Protected: ICS fitness check – future-proofing your internal control system

What is the main function of a functional and effective internal control system (ICS)?

A well-functioning and effective ICS is an integral part of a bank’s management of non-financial risks and contributes significantly to a secure and properly organized business. Regularly reviewing the ICS is essential to ensuring the stability and efficiency of processes. In the long term, an effective ICS creates a strong foundation of trust with customers, investors and supervisory authorities.

Which key enhancement measures are currently being observed in the market?

Several enhancement measures have been identified as part of projects aimed at making the ICS more effective and efficient. These include integrating OpRisk and ICS assessments, clearly defining responsibilities, and promoting cooperation between the 1^st and 2^nd lines. Other measures entail applying a risk-oriented approach to determining controls and establishing a systematic ICS control testing concept.

How are the responsibilities between the 1^st and 2^nd lines in the ICS typically delineated?

For an effective ICS, the responsibilities of the 1^st and 2^nd lines must be clearly defined and delineated from one another. The 1^st line is responsible for defining processes as well as identifying and assessing non-financial risks. The 2^nd line, on the other hand, ensures compliance with the specially developed specifications and is responsible for validating the results provided by the 1^st line.

What is involved in the three-stage zeb.ICS fitness check?

The zeb.ICS fitness check is a program that was developed to determine the level of ICS maturity and provide concrete recommendations for enhancement. It is divided into three phases:

• Phase I – status quo assessment: in this phase, the relevant vital parameters of the ICS are collected and analyzed to create transparency regarding the ICS maturity level and determine the status quo.
• Phase II – identification of ICS weaknesses: based on the findings from Phase I, a targeted identification of weak spots is carried out.
• Phase III – derivation of recommended actions: finally, recommended actions are derived and prioritized based on implementation effort and regulatory requirements.