After every large corporate failure, the same question is asked. In India’s biggest episodes, the uncomfortable assertion is that the controls were there. Satyam had independent directors and a global audit firm. IL&FS carried top credit ratings for years. YES Bank was a listed private bank under annual RBI inspection. What was missing was a working conversation among the people meant to watch one another.

That is the real test of the Three Lines of Defence (3LoD) model. The Institute of Internal Auditors (IIA) renamed it the Three Lines Model in 2020 and, in July 2026, replaced its position paper with a new Statement of Position. The structure is easy to draw. Whether it holds under pressure depends on whether all the Lines talk regularly and tell one another the truth. 

This two-part series puts it to that test: Part 1 in corporate India, where boards are professional and control functions are funded, and Part 2 in cooperative banks, where neither can be assumed.

Three lines, One Board, One Test: Who Can Say No? 
The first line is business and operations: the front office that lends, trades and sells, and the back office that processes, settles and supports. It makes decisions every day, so it owns the risk those decisions create. The second line includes risk management, compliance, and other specialist roles that support, monitor, and challenge the first. The third line is internal audit, which gives the board independent assurance on how the whole system is working. Above them sits the board, which sets the risk appetite and answers for the outcome. External auditors and regulators sit outside the lines, as additional pairs of eyes.

The IIA’s latest paper is candid that no line is perfect. The first line has proximity but struggles with objectivity, and management can override some controls. The second line has specialist knowledge but can be impaired by reporting through management. The third line has the highest independence, but reviews the organisation on a risk-based, periodic basis. Each line’s weakness is meant to be covered by another. The model works only when the lines come together and speak openly. Each must identify the entity’s vulnerabilities; together, they must find ways to keep it resilient.

The Buck Stops at the Top, Starts at the Bottom, and Gets Lost in the Middle
At the bottom, risk is created. Someone in the first line sanctions the loan or books the entry, and no policy can replace that person’s judgement and integrity. That is why risk culture begins there, for better or worse.

In the middle, risk is challenged, and this is where most failures are decided. The second line can say “not like this”, but it is part of management. Its independence, therefore, depends on reporting lines that reach a senior manager or a board-level committee. Without that, it becomes a rubber stamp.

At the top, accountability rests. A board can delegate tasks but not responsibility. After a failure, regulators and investors ask what the board knew, what it asked and what it did next.

A board that understands this changes its questions. Instead of “Are we compliant?”, it asks: who owns this risk, who challenged the decision, and who checked the challenge? It also tests the answers against the IIA’s markers of independence for internal audit. Does the head of audit report functionally to the board, decide the audit scope, see all the information, control its own resources and stay free from retaliation?

Four Ways the Music Stops
The model rarely fails because a line is missing. It fails in the handoffs:

• Information is withheld on its way up.
• Escalation is softened before it reaches the board.
• Challenge is heard and ignored.
• Audit findings sit unresolved.

All four appear in the cases below.

When the Tone from the Top Falters: Satyam and IL&FS
In January 2009, Satyam’s chairman admitted in a letter that ₹50.40 billion of the ₹53.61 billion shown as cash and bank balances did not exist. That is about 94% of the reported cash, which was close to 60% of the company’s total assets. The September 2008 quarter showed revenue of ₹27 billion and an operating margin of ₹6.49 billion, against actuals of ₹21.12 billion and ₹610 million. Weeks earlier, the board had cleared a proposal to buy two companies linked to the promoter’s family, a deal withdrawn after investors reacted sharply. Nine years later, SEBI barred the Price Waterhouse network from auditing listed companies for two years and ordered disgorgement of ₹130.9 million, noting audit fees of over ₹230 million from Satyam between 2000 and 2008. The firm said it was disappointed and appealed.

IL&FS tells a similar story on a larger scale. In October 2018, the group had 302 companies and about ₹942.1 billion of external fund-based debt, and in the same year ICRA cut ₹44.75 billion of its debt securities from AAA to AA+. Its recast accounts later showed a cumulative loss of ₹94.15 billion for 2013-14 to 2017-18, against a reported profit of ₹18.66 billion. The government moved to supersede the board on 1 October 2018. Several allegations in both cases remain before the courts and investigators.

In both, the top did not probe, and every line beneath it was reassured by silence.

When the Middle is Silent: YES Bank
The RBI’s review of YES Bank’s 2016-17 books found gross NPAs of ₹83.74 billion against the ₹20.18 billion the bank had reported, a gap of ₹63.55 billion, about three times the reported figure. For 2018-19, the gap was ₹32.77 billion: ₹78.82 billion reported against ₹111.59 billion assessed. In September 2018, the RBI limited the founder-CEO’s tenure to January 2019, well short of the three years shareholders had approved. On 5 March 2020, the RBI placed the bank under a moratorium, capped withdrawals at ₹50,000 per depositor and superseded the board. A reconstruction scheme followed, with SBI taking up to 49%.

The lesson is about the middle. It was the regulator’s review, not the bank’s own risk reporting, that surfaced the gap, and it did so more than once. A lender growing fast on concentrated exposures needs a risk function with the standing to say no and a board that backs it. Without both, the regulator discovers what the institution should have seen first. Allegations involving former management remain under investigation.

A Global Echo: Silicon Valley Bank
The pattern is not uniquely Indian. The Federal Reserve’s own review of SVB’s 2023 failure found that the bank’s board and management failed to manage their risks. The bank was without a chief risk officer for roughly a year while it grew past $200 billion in assets, with 31 unaddressed supervisory warnings, triple the average for similar banks. Different jurisdiction, same shape: the business chased growth, the middle was not strong enough to resist, and the top did not insist.

Warnings Existed. The Picture was Never Assembled
Across these cases, signals were not absent. They sat in related-party approvals, rating-versus-reality gaps, repeated divergence reports, and a risk chair left empty. What was missing was a forum that put the fragments together and forced a decision. That is what a board is for, and it is why a model on paper is not the same as a model in practice.

This is part one of two of the “Three Lines of Defence in Corporate India” series:  The authors say the model didn’t fail; the conversation did. In Part 2, the authors take the same test to cooperative banks, where depositors are many, boards are elected, and the orchestra is often missing half its instruments.