It is not an end in itself. The goal is a well-controlled firm with respect to its risks. There is a potential danger associated with applying the three lines of defense framework so rigidly that it detracts 1/7  BIS central bankers' speeches  from that goal. Independence and expertise are desirable. Silos are not. Excessive formalism can limit the overall control framework of an organization. I offer these observations with humility gained through experience. I have witnessed many discussions about where lawyers fit into the three lines of defense. First line? Second line? Not in any line? In hindsight, such debates are a distraction. It is much more important to think instead about the tasks the lawyer is performing. How do those tasks fit in to the overall goal of helping the organization control its risks? Ultimately, substance matters much more than form. Of course, clarity of roles and responsibilities is important. It is also important that a front line business feel accountable for managing the broad set of risks confronting it. Indeed, one of the benefits of the three lines of defense model is that the business lines think more expansively about the risks they face, beyond just traditional notions of credit and counterparty risk. But an effective risk manager worries less about whether her firm’s risk management framework exactly matches the theory of the three lines of defense, and more about whether the risks facing the firm are well controlled.
17 See Association of the Bar of the City of New York, Report of the Task Force on the Lawyer’s Role in Corporate  Governance 95 (Nov.2006), (“Not to waver or equivocate is no easy challenge for lawyers in some circumstances because of the economic and professional pressures already noted, and because the answers to legal issues are seldom completely free of doubt. It may take genuine professional courage to provide unwelcome advice and stick to it.”). 18 See Ben Heineman, The Inside Counsel Revolution 7 (2016). 7/7  BIS central bankers' speeches