The three lines of defense (3LOD) concept was first mentioned by the UK’s Financial Services Authority and then promoted by the Institute of Internal Auditors (IIA) in 2013; since then, the model has become ubiquitous among financial institutions. Although it’s often considered a pillar of enterprise risk management, make no mistake: 3LOD isn’t a framework for managing risk. Risk leaders must instead embrace a new way of managing risk using the Forrester Continuous Risk Management Model.