Confidence to be brave

On 22 October, at the City Dinner at Mansion House, the FCA’s chief executive, Nikhil Rathi, called for an end to tickbox compliance. He named the suspects: data packs, risk reports, internal audit, much of it potentially duplicative. He then said his deputy, Sarah Pritchard, would work with firms to strip out unnecessary effort, give boards the confidence to be brave, and “consider if it’s time to look again at the 3 lines of defence” [1].

It is a question, not a decision. I hope the answer is yes. I have never liked three lines of defence, or the three lines, as the Institute of Internal Auditors renamed it in 2020, and I would be delighted to see it go. However, I have to acknowledge that it has been fundamental to how financial services regulators supervise firms and it is well understood by financial services practitioners. It gave a structure the regulators could inspect and boards a structure they could show. But it has always had a cost.

What three lines costs

My objection is that it builds an artificial rigidity into how people talk about risk. Each line learns to stay in its lane, and people speak less freely than they should. The more rigidly the model is applied, the worse that gets. To be fair, the IIA’s 2020 update set out to clarify the principles and explain how the roles work together [2]. My quarrel is less with the words on the page than with how the model is lived: as boundaries to defend.

That matters more now than it ever has. AI and global instability are accelerating volatility, uncertainty, complexity and ambiguity. Many of the biggest risks we now face are what John Adams calls virtual risks: risks where the science is inconclusive, so people act on what they believe [3]. By definition, no single professional discipline is sufficient to deal with them. We can only do so by bringing people together in interdisciplinary teams, not by keeping them in silos or separate lines.

Nor am I convinced by the weight the model puts on separation. Assurance serves the firm. The people who provide it should be working alongside the business on the risks that matter most. That does not mean giving up independent judgement: they still need the freedom to challenge, direct access to the board, and licence to report what nobody wants to hear.

So I welcome the FCA’s question. My worry is that we will spend the next year redrawing the diagram, deciding which lines to merge and which reports to stop, and skip the two questions the diagram never answered.

How much risk will you accept?

Bravery means accepting risk on purpose. You cannot do that without saying how much. Rathi has pressed exactly this point on government since 2025, asking for an open debate on risk appetite and “metrics for tolerable failures” [4]. He wants clearer collective agreement on the risks the system should accept.

Boards should hold themselves to the same standard. Before cutting assurance, a board should be able to say what it is willing to see go wrong, how often and at what cost, and which risks it will not carry at all. Assurance gives a board the evidence to judge whether it is inside those limits. Cut assurance without a stated appetite and you have not become brave. You have become less informed.

I wrote the Institute of Risk Management’s guidance on risk appetite and tolerance in 2011. It argued that every firm has both a propensity to take risk and a propensity to exercise control, and that the balance between them matters. In January 2025, as the Chancellor pressed regulators to support growth, I argued that control had become unduly dominant and our ability to take risk sorely constrained [5]. The question has not got easier, but it has become unavoidable.