ICS fitness check – future-proofing your internal control system

What makes an ICS effective?

Although awareness of the importance of an effective ICS is growing and regulatory requirements continue to increase, methodological and organizational weaknesses remain evident in practice. This shows that a one-time ICS setup falls short of unlocking its full potential. Instead, an effective ICS requires ongoing enhancement and regular review to deliver lasting impact and act as a strategic – and potentially differentiating – success factor.

Our colleagues’ article, “Blackbox Internes Kontrollsystem” (in German), provides information on the regulatory requirements for an ICS. The content presented there – especially the outlined ICS control loop and defined responsibilities – forms the basis of our ICS fitness check.

Why is it essential to regularly enhance the ICS?

A regular review of the ICS is essential to ensure the stability and efficiency of processes. An effective ICS also helps to proactively manage non-financial risks, thus creating a strong foundation of trust with customers, investors and supervisory authorities in the long term.

In a dynamic environment where new requirements arise constantly due to innovations and regulations, an ineffective ICS can pose significant risks, leading to high fines or reputational damage.

What enhancement measures are emerging in the market?

In various client projects, we have identified a number of enhancement measures to improve the effectiveness and efficiency of ICSs.

Integration of OpRisk and ICS assessments

In practice, one risk analysis focuses on ICS processes, while the other uses regulatory event categories to address operational risks. Both instruments aim to identify and evaluate operational risks, or more broadly, non-financial risks.

Aligning the risk assessment methodology, including the use of a risk matrix, gross/net risk evaluation, and normal versus worst-case scenarios, is essential to avoid redundant operational risk assessments. Additionally, a standardized risk assessment methodology can be used to integrate detailed assessments of non-financial/operational risks (e.g. third-party dependencies, compliance and ICT risks).

Clear responsibilities and cooperation between the 1^st and 2^nd line

For an effective ICS, the responsibilities of the 1^st and 2^nd lines must be clearly defined and delineated. Responsibility for defining processes and identifying and assessing non-financial risks is a non-delegable task of the 1^st line. The 2^nd line must ensure compliance with the specifications and methods developed in-house and validate the results provided by the 1^st line.

Risk-oriented approach

In practice, we see a high number of processes and controls in an ICS. This usually results from a lack of risk-based thinking in process descriptions and control design. All relevant processes should be part of the process map, However, the level of detail in the process documentation and risk assessment can vary based on the process’s significance.

The same applies to the need for controls. If the risk without controls is low or below the risk tolerance limit, the control measures or the frequency of implementation can be reduced.

ICS control testing concept

Without systematic ICS control testing, an ICS cannot prove its effectiveness. Clear specifications must be defined as to which controls are tested, how, by whom and at what frequency. For this purpose, the 2^nd line must draw up a risk-oriented ICS control plan spread over several years.

To help you avoid potential pitfalls and determine the level of development of your internal control system, we have designed an ICS fitness program. That program enables you to determine your ICS maturity level compared to the market and receive specific recommendations to enhance your ICS.

What is included in the zeb.ICS fitness check?

The first step in developing a tailor-made program is to survey and analyze the relevant key indicators of the ICS to determine the status quo. In the second phase, we carry out a targeted identification of weak spots based on these findings.

To ensure the long-term, sustainable optimization of the ICS, the program includes the derivation and prioritization of recommended actions and concrete implementation plans. These plans enable the ICS’s continuous enhancement and adaptation to future requirements.

Figure 1: zeb.ICS fitness check

Phase I: Status quo assessment

The objective of the initial phase is to establish transparency regarding the ICS maturity level. A standardized questionnaire is used for the structured survey and evaluation (see Figure 2). This questionnaire was developed by taking into account an ICS control loop (see our BankingHub article “Blackbox Internes Kontrollsystem”), which incorporates proven market best practices.

An assessment is made for each question to determine the degree to which the financial institution fulfills the respective requirement. This degree of fulfillment must be justified accordingly.

Figure 2: Extract from the questionnaire

zeb analyzes the answers and justifications and translates them into a score. This score represents the institution’s ICS maturity level and enables comparison with the market.

Phase II: Identification of ICS weaknesses

Once the maturity level has been analyzed, the potential for enhancement is identified for each phase of the ICS control loop. These serve as the basis for deriving concrete recommendations for enhancing the ICS specifically.

Phase III: Derivation of recommended actions

Based on the maturity assessment and defined objectives, the identified recommendations are prioritized according to regulatory requirements and implementation effort (Figure 3).

Figure 3: Exemplary prioritization of the recommended actions

Taking these into account, individual training plans for implementation are jointly developed. The focus of these plans is on the “train-the-trainer” principle. Our project experience shows that employee involvement and support are decisive success factors for establishing a sustainable ICS.

The training plans are tailored precisely to the bank’s requirements and include in particular

• concrete action measures assigned to the phase of the ICS control loop,
• clear responsibilities and realistic schedules,
• practice-oriented learning and implementation formats (e.g. workshops, process reviews) and
• KPIs for measuring progress.

The goal is to continuously improve the ICS through ongoing development and targeted training measures to ensure its long-term success.

What is our main conclusion regarding the strengthening of the ICS?

Strengthening the ICS is no longer a mere regulatory obligation but an essential component of responsible corporate governance. The zeb.ICS fitness check is an effective tool that helps banks systematically analyze the maturity level of their ICS, address weaknesses in a targeted manner, invest in the enhancement of the ICS in a structured way, and ensure its sustainable implementation.

The zeb.ICS fitness check provides an assessment of the current situation and is the starting point for strengthening control functions in the bank, thus providing an effective lever for long-term success.