Internal control system (ICS): the basics for Swiss companies

What an ICS is

An internal control system is the entirety of rules, processes and controls a company sets up to achieve its objectives reliably. Four objectives are usually in focus: reliable financial reporting, compliance with laws and internal rules, safeguarding assets, and effective and efficient processes.

An ICS is not a single document. It consists of many small, often inconspicuous controls in daily work: an invoice is only paid after approval, a bank reconciliation is done every month, a new user account receives only the permissions its role requires. What matters is that these controls are defined, documented and actually carried out.

The legal framework in Switzerland

The Swiss Code of Obligations (CO) does not regulate the ICS in detail, but it addresses it in several places:

• Board of directors: the non-transferable and inalienable duties of the board include the organisation of the accounting system, financial control and financial planning, insofar as this is necessary for managing the company (Art. 716a para. 1 no. 3 CO).
• Ordinary audit: it applies, among others, to public companies, companies required to prepare consolidated accounts, and companies that exceed two of the following thresholds in two consecutive financial years: total assets of CHF 20 million, revenue of CHF 40 million, 250 full-time positions on annual average (Art. 727 CO).
• Review of existence: in an ordinary audit the statutory auditor checks, among other things, whether an internal control system exists (Art. 728a para. 1 no. 3 CO) and reports on it to the board of directors (Art. 728b CO). The Swiss auditing standard PS-CH 890 specifies this review. Confirming existence is not an opinion on effectiveness.
• Limited audit: here, reviewing the ICS is not part of the statutory audit mandate. A working ICS still makes sense – as a management tool.

Companies that prepare a management report under Art. 961 CO comment in it, among other things, on the performance of a risk assessment (Art. 961c para. 2 no. 2 CO). A well-maintained ICS provides a good basis for this.

Structure according to COSO

The “Internal Control – Integrated Framework” of the Committee of Sponsoring Organizations of the Treadway Commission (COSO), in its 2013 version, is often used to build an ICS. It describes five components that work together:

For SMEs, implementation does not have to be complicated. What matters is that the components are recognisable: management sets the example, risks are known, the key controls are defined, information flows, and someone regularly checks that everything works.

Typical controls

• Four-eyes principle: payments, contracts or master data changes are approved by a second person.
• Segregation of duties: whoever enters suppliers does not also approve payments.
• Reconciliations: bank, receivables, payables and inventory are regularly reconciled with the accounts.
• Permissions: access rights in accounting and ERP match the role and are reviewed periodically.
• Change management: changes to financially relevant systems are requested, tested and approved.
• Closing controls: checklists and plausibility checks at month-end and year-end closing.

Not every control is equally important. Key controls cover the material risks and are the focus of documentation and testing.

Documentation: the risk control matrix

The central working tool is a risk control matrix. For each process it records:

The matrix is complemented by process descriptions or flowcharts for the material processes. This shows where in the process a control applies.

Testing design and effectiveness

An ICS lives through monitoring. Two questions are distinguished:

• Design: is the control suitable for covering the risk, and has it been introduced as designed?
• Effectiveness: was it actually and correctly performed during the period under review? This is shown by samples and evidence.

Many companies complement testing with self-assessments: the owners periodically confirm in a questionnaire that their controls were performed, and sign it. This creates commitment and gives the board a documented basis.

ICS and information security

Modern financial processes run in IT systems. This is why IT controls are part of the ICS: access rights, change management, operations and backup of financially relevant systems. The same topics appear in every security framework – in ISO/IEC 27001 as well as in the ICT Minimum Standard.

It pays to align the two: an access control tested once can serve as evidence for the ICS and for the security audit. This avoids duplicate work and contradictory results. How a security audit works is described in The internal security audit in 6 steps.

How Audhive helps

In ICS mode Audhive manages the controls of the internal control system by audit scope and effectiveness, plus questionnaires that owners answer and sign via a personal link sent by e-mail. In FULL mode, ICS and security audit run in the same installation; for each tenant you decide which mode applies. Your own ICS catalogues come in as CSV. More under Product and Catalogues › Catalogues and modes.

Sources

• Fedlex: Swiss Code of Obligations (CO) – Art. 716a, 727, 728a, 728b, 961c
• COSO: Internal Control – Integrated Framework (2013)
• EXPERTsuisse: Swiss auditing standard PS-CH 890, audit of the existence of the internal control system