thermostat (controller) measures the temperature of the room (sensor) and switches the heater (actuator) on if the actual temperature is below the desired temperature. This is referred to as “closing the loop”
Figure 1: A simple control loop
In control engineering parlance, the 3LoD collectively could be thought of as a control system that monitors the actual business risk versus the firm’s risk appetite, and takes appropriate actions (Figure 2).
Figure 2: 3LoD as a control system
At a more granular level, each of the three lines of defence represents one or more individual control loops, e.g. pay/reward and conduct. Interactions between the different control loops and the lines of defence add to the overall complexity; in control engineering terms this is referred to as a multivariable control system.
There are a wide range of mathematical methods used to design control systems. While these work well with systems that can be modelled with some degree of accuracy, like robots, clearly organisations, people and their behaviours are less easily modelled. Nevertheless, many of the principlesof good control design still apply.
In fact, I would argue that many of the challenges that are being experienced with existing 3LoD frameworks are a legacy of the somewhat iterative and experimental way in which they have grown up. This being the case, looking at them through a more ‘scientific’ and less subjective lens may provide insight into where things could be improved.
Typical challenges of current 3LoD frameworks
Now that 3LoD frameworks have been running for a number of years a number of challenges are starting to become apparent:
A control engineer’s view of the challenges
Figure 3 explodes the simple view shown earlier to illustrate some of the complexity of the practical interactions that take place in typical 3LoD implementations. At the same time it starts to indicate the areas where challenges can arise:
Figure 3: 3LoD Control Loops
In the 1LoD panel session I gave a simple if apocryphal illustration of how poor control design can lead to both inefficiency and a poor outcome. For obvious reasons, most houses in Hong Kong have air conditioning but not central heating. In 2016 Hong Kong experienced a rare cold snap (3.1°C) which was the lowest temperature the territory had seen for 57 years. A cautious person might decide to install a heater in their house alongside the air-conditioner. Now we have both working alongside each other. Imagine if the heater was set to maintain the temperature in the room at 20°C and the air-conditioner was set to 16°C. Above 20°C and below 16°C the system would appear to operate efficiently with either the heater or the air-conditioner running but not both. However, once the temperature is in the range 16-20°C both machines are on and working at cross-purposes with the heater trying to increase the temperature and the air-conditioner working to reduce it. Eventually they may settle out at some sort of equilibrium but at a greater (ongoing) energy expenditure and achieving neither machine’s target temperature. Obviously, no sensible person would manage the temperature in a room that way. I leave you to draw the parallels.
About the Author: Anthony Fraser
I am an advisor with GD Financial Markets, working alongside the partners to develop client offerings. I have extensive experience in financial service operations including technology implementation and regulatory processes, having run Global Operations for an investment bank and more recently as Head of Digital Operations for corporate and institutional businesses. I also have extensive experience of Asia where I spent six years managing the regional Operations for a US investment bank. I am a chartered engineer and a member of the Institute of Engineering and Technology.
Find our more about GD Financial Markets by contacting us at: firstname.lastname@example.org