The New Three Lines of Defense: Building the Internal Audit Function of the Future

Learning journey

NEW THREE LINES OF DEFENSE → ASSURANCE MAP → COORDINATION & CONSOLIDATION → AUDITING STRATEGY → CONTINUOUS AUDITING → FUTURE-READY OPERATING MODEL

What it is

A full-day conference on navigating the new Three Lines of Defense while merging Internal Audit transformation with agile and continuous assurance — mapping, consolidating, and connecting assurance without assuming management responsibility.

Event promise

Attendees will learn how to position Internal Audit as the independent coordinator and consolidator of enterprise assurance, while building the operating capabilities required for continuous, technology-enabled assurance.

Practical differentiator

Attendees build a practical combined-assurance map and a continuous-auditing pilot canvas, linking the new Three Lines of Defense to real coordination, auditing strategy, risk sensing, testing, reporting, talent, and technology decisions.

Major tentative topics

Roles, relationships, independence, and the limits of coordination
Assurance universe, mapping, reliance, duplication, gaps, and consolidated reporting
Auditing organizational strategy and dynamic risk sensing (KRIs, external data, triggers)
Continuous auditing and continuous controls monitoring architecture
Agile audit delivery, sprints, minimum viable scope, and automated procedures
Talent, co-sourcing, and build-buy-borrow-automate decisions

Learning outcomes

1.Apply the new Three Lines of Defense framework to clarify governing-body, management, second-line, and Internal Audit roles.
2.Create an assurance map that identifies ownership, duplication, gaps, reliance opportunities, and escalation paths.
3.Define how Internal Audit can coordinate and consolidate assurance without taking management responsibility or impairing independence.
4.Design a practical continuous-auditing pilot using risk signals, automated procedures, exception thresholds, evidence, and human judgment.
5.Align talent, co-sourcing, technology, methodology, and executive communication to the future operating model.

Proposed agenda

Full-day, in-person leadership and technology conference with workshops and a continuous-auditing pilot exercise.

7:30 – 8:00

No CPE

Registration, Breakfast & Networking

Networking among audit, risk, controls, technology, and Board-facing professionals.

8:00 – 9:00

1 CPE

Session 1 — The New Three Lines of Defense: What Changes for Internal Audit?

Roles, relationships, independence, accountability, collaboration, and the limits of coordination.

9:00 – 10:00

1 CPE

Session 2 — Internal Audit as Assurance Coordinator and Consolidator

Assurance universe, mapping, reliance, duplication, gaps, consolidated reporting, and escalation.

10:00 – 10:15

—

Break

Networking and refreshments.

10:15 – 11:15

1 CPE

Session 3 — Auditing Organizational Strategy and Dynamic Risk Sensing

Strategy governance, assumptions, execution, performance indicators, stakeholder signals, KRIs, external data, and audit-plan implications.

11:15 – 12:15

1 CPE

Session 4 — Continuous Auditing and Continuous Controls Monitoring

Architecture, ownership, data access, control logic, exceptions, evidence, and management versus audit responsibilities.

12:15 – 1:00

No CPE

Lunch & Career Breakout for Job Seekers

Lunch, networking, and an optional career breakout covering CV tips, interview preparation, and job-search strategies.

1:00 – 2:00

1 CPE

Session 5 — Agile Audit Delivery and Automated Procedures

Sprints, minimum viable scope, iterative reporting, automation candidates, quality review, and human judgment.

2:00 – 3:00

1 CPE

Session 6 — Talent, Co-Sourcing, and the Future Audit Team

Build-buy-borrow-automate decisions, analytics/AI/cyber skills, knowledge transfer, hybrid teams, and succession.

3:00 – 3:15

—

Break

Networking and refreshments.

3:15 – 4:15

1 CPE

Session 7 — Workshop: Build the Enterprise Assurance Map

Teams map risks, providers, coverage, reliance, gaps, reporting, and coordination protocols.

4:15 – 5:15

1 CPE

Session 8 — Workshop: Design a 90-Day Continuous Auditing Pilot

Select a risk, define signals, procedures, thresholds, evidence, ownership, and success measures.

5:15 – 5:30

No CPE

Roadmap & Closing

Translate the day into a 12-month future-state roadmap.

Primary audience

CAEs, Audit Directors, Audit Managers, ERM/Compliance/Internal Controls leaders, audit methodology and analytics professionals.

Secondary audience

Board/Audit Committee members, risk owners, Finance, Technology, SOX, co-sourcing partners, and aspiring audit leaders.

Speaker architecture

Speaker 1

CAE / governance leader

Frame the new Three Lines of Defense and the Internal Audit mandate

Speaker 2

Combined-assurance / ERM practitioner

Demonstrate assurance mapping, coordination, and consolidation

Speaker 3

Continuous auditing / analytics leader

Show risk sensing, automated testing, and exception management

Panel / Workshop

Board, second-line, technology, talent, and co-sourcing perspectives

Build the future operating model and resolve trade-offs

Preferred operating model: 1 governance keynote + 1 combined-assurance case + 1 continuous-auditing demonstration + 1 facilitated operating-model workshop.

Attendee take-home tools

Enterprise combined-assurance map
Assurance coordination and reliance protocols
90-day continuous-auditing pilot canvas
Dynamic risk-sensing indicator set
12-month future-state operating-model roadmap

Interested in sponsoring or speaking at this event?

Sponsorship packages and speaking opportunities are coordinated by the Programs Committee.

* All dates, venues, pricing, speaker assumptions, and CPE eligibility remain preliminary and subject to Board and Certification/NASBA validation, and may change without further notice.