Bringing the Three Lines of Defense to Life
Overview
The heart of this project was redefining how first-line employees and second-line risk partners work together. The goal was to move away from an approval-seeking habit and toward first-line employees owning risk decisions, while turning to the second line for advice when they needed it. Over the course of a month, I led the rollout of four short eLearning modules that took the Three Lines of Defense model out of policy slides and into familiar, everyday situations. I owned the project from analysis through design, development, and evaluation so the experience fit into busy workdays and felt directly tied to the decisions people were already making.
*Some details of this project and internal materials are confidential. This case study focuses on my role, process, and outcomes; specifics have been generalized and no internal content is shown.
Audience and Context
The campaign was designed for roughly 3,000 first-line employees across the business, from support staff handling internal processes to client-facing teams in claims and customer service. In practice, many of these employees were accustomed to sending issues to the second line for approval instead of making and documenting their own risk decisions, which created bottlenecks and blurred accountability. Because the organization operates in a highly regulated environment with heavy workloads, the learning also had to fit into short windows of time and feel practical enough to try immediately on the job.
Competencies and Objectives
The core challenge was behavior change: shifting first-line employees from an approval-seeking habit to using the Three Lines of Defense as a practical decision-making tool in their day-to-day work. To keep the campaign focused, we anchored the design to a small set of clear learning objectives:
- Explain the Three Lines of Defense model in plain language.
- Describe the role and responsibility of a first-line employee in managing risk.
- Distinguish between owning a risk decision and consulting the second line for advice.
- Document decisions and reasoning in a way that makes accountability visible.
These objectives were tied directly to company leadership expectations around empowered decision making and thoughtful attention to customer impact when choosing a path forward.
Assets I developed and tools used
To support the behavior shift, I designed a set of connected assets that worked together as a campaign rather than a one-off course:
- Four short eLearning modules (Articulate Rise and Storyline)
Each module focused on a different set of everyday situations and showed how the Three Lines of Defense model should guide first-line decisions. - Story-based videos (Vyond and Adobe)
Short videos carried a simple narrative thread across the four weeks so employees saw familiar characters and scenarios recur over time. - Campaign intranet hub
A central site brought the modules, videos, and resources together in one place and gave employees a single destination to return to as new pieces were released. - Visual identity and campaign branding (Adobe Illustrator)
A cohesive look and feel was developed and applied across the intranet hub, course screens, and the email communications I ran point on, so the work was immediately recognizable. - Manager discussion guides (Adobe and MS Word)
Simple guides and prompts helped leaders use existing team meetings to talk through real decisions in their own work. - Embedded course assessments (Credspark)
Knowledge checks and interactions, delivered through CredSpark, gave learners immediate feedback and provided our team with data on understanding. - End-of-campaign survey (Credspark)
A short survey captured how employees experienced the campaign and offered early signals on confidence, intent to apply, and day-to-day awareness of risk.
Process
Discovery and Alignment
I started by partnering with risk and compliance leaders to pinpoint where first-line decisions were breaking down and how often issues were being pushed to the second line for approval. We used real examples to shape the learning objectives, connect them to company leadership expectations, and agree on what better decisions and documentation should look like. Early in the project, I brought in our strategic analyst so we could plan how to track completions and the outcome data coming from assessments and surveys once the campaign launched.
Designing the Journey
With that foundation in place, I mapped out the four-week journey and decided how the modules, videos, intranet hub, and manager resources would work together as one continuous experience rather than separate training events. I drafted storyboards and early versions of the modules and videos, then tested them with a small group of stakeholders to see whether they were clear and struck the right tone for a regulated environment. Feedback from those sessions drove several rounds of refinement, especially around how we described ownership of risk and the advisory role of the second line.
Rollout and Evaluation
During rollout, I coordinated timing with internal communications so each weekly release was supported by consistent messaging and campaign visuals across email and the intranet. As employees moved through the campaign, I worked with the strategic analyst to review completion trends and the data we were seeing from assessments and surveys, then highlighted where we might need to reinforce key ideas after the initial four weeks.
Results and Impact
“I’ve enjoyed the quick hits, engaging material, with good “one liners” to better understand. The smaller bites has made it easier for me to get my team engaged and follow along.”
– Colin, Team Manager
When the campaign wrapped, I worked with our strategic analyst to pull a simple picture of how it had landed for employees.
Direction for reinforcement
I summarized these patterns for the stakeholder team and highlighted specific areas to reinforce so the campaign would serve as a starting point for ongoing risk conversations rather than a one-time event.
Sustained participation
Most employees who started the experience completed all four modules, which showed that the format and pacing worked within busy workdays.
Stronger decision-making confidence
Assessment data and survey responses pointed to a clear jump in confidence around making and documenting risk decisions instead of sending every question to the second line.
Clearer use of the model in daily work
In open comments, employees described feeling more certain about how the Three Lines of Defense model applied to their own work and when it made sense to reach out to the second line for advice.
Lessons Learned
This project clarified a few things about how I want to design and lead risk-focused learning in the future.
- Engagement was noticeably stronger when risk was framed as part of everyday choices rather than as a separate compliance topic. The story elements and short touchpoints helped employees see themselves in the situations and connect the model to their own role.
- Managing the project and developing the content end to end was genuinely satisfying and underscored the value of having a strong sponsor. I also saw how much more impact we could have had with their involvement spread more evenly across the project lifecycle instead of concentrating it at launch and key approvals.
- Next time, I would build a more intentional change and adoption plan with a dedicated project manager and clearer reinforcement over time. I’d use the intranet hub and existing channels to keep introducing new scenarios and prompts so the conversation about risk culture stays active well beyond the initial campaign.
Samiya LXD 