The three lines of defence in social housing

The three lines of defence is a governance model for managing risk. Applied to compliance and safety in social housing, it clarifies who does the work, who provides oversight, and who independently checks the whole system.

The model in brief

• First line — operational delivery. The teams who carry out and record compliance activity: servicing, inspections, remedial works, contractor management.
• Second line — oversight and assurance. Risk, compliance and health and safety functions that test whether first-line controls are working and report the position.
• Third line — independent internal audit, providing objective assurance to the board and audit committee.

Where the gaps usually appear

Most social housing providers have a capable first line and a periodic third line. The weakness is often the second line: oversight that is informal, undocumented, or dependent on individuals rather than a repeatable process.

When the second line is weak, the board effectively relies on first-line self-reporting — which is exactly what regulators and auditors probe.

Strengthening the second line

A strong second line tests controls independently, holds the supporting evidence, tracks findings and actions to closure, and reports a clear assurance position. It gives the third line a structured base to review and the board a reliable view of risk.

This is where dedicated assurance tooling earns its place: it makes second-line activity consistent, evidenced and reportable rather than ad hoc.

The board’s view

For the board, the value of the model is simple: confidence. When each line is doing its job and the second line is evidenced, leaders can answer scrutiny with facts rather than assurances.

GRC Assured is built to strengthen that second line — turning oversight into a defensible, board-ready assurance record.