ICS Design & Implementation

An internal control system encompasses all regulations, procedures, and controls that ensure business processes operate properly, effectively, and economically. For banks, an ICS is mandatory under MaRisk AT 4.3 and must include organizational structure, risk management and controlling processes, and internal audit. The COSO framework and IDW PS

981 provide recognized reference frameworks for design. An effective ICS protects against operational risks, compliance violations, and financial losses.

MaRisk (AT 4.3) requires an adequate and effective ICS with clear organizational structure. BaFin regularly reviews design and effectiveness through market examinations. Listed companies must additionally comply with SOX Section

404 requirements for Internal Controls over Financial Reporting (ICFR). IDW PS

981 offers a voluntary German audit standard with a principles-based approach. DORA adds specific ICT control requirements from 2025. The three lines of defence structure provides the organizational framework.

The risk-control matrix (RCM) is the central management tool of an ICS. It is developed in four steps: First, systematic identification of process-related risks across all business areas. Second, assessment by likelihood and impact. Third, derivation of control objectives and activities with clear risk mapping. Fourth, definition of control responsibilities, frequencies, and evidence requirements. The RCM should contain an appropriate mix of preventive, detective, and corrective controls.

Implementation duration depends on institution size and complexity. For mid-sized banks, the typical project timeline is six to twelve months, covering gap analysis, framework design, risk-control matrix creation, rollout, and effectiveness testing. The process occurs in waves: high-risk areas such as lending and treasury are covered first, then additional business units are added progressively. ADVISORI supports all phases and ensures sustainable operations through train-the-trainer concepts.

Design testing (design assessment) verifies whether required controls are conceptually in place and appropriately designed, meaning the right controls are defined at the right points. Effectiveness testing (operating effectiveness testing) goes further: it verifies whether implemented controls actually functioned as intended throughout the entire audit period. Both types of testing are necessary for a MaRisk-compliant ICS.

Automation occurs in stages: IT-supported controls use system validations and authorization concepts. Continuous control monitoring enables real-time oversight through automated rule checks. Process mining automatically detects process deviations and control weaknesses. RPA automates repetitive control activities such as data reconciliations. GRC software integrates control documentation, testing, and reporting on a single platform. The automation level should be determined on a risk basis, as not every control requires automation.

Typical project budgets for mid-sized institutions range from EUR 150,

000 to 400,

000 for complete ICS setup including framework, risk-control matrix, training, and initial effectiveness testing. Key factors include the number of business processes, existing maturity level, and automation requirements. ADVISORI offers modular service packages: from ICS quick checks and gap analysis through framework design and implementation support to ongoing effectiveness testing and GRC tool selection.