In the context of economic imbalances, financial globalization and the introduction of innovative forms of banking services, the likelihood of banking risks has increased significantly, leading to the search for new methods and forms for building an effective internal control system and risk management. The purpose of the article is to reveal the features and advantages of the Four lines of defense internal control model, as well as to study the specifics of its operation. It was established that international banking institutions, taking into account the studies of the Basel Committee on Banking Supervision and the Committee of Sponsoring Organizations of the Treadway Commission, have restructured their own internal control systems in accordance with the requirements of the Three lines of defense model. It allows them to timely identify, evaluate, control and minimize bank risks. However, it was found that the Three lines of defense model is characterized by certain shortcomings that weaken the risk-oriented management of a banking institution. It was proved that eliminating the disadvantages of this model is possible by supplementing it with a fourth line of defense, which provides for close cooperation of the internal auditor with the regulator and the external auditor. The interaction between the regulator, internal and external auditors allows for timely detection of weaknesses in the bank's internal control and new risk areas, and, as a result, improving the bank's risk management system. It was substantiated that the addition of the fourth line to the Three lines of defense model will increase public confidence in banking institutions as a result of improving the bank's risk management and strengthening the financial stability of the banking institution. The prospects for building an effective risk management system and risk-based internal control in Ukrainian banks were evaluated.