Risk committees Effective risk management requires company-wide risk governance. ING's risk and control structure is based on the 'three lines of defence' governance model, whereby each line has a specific role and defined responsibilities and the execution and control of tasks are separated. At the same time, the three lines have to work closely together to identify, assess and mitigate risks. This governance framework is designed to manage risk in line with ING's overall risk appetite as approved by the Management Board Banking, Executive Board and Supervisory Board.