Interest in financial services firms developing and implementing robust systems and structures to manage operational risk has been growing. While there now appears to be some consensus in terms of definitions, quantification and modeling, firms are struggling with the qualitative side of operational risk management (ORM). This is particularly the case for financial institutions’ operational risk governance, where the three lines of defence model has become standardized. At the same time, corporate scandals post-financial crisis continue to indicate deficiencies in operational risk governance. Our paper examines the three lines of defence in the context of ORM in UK financial institutions. It focuses on roles and responsibilities and then analyzes the effectiveness of the traditional three lines of defence model. We find a lack of common understanding of the lines of defence in financial institutions, which leads to the duplication of roles and gaps in coverage. This is concerning for the industry, the economy and regulators.