3 Lines of Defense
Oversight and Accountability
VHA's Office of Organizational Excellence (OE) performs a critical role in ensuring excellence in the health care and services Veterans receive. Within VHA, a framework known as the Three Lines of Defense is being used to establish a standard, easily understandable framework for ensuring adequate oversight across all business lines and at all levels of VHA.
The first line of defense is comprised of the people and management responsible for controlling and monitoring processes. For example, operational managers manage and own risks on a day-to-day basis. "If there is a solid first line of defense, policies and scheduling procedures will provide a smooth entry to care and improve wait times and overall patient experience," says Dr. Gerard Cox, Deputy Under Secretary of Health for Organizational Excellence.
The second line of defense is risk, control, and compliance oversight functions. These oversight functions assure processes and controls are properly designed and are effective. Oversight activities occur at VA medical facilities, VISNs, and national program offices. The goal is to ensure VA's policies are implemented with fidelity, and that facilities and national program offices are functioning in the way intended and producing the right outcomes for Veterans.
The third line of defense is independent assurance. Independent assurance is performed by internal auditors who are not a part of an organization's management structure, and who follow the professional standards established by the Government Accountability Office in their Government Auditing Standards. VHA's Internal Audit Office provides VHA's governing body and senior leadership with assurance on the effectiveness of governance, risk management and internal controls. The scope of the assurance function includes evaluating effectiveness and efficiency; the reliability and integrity of reporting processes and data; and compliance with laws, regulations, policies, and procedures. Organizations working to become high reliability organizations use the third line of defense in support of their objectives to foster a process improvement culture.