Tailored control concepts and successful implementation

ICS Design & Implementation

Design and implementation of internal control systems (ICS).

  • 01Systematic design of a risk-based control system in accordance with recognized standards
  • 02Efficient implementation with a focus on practical feasibility and value
  • 03Optimal balance between risk minimization and appropriate control effort
  • 04Sustainable embedding of the ICS in processes, systems, and corporate culture
View services
11+Years of experience
120+Employees
540+Projects
ISO 27001certified

Systematic Approach for Successful ICS Design and Implementation

A successful internal control system begins with a well-thought-out design and effective implementation. The right approach ensures that your ICS not only meets regulatory requirements, but also creates genuine value for your organization — through effective risk minimization, increased process efficiency, and improved transparency. Our structured approach combines proven methods with industry-specific expertise and takes into account both the technical and cultural aspects of a successful ICS introduction.

Our offering in the area of ICS design and implementation encompasses the systematic development and effective execution of tailored internal control systems, optimally aligned with your specific requirements, processes, and risks. We accompany you throughout the entire process — from the initial analysis phase through design and implementation to the sustainable embedding and continuous improvement of the ICS within your organization.

4 service modules

Service scope

01

ICS Design and Control Conception

Systematic development of a tailored internal control system with an optimal control architecture for your specific risks and processes. We design a balanced control system in accordance with recognized standards such as COSO, IDW PS 981, or SOX, providing effective protection with appropriate effort.

  • Process- and risk-based derivation of the control architecture and requirements
  • Development of an integrated control concept with various control types
  • Definition of control objectives, activities, and required evidence
  • Creation of control matrices with clear responsibilities and frequencies
02

ICS Implementation and Rollout

Support for the practical execution and stepwise introduction of your internal control system. We assist you with effective implementation, ensure high acceptance within the organization, and make certain that controls are effectively integrated into your business processes.

  • Development of a structured implementation roadmap and planning
  • Creation of control descriptions and execution instructions
  • Implementation support and coaching for control and process owners
  • Establishment of communication and escalation channels for the ICS
03

ICS Change Management and Training

Targeted support for the organizational and cultural embedding of the internal control system. We develop and implement change management concepts and training measures that promote acceptance and understanding of the ICS and convey practical knowledge for control execution.

  • Development of an ICS-specific change management concept
  • Design and delivery of target-group-specific ICS training
  • Creation of training materials and user manuals
  • Communication and awareness measures for various stakeholders
04

ICS Documentation and Evidence

Development and implementation of efficient, appropriate ICS documentation that meets both regulatory requirements and provides practical value for the organization. We support you in establishing traceable evidence management for your internal control system.

  • Design of a structured ICS documentation hierarchy and standards
  • Development of control evidence formats and documentation templates
  • Implementation of efficient processes for control documentation
  • Support in selecting and introducing documentation tools

5 phases

Our Approach

Developing and implementing an effective internal control system requires a structured, methodical approach that simultaneously accounts for the specific characteristics of your organization. Our proven methodology combines a systematic approach with industry-specific expertise, ensuring that your ICS is tailored, effective, and implemented with appropriate effort.

  1. Step 1

    Analysis & Planning - Analysis of the process landscape, risk assessment, assessment of existing controls, definition of the project framework, and definition of ICS objectives and scope

  2. Step 2

    Design & Conception - Development of the control architecture, definition of control objectives, activities and evidence, creation of the control matrix, and alignment with relevant stakeholders

  3. Step 3

    Implementation & Rollout - Stepwise introduction of controls, creation of required documentation, training of control owners, and establishment of communication channels

  4. Step 4

    Change Management & Training - Support of organizational change, target-group-specific training, and awareness measures for managers and employees

  5. Step 5

    Evaluation & Improvement - Initial effectiveness review, identification of improvement potential, and establishment of a continuous improvement process

Your contact

Melanie Düring

Head of Risk Management

+49 69 913 113-01 info@advisori.de

Our Strengths

  • 01Comprehensive expertise in recognized ICS frameworks such as COSO, IDW PS 981, and SOX
  • 02Combined process and risk management perspective for optimal control design
  • 03Experience in numerous successful ICS implementation projects of varying scale
  • 04Practice-oriented approach with a focus on manageability and acceptance of the ICS

Expert Tip

A balanced approach is critical when designing and implementing an internal control system. Our experience shows that the greatest successes in ICS projects are achieved when methodical rigor ensures effectiveness on the one hand, while practical feasibility and business value remain the constant focus on the other. Risk-based prioritization is particularly important: concentrate first on the controls with the greatest benefit, and avoid excessive control density in non-critical areas.

7 QUESTIONS, BRIEFLY ANSWERED

Frequently asked questions about ICS Design & Implementation

What is an internal control system (ICS) and why do banks need one?

An internal control system encompasses all regulations, procedures, and controls that ensure business processes operate properly, effectively, and economically. For banks, an ICS is mandatory under MaRisk AT 4.3 and must include organizational structure, risk management and controlling processes, and internal audit. The COSO framework and IDW PS 981 provide recognized reference frameworks for design. An effective ICS protects against operational risks, compliance violations, and financial losses.

What regulatory requirements apply to the ICS in banks?

MaRisk (AT 4.3) requires an adequate and effective ICS with clear organizational structure. BaFin regularly reviews design and effectiveness through market examinations. Listed companies must additionally comply with SOX Section 404 requirements for Internal Controls over Financial Reporting (ICFR). IDW PS 981 offers a voluntary German audit standard with a principles-based approach. DORA adds specific ICT control requirements from 2025. The three lines of defence structure provides the organizational framework.

How do you develop a risk-control matrix for the ICS?

The risk-control matrix (RCM) is the central management tool of an ICS. It is developed in four steps: First, systematic identification of process-related risks across all business areas. Second, assessment by likelihood and impact. Third, derivation of control objectives and activities with clear risk mapping. Fourth, definition of control responsibilities, frequencies, and evidence requirements. The RCM should contain an appropriate mix of preventive, detective, and corrective controls.

How long does ICS implementation take at a bank?

Implementation duration depends on institution size and complexity. For mid-sized banks, the typical project timeline is six to twelve months, covering gap analysis, framework design, risk-control matrix creation, rollout, and effectiveness testing. The process occurs in waves: high-risk areas such as lending and treasury are covered first, then additional business units are added progressively. ADVISORI supports all phases and ensures sustainable operations through train-the-trainer concepts.

What is the difference between ICS design testing and effectiveness testing?

Design testing (design assessment) verifies whether required controls are conceptually in place and appropriately designed, meaning the right controls are defined at the right points. Effectiveness testing (operating effectiveness testing) goes further: it verifies whether implemented controls actually functioned as intended throughout the entire audit period. Both types of testing are necessary for a MaRisk-compliant ICS.

How can ICS controls be automated?

Automation occurs in stages: IT-supported controls use system validations and authorization concepts. Continuous control monitoring enables real-time oversight through automated rule checks. Process mining automatically detects process deviations and control weaknesses. RPA automates repetitive control activities such as data reconciliations. GRC software integrates control documentation, testing, and reporting on a single platform. The automation level should be determined on a risk basis, as not every control requires automation.

What does ICS consulting and implementation cost for financial institutions?

Typical project budgets for mid-sized institutions range from EUR 150,000 to 400,000 for complete ICS setup including framework, risk-control matrix, training, and initial effectiveness testing. Key factors include the number of business processes, existing maturity level, and automation requirements. ADVISORI offers modular service packages: from ICS quick checks and gap analysis through framework design and implementation support to ongoing effectiveness testing and GRC tool selection.