Three lines, one record
Technology builds and runs AI, risk and compliance challenge it, internal audit proves it. In CognaOne all three work from the same record.
1st lineTechnology and AIRegister once and ship with controls defined, rather than retrofitting them.2nd lineRisk and complianceA current view of AI risk, tied to the obligations already reported on.3rd lineInternal auditDated evidence for every control, with a clear line between declared and proven.One recordAI systems · owners · risks · controls · evidence · decisions
What each line does in CognaOne#
| Line | Owns | Typical work |
|---|---|---|
| 1st line: technology and AI | The systems and their day-to-day running | Register systems, name owners, connect platforms, implement controls, bring agents into production |
| 2nd line: risk and compliance | The framework, appetite and challenge | Set tier rules, rate risk, map obligations to controls, review and approve |
| 3rd line: internal audit | Independent assurance | Test controls, read evidence and decision receipts, build audit packs |
Why one record matters#
- No reconciliation between spreadsheets, tickets and audit files.
- A control mapped by the second line shows on every system the first line runs.
- Audit tests what actually operated, with dated evidence, not a copy made for the audit.
- Accountability is visible: who owned the system and who approved it, on any date.
Permissions follow the lines: people see and change what their role allows, and every change is attributed in the history.
Last reviewed October 2026Suggest a change