# When GRC Software Becomes a Vantage Point > The article explains how the shift from periodic control testing to continuous monitoring tightens governance duties for risk and compliance teams in finance. SwissGRC® covers FINMA, EBA and DORA requirements and names a first practical step. - URL: https://swissgrc.com/ar/grc-software-vantage-point-continuous-monitoring/ - الناشر: SwissGRC® - تاريخ النشر: 2026-09-23 - آخر تحديث: 2026-09-23 ## معلومات أساسية - FINMA Circular 2023/1 on operational risks and resilience was adopted on 13 December 2022 and entered into force on 1 January 2024. - Neither FINMA Circular 2023/1 nor the EBA Guidelines on ICT risk prescribe continuous monitoring as a mandatory method, but both tighten the requirements for inventories and governance. - FINMA carried out 111 on-site inspections at banks, 55 at insurers and 20 in asset management in 2024, according to finews.ch. - The IIA published the update to its Three Lines Model on 20 July 2020 and dropped the term defense to emphasise collaboration and accountability. - The EBA Guidelines on ICT and security risk management have applied since 30 June 2020 and require organisational separation of the control function from ICT operational processes. - The DORA regulation entered into force on 16 January 2023 and applied directly to almost all financial entities from 17 January 2025. Gartner places the GRC software market in a new growth phase for 2025, driven by AI and shifting cyber risks. Behind this market movement lies a quieter but more consequential shift: away from spot-check control testing, toward continuous observation of risks and controls. This shift is not primarily a technical issue but a governance one. Those who monitor continuously must also be able to continuously assign responsibility, report, and decide. In short The shift from periodic control testing to continuous monitoring primarily tightens governance obligations: institutions must maintain complete risk inventories, clarify responsibilities across the three lines, and make reporting lines to executive management and the board more concrete. Supervisory authorities such as FINMA do not prescribe a specific monitoring technology, but require traceable, up to date evidence, regardless of how often controls are tested. 111inspections FINMA on-site inspections at banks in 2024 finews.ch, 8 April 2025 2years Period between DORA entering into force and direct applicability KPMG / Orbiq ## What do supervisory texts actually require? Neither FINMA Circular 2023/1 nor the EBA Guidelines on ICT risk prescribe continuous monitoring as a mandatory method, but both tighten the requirements for inventories and governance. The fully revised FINMA Circular 2023/1 on operational risks and resilience was adopted on 13 December 2022 and entered into force on 1 January 2024, as Lexology reported on 19 January 2023. It is principles-based and technology-neutral, and requires a consistent, institution-wide inventory of operational risks. Within two years of the circular entering into force, institutions must, according to InfoGuard, ensure operational resilience and meet further requirements from the circular. This deadline concerns the substance of the evidence, not the frequency of the testing behind it. ## Does periodic testing remain in place regardless? Yes, point-in-time instruments such as on-site inspections remain a central supervisory tool, while certain obligations are monitored continuously in parallel. FINMA carried out 111 on-site inspections at banks, 55 at insurers and 20 in asset management in 2024, as finews.ch reported on 8 April 2025. At the same time, FINMA describes [ongoing supervision of anti-money laundering rules](https://www.finma.ch/en/finma/activities/supervision/) as a permanent task. For risk and compliance functions, this creates two parallel lines of evidence: continuously current data for the ongoing part of supervision, and audit-ready documentation for point-in-time inspections. Both lines need the same underlying data, but different preparation. Two parallel lines of evidence emerge: ongoing data for permanent tasks, audit-ready documentation for on-site inspections. ## What does the Three Lines Model change about collaboration? The IIA renamed its model in 2020, placing greater emphasis on collaboration and accountability rather than pure defence, without specifying resource allocation between the lines in concrete terms. On 20 July 2020, the IIA published the major update to the Three Lines Model, deliberately dropping the term defense to signal that its purpose extends beyond pure protective measures, as Diligent noted on 19 December 2025. An analysis by the University of St. Gallen notes that the model introduced, for the first time, an explicit definition of the [concept of assurance](https://alexandria.unisg.ch/bitstreams/7b10168e-1994-485c-a94d-19ee8650feca/download), which had previously been missing from the IIA standards. Neither the IIA nor the supervisory texts used here specify in detail how this affects job profiles or resources across the first, second and third lines. ## How does this affect the independence of the second line? The EBA Guidelines explicitly require separation of the control function from ICT operational processes, regardless of how closely monitoring is technically integrated. The EBA Guidelines on ICT and security risk management have applied since 30 June 2020 and, according to Proper Banking, are for the first time addressed directly to credit institutions and payment institutions. They require independence and objectivity of the control function through adequate organisational separation. A shared data basis for monitoring therefore does not automatically mean shared responsibility. Governance requirements for critical functions continue to demand separate responsibilities, even where the underlying data is the same. ## What does this mean for reporting lines to executive management and the board? Under the eight principles of the FINMA circular, risk control reports to the board at least annually and to executive management at least twice a year, regardless of the testing method behind it. According to KPMG, the board must approve the bank’s critical functions and their disruption tolerances at least once a year, as Redguard summarised on 24 May 2024. At EU level, too, the framework is tightening: the DORA regulation entered into force on 16 January 2023 and applied directly to almost all financial entities from 17 January 2025, as KPMG and Orbiq note. These reporting deadlines do not change automatically as data points become more frequent. Those monitoring continuously should nonetheless check whether existing ICT risk controls deliver the right information for the next reporting cycle. One concrete first step: the risk or compliance function reconciles the existing control inventory with the reporting cycles for the board and executive management before the next regular reporting date, and documents any gaps in writing. Related ### Control inventory and evidence in one place The Internal Control System solution brings together the control inventory and test evidence. It supports both periodic testing cycles and continuously updated evidence. [Internal Controls](https://swissgrc.com/ar/internal-control-software-ics/) For practice ## Key points - FINMA Circular 2023/1 does not mandate continuous monitoring, but requires more precise risk inventories and clear governance responsibilities. - Periodic instruments such as on-site inspections remain in place under FINMA’s 2024 practice, even as other obligations are monitored continuously. - The 2020 Three Lines Model shifts the focus to collaboration and accountability, without concretely assigning roles or resources. - The EBA Guidelines continue to require organisational separation of the control function from ICT operational processes, regardless of the monitoring technology used. - A first step is to reconcile the existing control inventory with the reporting cycles for the board and executive management. FAQ ## Frequently asked questions Does FINMA prescribe a specific monitoring technology? No. Both FINMA Circular 2023/1 and the EBA Guidelines on ICT risk are formulated in a technology-neutral way. They require traceable, up to date evidence on risks and controls, but do not prescribe a particular monitoring method or testing frequency. Institutions can combine periodic and continuous approaches as long as the governance requirements are met. How many on-site inspections did FINMA carry out in 2024? According to finews.ch, FINMA carried out 111 on-site inspections at banks, 55 at insurers and 20 in asset management in 2024. These figures show that point-in-time supervisory instruments remain a central tool despite increasing continuous monitoring, and are not replaced by ongoing data collection. What did the Three Lines Model actually change in 2020? On 20 July 2020, the IIA renamed its model and dropped the term defense to place greater emphasis on collaboration and accountability. For the first time, the concept of assurance was explicitly defined. How this concretely affects job profiles or resources across the three lines remains unspecified. How often must risk control report to executive management under FINMA rules? Under the eight principles of FINMA Circular 2023/1, risk control reports to the board at least annually and to executive management at least twice a year. These deadlines apply regardless of whether the underlying data is collected periodically or continuously. What is a sensible first step when moving to continuous monitoring? The risk or compliance function should reconcile the existing control inventory with the reporting cycles for the board and executive management before the next regular reporting date. Any gaps identified should be documented in writing so that the data basis for both lines of evidence stays consistent. Sources 1. [Effective supervision creates a stable financial system](https://www.finma.ch/en/finma/activities/supervision/)FINMA 2. [The Three Lines Model and the Concept of Assurance](https://alexandria.unisg.ch/bitstreams/7b10168e-1994-485c-a94d-19ee8650feca/download)University of St. Gallen, Expert Focus ## الأسئلة الشائعة ### Does FINMA prescribe a specific monitoring technology? No. FINMA Circular 2023/1 is principles-based and technology-neutral, and the EBA Guidelines on ICT risk also do not prescribe continuous monitoring. They require traceable, up to date evidence on risks and controls. ### Does periodic control testing still matter if institutions monitor continuously? Yes. Point-in-time instruments such as FINMA on-site inspections remain a central supervisory tool, while certain obligations are monitored continuously in parallel. Risk and compliance functions therefore need continuously current data and audit-ready documentation. ### What did the Three Lines Model change in 2020? On 20 July 2020, the IIA dropped the term defense to place more emphasis on collaboration and accountability. It also introduced an explicit definition of assurance. How this affects job profiles or resources across the three lines is not specified. ### How often does risk control report to the board and executive management under the FINMA circular? Under the eight principles of the FINMA circular, risk control reports to the board at least annually and to executive management at least twice a year. These deadlines apply regardless of the testing method. ### What is a sensible first step when moving to continuous monitoring? The risk or compliance function reconciles the existing control inventory with the reporting cycles for the board and executive management before the next regular reporting date. It documents any gaps in writing.