The «COSO – Three Lines of Defense» Model for Assessing the Risk-Oriented Internal Control System in Russian Corporations

International approaches and Russian methods for assessing internal control systems were analyzed. It is proposed to consider the effectiveness of this system from an internal and external point of view. The external effectiveness of the internal control system involves the integration of risk management into decision-making at all levels of company management aimed at ensuring the medium and long-term efficiency of the corporation It is assumed that the necessary conditions for effectiveness are the passage of risk management and control through all decision-making processes, as well as the involvement of employees in this process. In this paper, using the example of the compliance service, an analysis of the effects of its activities is conducted, statistical data of the applied performance indicators of this service are analyzed, as well as the indicators for assessing the internal audit service in Russian companies. Based on the analysis of existing methods, a model for assessing the riskoriented internal control system “COSO – three lines of defense” is proposed, representing a matrix, the elements of which are key performance indicators that assess the contribution and involvement of employees and departments in the implementation of each element of the COSO model, as well as the areas within which it is possible to develop such indicators.