Internal control system (ICS)
The internal control system (ICS) is the totality of control structures and processes that, at all levels of a bank, support achieving business objectives and orderly operations.
FINMA Circular 2017/1 defines the ICS as the totality of control structures and processes which, at all levels of an institution, form the basis for achieving business objectives and ensuring orderly operations. It covers controls built into work processes, risk management and compliance processes, and independent control bodies, in particular risk control and the compliance function. In Germany, MaRisk AT 4.3 sets equivalent requirements on organisation, risk control processes and the risk control and compliance functions.
The board of directors is responsible for an appropriate risk and control environment and an effective ICS. FINMA Circular 2023/1 adds that the effectiveness of key controls, meaning the controls that mitigate material inherent risks, must be assessed regularly and documented by an independent control body, covering both design and operating effectiveness.
Typical weaknesses are control inventories that list activities without the risk they address, controls without evidence, compensating controls that become permanent, and reporting that shows individual test results but no aggregated view of control effectiveness for the board.
In practice
- 01Maintains a risk and control matrix linking each process step to its risks, controls, owners and test results.
- 02Identifies key controls explicitly and tests them more often and more deeply than other controls.
- 03Prefers preventive and automated controls and documents segregation of duties conflicts.
- 04Tracks control deficiencies through remediation with owners, deadlines and escalation.
- 05Reports aggregated control effectiveness and trends to the executive board and the audit committee.
How MRM-Solution supports it
- 01Attach controls to the activities they secure, record tests or import results in your own spreadsheet layout, and track deficiencies to closure.
- 02See per requirement whether policy, process and governance, and controls hold it: three lamps, and the weakest one counts.
Too good to be true? Then we should talk.
30 minutes. Your use case, maximum impact.
info@mrm-solution.com