Lessons from the financial crisis and growing demands on company management have increasingly placed qualitative and organisational aspects of risk management at financial institutions under the spotlight. In order for a governance system to achieve the desired operational capability, financial institutions must ensure that the control functions constantly exchange information and work closely together. As a result of the paper published by the Institute of Internal Auditors (IIA, 2013), the Three Lines of Defence model has achieved widespread recognition and established itself internationally as a concept for organisational embedding of control functions and interaction between the various operational units.However, in Switzerland there has been no investigation to date of the concrete application of the model, its implementation in the insurance industry and the experience gained as a result. In this project, 12 experts were questioned in personal interviews, and 35 insurance companies asked about the benefits of the Three Lines of Defence model, its implementation and their experiences to date by means of standardized, online questionnaires.