Building and testing an internal control system

Short answer: You build an internal control system (ICS) in seven steps: define the scope, document processes, assess risks, define key controls, record them, test the controls and remediate deficiencies. In Switzerland, the statutory auditor checks in an ordinary audit whether an ICS exists (Art. 728a(1) no. 3 of the Swiss Code of Obligations, CO). In Germany, the management board must set up a monitoring system (§ 91(2) of the German Stock Corporation Act, AktG); listed companies must also have an appropriate and effective ICS (§ 91(3) AktG).

This guide is for CFOs, heads of compliance, general counsel and board members in Switzerland and Germany who need to build an internal control system, rework it after audit findings or test it for the first time. It sets out the legal requirements, the work steps with deliverables and roles, and when interim support makes sense.

Switzerland: what applies to the ICS in an ordinary audit?

Companies subject to an ordinary audit (ordentliche Revision) need an ICS, and the statutory auditor checks every year that it exists (Art. 728a(1) no. 3 CO). Under Art. 727(1) CO, an ordinary audit is required for:

• public companies, for example those with listed equity securities or outstanding bonds,
• companies that exceed two of three thresholds in two consecutive financial years: total assets of CHF 20 million, revenue of CHF 40 million, 250 full-time positions on annual average,
• companies required to prepare consolidated accounts.

The auditor takes the ICS into account when planning and performing the audit (Art. 728a(2) CO). Its findings on the ICS appear in the comprehensive report to the board of directors (Art. 728b(1) CO). For limited liability companies (GmbH), the stock corporation rules on the auditor apply accordingly (Art. 818(1) CO). In a limited audit (eingeschränkte Revision), the ICS is not an explicit audit subject (Art. 729a CO).

Board responsibility: Whatever the type of audit, structuring the accounting system and financial control and overseeing management are non-transferable duties of the board of directors (Art. 716a(1) nos. 3 and 5 CO). In a GmbH, these duties lie with the managing directors (Art. 810(2) CO). How the auditor tests existence in practice is set out in Swiss auditing standard PS-CH 890 issued by EXPERTsuisse; the version that applies is the current one, which you should align with your auditor.

Important when building the system: the statutory auditor may not build the ICS it later audits. Services that would require it to audit its own work are incompatible with its independence (Art. 728(2) no. 4 CO). Design and testing must therefore be done in-house or with other support.

Germany: what are the requirements for control systems?

In Germany, the duty to maintain an ICS comes from company law, accounting law and, for financial institutions, supervisory law. The key provisions:

• Every stock corporation (AG): the management board must take suitable measures, in particular set up a monitoring system, so that developments threatening the company's survival are identified early (§ 91(2) AktG).
• Listed AG: the management board must also set up an ICS and a risk management system that are appropriate and effective in view of the scope of business and the risk profile (§ 91(3) AktG). The auditor assesses whether the monitoring system under § 91(2) AktG can fulfil its tasks (§ 317(4) of the German Commercial Code, HGB).
• Duty of care and liability: board members must apply the care of a prudent and conscientious manager and are liable for breaches; in a dispute, the burden of proof is on them (§ 93(1) and (2) AktG). A documented ICS helps to demonstrate the care applied.
• Supervisory board: an audit committee may deal with the effectiveness of the ICS, the risk management system and the internal audit system (§ 107(3) AktG). Public-interest entities must set one up (§ 107(4) AktG).
• Capital-market-oriented companies: the management report describes the main features of the ICS and the risk management system with regard to the financial reporting process (§ 289(4) HGB).
• Credit and financial services institutions: § 25a(1) of the German Banking Act (KWG) requires internal control procedures with an ICS and an independent internal audit function. The MaRisk (BaFin Circular 06/2026 (BA) of 30 June 2026) set this out in AT 4.3: organisational structure and workflows, risk management and controlling processes, a risk control function and a compliance function.

For the GmbH, the German Limited Liability Companies Act contains no explicit ICS duty. Managing directors must, however, apply the care of a prudent businessperson (Section 43(1) GmbHG) and continuously monitor developments that could threaten the company's continued existence (Section 1(1) of the Corporate Stabilisation and Restructuring Act, StaRUG). How far Section 91(2) AktG extends to the GmbH beyond this depends on size and complexity and is not answered uniformly; in practice, an appropriate ICS is the simplest way to evidence that care.

How do you build an ICS? Documenting processes, risks and controls

Building an internal control system means mapping material processes, assessing their risks and assigning a verifiable control to every material risk. This sequence works well:

1. Define the scope: identify material financial statement items, entities and processes, such as purchase-to-pay, order-to-cash, payroll, financial close and IT.
2. Document processes: capture workflows as narratives or flowcharts, including systems and interfaces.
3. Assess risks: record for each process what can go wrong and weight it by likelihood and impact.
4. Define controls: identify key controls such as segregation of duties, the four-eyes principle, approval limits, reconciliations and access rights.
5. Record: build a risk and control matrix with control owners, frequency and evidence.
6. Test: check the design and operation of the controls (see the next section).
7. Remediate and report: rate deficiencies, set actions with deadlines and inform the board of directors, the management board or the audit committee.

If you are building a compliance management system at the same time, maintain the risk inventory and controls together. How the elements fit is explained in our guide to building a compliance management system.

Control testing: how do you check that controls work?

Control testing answers two questions: is the control designed correctly, and is it performed as described? In Switzerland, Art. 728a CO requires the ordinary audit to check existence; the wording does not call for an opinion on effectiveness. For listed companies in Germany, § 91(3) AktG goes further and requires an effective system, which points to regular effectiveness testing.

• Design: does the control address the risk? Is it clear who checks what, when, and what the evidence looks like?
• Implementation (walkthrough): one transaction is traced from start to finish to show whether the control actually happens in day-to-day work.
• Operating effectiveness: a sample from the test period shows whether the control worked throughout. Sample size depends on control frequency; set the method in the test plan upfront.
• Deficiency assessment: every exception is documented, rated by severity and given an action, an owner and a deadline.

For German institutions, internal audit independently audits all activities and processes on a risk-oriented basis, including the internal control system (MaRisk AT 4.4.3 para. 5). Findings from such audits can be worked through with a structured action plan, as described in our guide to compliance remediation after audit findings.

Roles and capacity: when does interim support help?

Interim support helps most in three situations: the first build, the run-up to the first ordinary audit and the remediation of audit findings. Each involves a large volume of documentation and testing that the existing team can rarely handle alongside day-to-day work.

• ICS project lead: plans scope, timeline and reporting and manages alignment with the statutory or external auditor.
• Process and control documentation: professionals with experience in finance processes, compliance or regulation map workflows and draft controls together with process owners.
• Control testing: testers should not be the people who perform the controls. External professionals provide that distance.
• Remediation: an interim team implements actions and documents the evidence.

Alpinum Solutions provides legal and compliance professionals for this work through staff leasing or freelancing, part-time or full-time, as individuals or teams, from junior to senior level. Under staff leasing, the company holds the right to give professional instructions and the professional is integrated into the organisation. Under freelancing, the professional works independently within the agreed mandate. Selected profiles are usually available within 48 hours; the company and Alpinum agree the start date together.

Example (assumption): a Swiss industrial group exceeds two of the three thresholds under Art. 727 CO for the first time and moves to an ordinary audit. A senior professional leads the ICS build full-time, while an experienced professional maps processes part-time and prepares the tests. The in-house finance team remains the owner of the controls.

Limits and risks

• Responsibility stays with the board of directors or management board. External professionals support design and testing but do not take on corporate body responsibility.
• Internal control testing does not replace an audit by the statutory auditor, external auditor or internal audit.
• An ICS that exists only on paper will not pass an existence check. Control owners must know and perform their controls.
• Alpinum is neither a law firm nor an audit firm. Audit opinions and legal opinions require the competent bodies.

Frequently asked questions about internal control systems

Who needs an internal control system?

In Switzerland, every company subject to an ordinary audit needs an ICS, because the statutory auditor checks that it exists (Art. 728a(1) no. 3 CO). This covers public companies, companies required to consolidate and companies above two of three thresholds under Art. 727 CO. In Germany, every AG must set up a monitoring system (§ 91(2) AktG), listed companies an appropriate and effective ICS (§ 91(3) AktG), and institutions an ICS under § 25a KWG.

What does the Swiss statutory auditor check?

In an ordinary audit, the statutory auditor checks whether an internal control system exists and takes it into account when planning and performing the audit (Art. 728a CO). Its findings on the ICS are set out in the comprehensive report to the board of directors (Art. 728b(1) CO). The wording does not require an opinion on effectiveness, but existence presupposes controls that are documented and actually performed.

What is the difference between existence and effectiveness of an ICS?

Existence means that risks are identified and controls are documented and implemented. Effectiveness means that the controls work as intended throughout the whole period, shown by sample testing. The Swiss Code of Obligations focuses on existence in an ordinary audit. § 91(3) AktG requires listed German companies to have an appropriate and effective system.

May the statutory auditor help build the ICS?

Only to a limited extent. In an ordinary audit, services that would require the auditor to audit its own work are incompatible with its independence (Art. 728(2) no. 4 CO). The build is therefore usually handled by the company's own team, a different adviser or interim professionals directed by the company itself.

Can an interim professional test controls?

Yes. An interim professional can prepare test plans, run walkthroughs, test samples and document deficiencies. The key point is that they do not test controls they perform themselves. Responsibility for the ICS stays with the board of directors or management board, and internal testing does not replace the external audit by the statutory or external auditor.

Next step

Clarify the scope, the date of the next audit and the roles you lack in-house. You can then put together an interim team with a clear brief.

• Risk management, internal controls and governance: interim professionals
• Interim compliance for companies
• Regulatory change management: implementing new rules
• Discuss your requirements

Last updated: 31 October 2026.