BUSINESS INFORM JOURNAL.

УКР

ENG

Search:

REGISTRATION CERTIFICATE

KV #19905-9705 PR dated 02.04.2013.

FOUNDERS

RESEARCH CENTER FOR INDUSTRIAL DEVELOPMENT PROBLEMS of NAS of Ukraine (KHARKIV, UKRAINE)

ROR

EDRPOU 05481984

According to the decision No. 802 of the National Council of Television and Radio Broadcasting of Ukraine dated 14.03.2024, is registered as a subject in the field of print media.
ID R30-03156

PUBLISHER

Liburkina L. M.

CATALOG

The Architecture of a Corporate Risk Management System for Investment Activity Based on the Three Lines Model
Pozniak R. V.

Pozniak, Roman V. (2026) “The Architecture of a Corporate Risk Management System for Investment Activity Based on the Three Lines Model.” Business Inform 9:179–188.
https://doi.org/10.32983/2222-4459-2026-9-179-188

Section: Investment Processes

Article is written in Ukrainian
Downloads/views: 0

Download article (pdf) -

UDC 005.334:330.322:657.6

Abstract:
The relevance of the problem stems from the persistent recurrence of adverse deviations in investment projects, which has continued for decades despite the intensive development of quantitative risk assessment tools, indicating that the problem is predominantly organisational rather than methodological in origin. The aim of the article is to substantiate the architecture of a corporate risk management system for investment activity based on the Three Lines Model and to develop methodological recommendations for its configuration according to the stages of the investment project life cycle. The methods applied comprise systemic and process approaches; structural-functional analysis was used to decompose the architecture, comparative analysis to juxtapose successive editions of the model and regulatory practices, and matrix structuring to allocate authority among risk management actors; the empirical basis comprised the framework documents of COSO, ISO 31000 and the Institute of Internal Auditors, together with the findings of field and experimental studies of corporate risk management. The study examined the correspondence between the design logic of the Three Lines Model and the nature of the investment process, the mechanisms for preserving the independence of control lines at the stage of forming financial model assumptions, and the criteria for distinguishing an operative risk management system from its formal imitation. The results revealed a methodological mismatch between the classical construct of the model, oriented towards continuous operational processes with a permanent process owner, and the discrete, project-cyclical and cross-functional nature of investment activity, in which risk ownership migrates between centres of responsibility and the most critical decisions are taken before the first line acquires organisational form. It was determined that a unit’s affiliation with a particular line is not a permanent organisational attribute but a function of the project life-cycle stage, and consequently that internal corporate regulations should assign roles to stages rather than to positions and departments; it was likewise determined that a zero rate of projects rejected at approval gates indicates an inoperative filter rather than flawless project preparation. The expediency of replacing the functional assignment of roles with a stage-based one has been demonstrated, and the traceability-of-influence principle has been substantiated, according to which the effectiveness of the architecture is measured by the documented trace that control procedures leave in investment decisions rather than by the existence of units or approved policies. A matrix allocating the roles of the three lines across the stages of the investment project life cycle and a system of architectural effectiveness indicators have been proposed, suitable for designing internal regulations governing investment activity at real-sector enterprises, where the three-line construct is not mandatory, and for enterprise self-assessment ahead of due diligence procedures conducted by international financial institutions.

Keywords: financial risks; investment activity; risk management; Three Lines Model; corporate governance.

Tabl.: 2. Bibl.: 25.

Pozniak Roman V. – Applicant, Department of Accounting and Finance, National Technical University «Kharkiv Polytechnic Institute» (2 Kyrpychova Str., Kharkіv, 61002, Ukraine)
Email: [email protected]

List of references in article

Arena M., Arnaboldi M. & Azzone G. (2010). The organizational dynamics of Enterprise Risk Management. Accounting, Organizations and Society, 35(7), 659–675. https://doi.org/10.1016/j.aos.2010.07.003
Arena M., Arnaboldi M. & Palermo T. (2017). The dynamics of (dis)integrated risk management: A comparative field study. Accounting, Organizations and Society, 62, 65–81. https://doi.org/10.1016/j.aos.2017.08.006
Bantleon U., d'Arcy A. & Eulerich M. (2021). Coordination challenges in implementing the three lines of defense model. International Journal of Auditing, 25(1), 59–74. https://doi.org/10.1111/ijau.12201
Beridze T., Baranyk Z., Dashko I., Hamova O. & Tkachenko S. (2021). Otsiniuvannia investytsiinykh ryzykiv promyslovoho pidpryiemstva [Evaluation of investment risks of an industrial enterprise]. Finansovo-kredytna diialnist: problemy teorii ta praktyky, 5, 429–436. https://doi.org/10.18371/fcaptp.v5i40.245194
Bromiley P., McShane M., Nair A. & Rustambekov E. (2015). Enterprise risk management: Review, critique, and research directions. Long Range Planning, 48(4), 265–276. https://doi.org/10.1016/j.lrp.2014.07.005
Committee of Sponsoring Organizations of the Treadway Commission. (2017). Enterprise risk management – Integrating with strategy and performance. COSO. https://www.coso.org/enterprise-risk-management
Davies H. & Zhivitskaya M. (2018). Three lines of defence: A robust organising framework, or just lines in the sand?. Global Policy, 9(S1), 34–42. https://doi.org/10.1111/1758-5899.12568
de Zwaan L., Stewart J. & Subramaniam N. (2011). Internal audit involvement in enterprise risk management. Managerial Auditing Journal, 26(7), 586–604. https://doi.org/10.1108/02686901111151323
Dmyshko Ya. (2026). Implementatsiia hlobalnykh standartiv vnutrishnoho audytu v banku [Implementation of global internal audit standards in the bank]. Oblik i finansy, 1, 153–160. https://doi.org/10.33146/2518-1181-2026-1(111)-153-160
Eulerich M. (2021). The new three lines model for structuring corporate governance – A critical discussion of similarities and differences. Corporate Ownership & Control, 18(2), 180–187. https://doi.org/10.22495/cocv18i2art15
Flyvbjerg B. (2014). What you should know about megaprojects and why: An overview. Project Management Journal, 45(2), 6–19. https://doi.org/10.1002/pmj.21409
Hoyt R. E. & Liebenberg A. P. (2011). The value of enterprise risk management. Journal of Risk and Insurance, 78(4), 795–822. https://doi.org/10.1111/j.1539-6975.2011.01413.x
The Institute of Internal Auditors. (2020). The IIA's three lines model: An update of the three lines of defense [Position paper]. https://www.theiia.org/en/content/position-papers/2020/the-iias-three-lines-model-an-update-of-the-three-lines-of-defense/
The Institute of Internal Auditors. (2026). Three lines model: Assurance and advice in support of effective governance [Statement of position]. https://www.theiia.org/globalassets/site/resources/statements-of-position/tlm_assurance_advice_support_effective_gov_en.pdf
Institute of Internal Auditors. (2026). The role of the internal audit function in enterprise risk management [Statement of position]. https://www.theiia.org/globalassets/site/resources/statements-of-position/role_of_ia_function_enterprise_risk_mgmt_en.pdf
International Organization for Standardization. (2018). ISO 31000:2018. Risk management – Guidelines. https://www.iso.org/standard/65694.html
Meidell A. & Kaarb?e K. (2017). How the enterprise risk management function influences decision-making in the organization – A field study of a large, global oil and gas company. The British Accounting Review, 49(1), 39–55. https://doi.org/10.1016/j.bar.2016.10.005
Mikes A. (2009). Risk management and calculative cultures. Management Accounting Research, 20(1), 18–40. https://doi.org/10.1016/j.mar.2008.10.005
Power M. (2009). The risk management of nothing. Accounting, Organizations and Society, 34(6–7), 849–855. https://doi.org/10.1016/j.aos.2009.06.001
Roussy M. & Rodrigue M. (2018). Internal audit: Is the 'third line of defense' effective as a form of governance? An exploratory study of the impression management techniques chief audit executives use in their annual accountability to the audit committee. Journal of Business Ethics, 151(3), 853–869. https://doi.org/10.1007/s10551-016-3263-y
Rud O. O. (2024). Investytsiinyi ryzyk-menedzhment: osoblyvosti analizu ta otsinky ryzykiv v investytsiinomu proiekti [Investment risk management: features of risk analysis and assessment in an investment project]. Ekonomika ta suspilstvo, 70. https://doi.org/10.32782/2524-0072/2024-70-127
Seidenfuss K.-U., Young A. & Datwani M. (2023). Integrating governance, risk and compliance? A multi-method analysis of the new Three Lines Model. SN Business & Economics, 3(184). https://doi.org/10.1007/s43546-023-00561-x
Trigeorgis L. & Reuer J. J. (2017). Real options theory in strategic management. Strategic Management Journal, 38(1), 42–63. https://doi.org/10.1002/smj.2593
Vousinas G. L. (2021). Beyond the three lines of defense: The five lines of defense model for financial institutions. ACRN Journal of Finance and Risk Perspectives, 10(1), 95–110. https://doi.org/10.35944/jofrp.2021.10.1.006
zakon.rada.gov.ua. (2018, June 11). Postanova Pravlinnia Natsionalnjuj banke Ukrainy «Pro zatverdzhennia Polozhennia pro orhanizatsiiu systemy upravlinnia ryzykamy v bankakh Ukrainy ta bankivskykh hruppakh» vid 11.06.2018 r. № 64 [Resolution of the Board of the National Bank of Ukraine "On Approval of the Regulation on Organization of Risk Management System in Banks of Ukraine and Banking Groups" dated June 11, 2018 No. 64]. https://zakon.rada.gov.ua/laws/show/v0064500-18#Text