DE
FR
IT
العربية
Contents 5
Gartner places the GRC software market in a new growth phase for 2025, driven by AI and shifting cyber risks. Behind this market movement lies a quieter but more consequential shift: away from spot-check control testing, toward continuous observation of risks and controls. This shift is not primarily a technical issue but a governance one. Those who monitor continuously must also be able to continuously assign responsibility, report, and decide.
The shift from periodic control testing to continuous monitoring primarily tightens governance obligations: institutions must maintain complete risk inventories, clarify responsibilities across the three lines, and make reporting lines to executive management and the board more concrete. Supervisory authorities such as FINMA do not prescribe a specific monitoring technology, but require traceable, up to date evidence, regardless of how often controls are tested.
What do supervisory texts actually require?
Neither FINMA Circular 2023/1 nor the EBA Guidelines on ICT risk prescribe continuous monitoring as a mandatory method, but both tighten the requirements for inventories and governance.
The fully revised FINMA Circular 2023/1 on operational risks and resilience was adopted on 13 December 2022 and entered into force on 1 January 2024, as Lexology reported on 19 January 2023. It is principles-based and technology-neutral, and requires a consistent, institution-wide inventory of operational risks.
Within two years of the circular entering into force, institutions must, according to InfoGuard, ensure operational resilience and meet further requirements from the circular. This deadline concerns the substance of the evidence, not the frequency of the testing behind it.
Does periodic testing remain in place regardless?
Yes, point-in-time instruments such as on-site inspections remain a central supervisory tool, while certain obligations are monitored continuously in parallel.
FINMA carried out 111 on-site inspections at banks, 55 at insurers and 20 in asset management in 2024, as finews.ch reported on 8 April 2025. At the same time, FINMA describes ongoing supervision of anti-money laundering rules as a permanent task.
For risk and compliance functions, this creates two parallel lines of evidence: continuously current data for the ongoing part of supervision, and audit-ready documentation for point-in-time inspections. Both lines need the same underlying data, but different preparation.
Two parallel lines of evidence emerge: ongoing data for permanent tasks, audit-ready documentation for on-site inspections.
What does the Three Lines Model change about collaboration?
The IIA renamed its model in 2020, placing greater emphasis on collaboration and accountability rather than pure defence, without specifying resource allocation between the lines in concrete terms.
On 20 July 2020, the IIA published the major update to the Three Lines Model, deliberately dropping the term defense to signal that its purpose extends beyond pure protective measures, as Diligent noted on 19 December 2025.
An analysis by the University of St. Gallen notes that the model introduced, for the first time, an explicit definition of the concept of assurance, which had previously been missing from the IIA standards. Neither the IIA nor the supervisory texts used here specify in detail how this affects job profiles or resources across the first, second and third lines.
How does this affect the independence of the second line?
The EBA Guidelines explicitly require separation of the control function from ICT operational processes, regardless of how closely monitoring is technically integrated.
The EBA Guidelines on ICT and security risk management have applied since 30 June 2020 and, according to Proper Banking, are for the first time addressed directly to credit institutions and payment institutions. They require independence and objectivity of the control function through adequate organisational separation.
A shared data basis for monitoring therefore does not automatically mean shared responsibility. Governance requirements for critical functions continue to demand separate responsibilities, even where the underlying data is the same.
What does this mean for reporting lines to executive management and the board?
Under the eight principles of the FINMA circular, risk control reports to the board at least annually and to executive management at least twice a year, regardless of the testing method behind it.
According to KPMG, the board must approve the bank’s critical functions and their disruption tolerances at least once a year, as Redguard summarised on 24 May 2024. At EU level, too, the framework is tightening: the DORA regulation entered into force on 16 January 2023 and applied directly to almost all financial entities from 17 January 2025, as KPMG and Orbiq note.
These reporting deadlines do not change automatically as data points become more frequent. Those monitoring continuously should nonetheless check whether existing ICT risk controls deliver the right information for the next reporting cycle.
One concrete first step: the risk or compliance function reconciles the existing control inventory with the reporting cycles for the board and executive management before the next regular reporting date, and documents any gaps in writing.
Control inventory and evidence in one place
The Internal Control System solution brings together the control inventory and test evidence. It supports both periodic testing cycles and continuously updated evidence.
Internal ControlsFrequently asked questions
Does FINMA prescribe a specific monitoring technology?
No. Both FINMA Circular 2023/1 and the EBA Guidelines on ICT risk are formulated in a technology-neutral way. They require traceable, up to date evidence on risks and controls, but do not prescribe a particular monitoring method or testing frequency. Institutions can combine periodic and continuous approaches as long as the governance requirements are met.
How many on-site inspections did FINMA carry out in 2024?
According to finews.ch, FINMA carried out 111 on-site inspections at banks, 55 at insurers and 20 in asset management in 2024. These figures show that point-in-time supervisory instruments remain a central tool despite increasing continuous monitoring, and are not replaced by ongoing data collection.
What did the Three Lines Model actually change in 2020?
On 20 July 2020, the IIA renamed its model and dropped the term defense to place greater emphasis on collaboration and accountability. For the first time, the concept of assurance was explicitly defined. How this concretely affects job profiles or resources across the three lines remains unspecified.
How often must risk control report to executive management under FINMA rules?
Under the eight principles of FINMA Circular 2023/1, risk control reports to the board at least annually and to executive management at least twice a year. These deadlines apply regardless of whether the underlying data is collected periodically or continuously.
What is a sensible first step when moving to continuous monitoring?
The risk or compliance function should reconcile the existing control inventory with the reporting cycles for the board and executive management before the next regular reporting date. Any gaps identified should be documented in writing so that the data basis for both lines of evidence stays consistent.
- Effective supervision creates a stable financial systemFINMA
- The Three Lines Model and the Concept of AssuranceUniversity of St. Gallen, Expert Focus
