Three Lines of Defence in a Quant Firm

The three lines of defence is a governance structure borrowed from banking and adopted by larger quant firms to keep risk-taking and risk-checking separate. The first line is the desk itself — traders and researchers who own their positions and are the first ones responsible for managing the risk they take on. The second line is an independent risk or compliance function that sets limits, monitors exposures, and can override or halt the first line — independent specifically so it isn't grading its own homework. The third line is internal audit, which periodically checks that both the first and second lines are actually following the firm's own stated policies, reporting up to the board rather than to either line.

The point of splitting these apart is that a desk that both takes risk and polices its own risk has an obvious conflict of interest — nobody wants to flag their own trade as too risky. Keeping the second line's compensation and reporting line separate from the desks it oversees is what makes its limit-setting credible rather than theater.

Worked example. A quant desk (first line) runs a strategy with a stated max drawdown limit. An independent risk team (second line) monitors real-time exposure against that limit and has authority to cut the desk's size if breached, regardless of the desk's objections. Internal audit (third line) separately reviews, on a quarterly cycle, whether the risk team's monitoring actually caught every breach that occurred and whether the stated limit was ever quietly raised without proper sign-off — a check on the checker.