# Internal Control Software / ICS

> Swiss GRC bietet auf der SwissGRC® Platform eine Software für das interne Kontrollsystem (IKS bzw. ICS) an. Sie verteilt Kontrollen automatisch, hält Nachweise bei der Durchführung fest und macht die Wirksamkeit prüfbar.

- URL: https://swissgrc.com/en/internal-control-software-ics/
- Publisher: SwissGRC®
- Published: 2023-02-07
- Last updated: 2026-10-07

## Key facts

- Die SwissGRC® Platform verteilt fällige Kontrollen automatisch an die Kontrollverantwortlichen und erinnert sie an Fristen.
- Nachweise, Zeitstempel, Verantwortlichkeiten und Historie entstehen bei der Durchführung der Kontrolle und liegen direkt an der Kontrolle.
- Prozesse werden nach BPMN 2.0 modelliert, Risiken und Kontrollen sind direkt am Prozessschritt verknüpft.
- Die Risiko-Kontroll-Matrix zeigt pro Kontrolle Verantwortliche, Häufigkeit und Relevanz sowie Angemessenheit und Wirksamkeit; die Häufigkeit reicht von täglich bis ereignisgesteuert.
- Kontrolltests umfassen Walkthrough, Designtest und Gesamtbeurteilung; Feststellungen erhalten Massnahme, Verantwortliche und Frist.
- Die Lösung stützt sich auf COSO Internal Control, Art. 728a OR und PS 890 sowie auf Schlüsselkontrollen und Funktionentrennung.
- Prozesse und Kontrollen lassen sich gemeinsam für ICS, Interne Revision und Risikomanagement nutzen.

Internal Control System

# Your control is described. But is it effective?

Reduce risk, improve processes.
**Run, evidence and assess your controls continuously.** Existence and effectiveness evidenced.

[Request Demo](https://swissgrc.com/en/internal-control-software-ics/#contact) [Explore features](https://swissgrc.com/en/internal-control-software-ics/#features)

Control cockpit continuously updated

**84***%*

evidenced effective

+12 points year on year

**100**controls in the inventory

**9**findings open

**7**not yet tested

What the platform takes care of

- Controls distributed automatically, with due date and reminder
- Evidence is produced during execution, not afterwards
- Effectiveness evidenced, audit ready at any time

*no more spreadsheets by email**·**audits in days instead of weeks**·**control gaps surface early*

Trusted by leading organizations

What makes the difference

## From an annual scramble to continuous control operation

Processes, risks and controls are documented in most organizations. What sets them apart is whether the controls actually run day to day.

The common starting point

### An ICS that wakes up for the season

The risk control matrix lives in Excel and evidence arrives by email. Shortly before the audit, everything is tested at once.

- Control matrix in Excel, evidence by email
- Control owners do not know what is due when
- Testing happens just before the audit, all at once
- Findings are recorded but not followed through

With the SwissGRC® Platform

### An ICS that keeps working all year

Controls are distributed, confirmed and evidenced automatically. Effectiveness builds up over the year, not in December.

- Controls distributed automatically, with due date and reminder
- Evidence attached directly to the control execution
- Control tests and assessments spread across the year
- Findings with action, owner and due date

The SwissGRC® Platform at a glance

## Your entire ICS, in one place

Model, link, execute, assess, test and report. Click through the six views.

BPMN 2.0

### Processes, risks and controls in one picture

Management, core and support processes modelled, with roles in swim lanes. **Risks and controls sit right on the process step**.

- Process hierarchy from management to support processes
- Risks marked on the process step, not in a side list
- PDF export, approval and version held on the process

![BPMN process model with risks on the process step in the SwissGRC Platform](https://swissgrc.com/en/wp-content/uploads/sites/2/2023/04/BPMN.png)

RCM

### Every risk with its control

The matrix brings process, risk and control together, with owner, frequency and relevance. **Control design and effectiveness visible in one column**.

- Grouped by process, key controls flagged
- Control frequency from daily to event driven
- Adequacy and effectiveness at a glance

![Risk control matrix grouped by process in the SwissGRC Platform](https://swissgrc.com/en/wp-content/uploads/sites/2/2023/04/ICS_RCM-1024x639.png)

Control execution

### The control reaches the right person

The platform distributes due controls to their owners automatically and reminds them of deadlines. **Execution is confirmed and evidenced**.

- Automatic notification with a link to the task
- Task with due date, assignment and status
- Evidence and findings attached to the task

![Automated control confirmation with task and notification in the SwissGRC Platform](https://swissgrc.com/en/wp-content/uploads/sites/2/2023/04/ICS_Control_Execution-1024x738.png)

Adequacy and effectiveness

### Adequate and effective, assessed

Controls are assessed regularly for adequacy and effectiveness. **The dashboard shows where it breaks down**, by process and organizational unit.

- Controls evaluated by process and effectiveness
- Filter by organizational unit, category and process
- Key controls assessed separately

![Dashboard assessing adequacy and effectiveness of controls](https://swissgrc.com/en/wp-content/uploads/sites/2/2023/04/ICS_Control_Assessments-1024x627.png)

Testing and findings

### Effectiveness tested, deficiencies documented

Walkthrough, design test and overall rating structured per control. **Findings and recommendations emerge during the test**, not afterwards.

- Test questionnaire ordered by area and control
- Walkthrough, design test and overall rating documented
- Findings and recommendations captured directly

![Control testing with walkthrough, design test and findings in the SwissGRC Platform](https://swissgrc.com/en/wp-content/uploads/sites/2/2023/04/Kontrolltesting.png)

Reporting

### Control results for the right audience

Execution status, adequacy and effectiveness in one dashboard. **One picture that both management and the statutory auditor can rely on**.

- Execution status by open, in progress and completed
- Adequacy and effectiveness per period
- ICS report and risk control matrix as ready analyses

![ICS dashboard with execution status, adequacy and effectiveness](https://swissgrc.com/en/wp-content/uploads/sites/2/2023/04/ICS_Reporting-1024x627.png)

Built on **recognized methods and standards**, from process modelling through to the control test.

COSO Internal Control Art. 728a Swiss CO PS 890 [BPMN 2.0](https://swissgrc.com/en/bpm-software) Key controls Segregation of duties

Evidence and audit

## Existence is mandatory. Effectiveness pays off.

In a statutory audit the auditor verifies that an ICS exists (Art. 728a para. 1 no. 3 Swiss CO, PS 890). Evidencing effectiveness beyond that shortens the audit and produces information you can steer with.

Evidence held on the control

Records, timestamps, ownership and history are produced during execution. The ICS documentation is ready to show at any time.

Existence evidenced, effectiveness tested

Control design and execution are documented, walkthrough and test result sit on the control. Voluntary effectiveness audits are prepared for.

Findings and actions

Deficiencies are rated, given an owner and a due date and tracked through to closure. Nothing is left sitting on a list.

Document management

Process documentation, directives and manuals versioned, reviewed and approved, referenced from the process and from the control.

One control set, several disciplines

The same processes and controls carry ICS, internal audit and risk management. Maintain once, use many times.

[Process modelling](https://swissgrc.com/en/bpm-software) [Internal audit](https://swissgrc.com/en/internal-audit-software) [Risk management](https://swissgrc.com/en/risk-management-software/)

Advantages and added value

## More effectiveness, less year end pressure

Comprehensive and simple at the same time. That is what drives adoption and lifts maturity.

#### Process, risk and control connected

Every control hangs on the process step and on the risk. The connection can be queried, not reconstructed.

#### Continuous operation instead of a year end run

Controls are distributed and confirmed automatically. Effectiveness builds up across the year.

#### Audit ready at any time

Evidence is produced during execution. The auditor finds what they need without weeks of chasing.

#### Part of a connected GRC system

The ICS shares one foundation with risk management, ISMS, BCM, compliance and internal audit.

#### Control owners involved day to day

Workflows and reminders bring the control to the responsible person, without chasing by email.

#### Higher maturity through standards

Built on COSO: one consistent, automated approach across every process and unit.

Contact and demo

## See our ICS solution in action

In a personal demo we walk you through the SwissGRC® Platform and show how processes, risks, controls and evidence work together.

[Request Demo](https://swissgrc.com/en/demo) [Contact Sales](https://swissgrc.com/en/sales)

## Frequently asked questions

### Was ist eine ICS-Software?

Eine ICS-Software unterstützt das interne Kontrollsystem. Bei Swiss GRC werden Kontrollen verteilt, durchgeführt, nachgewiesen, bewertet, getestet und im Reporting ausgewertet.

### Was verlangt Art. 728a OR vom internen Kontrollsystem?

Bei der ordentlichen Revision prüft die Revisionsstelle, ob ein IKS existiert (Art. 728a Abs. 1 Ziff. 3 OR, PS 890). Laut Swiss GRC verkürzt der Nachweis der Wirksamkeit darüber hinaus die Prüfung und liefert Steuerungsinformationen.

### Wie unterstützt die SwissGRC Platform die Durchführung von Kontrollen?

Die Plattform verteilt fällige Kontrollen automatisch mit Benachrichtigung und Link zur Aufgabe. Jede Aufgabe hat Fälligkeit, Zuweisung und Status, Nachweise und Feststellungen werden daran angehängt.

### Wie werden Wirksamkeit und Angemessenheit von Kontrollen geprüft?

Kontrollen werden regelmässig auf Angemessenheit und Wirksamkeit beurteilt. Ein Dashboard zeigt die Ergebnisse nach Prozess und Organisationseinheit, Schlüsselkontrollen werden separat bewertet.

### Kann die ICS-Lösung mit anderen GRC-Themen kombiniert werden?

Ja. Das ICS teilt eine gemeinsame Basis mit Risikomanagement, ISMS, BCM, Compliance und Interner Revision.