DE
FRYour control is described.
But is it effective?
Reduce risk, improve processes.
Run, evidence and assess your controls continuously. Existence and effectiveness evidenced.
- Controls distributed automatically, with due date and reminder
- Evidence is produced during execution, not afterwards
- Effectiveness evidenced, audit ready at any time
Trusted by leading organizations
From an annual scramble
to continuous control operation
Processes, risks and controls are documented in most organizations. What sets them apart is whether the controls actually run day to day.
An ICS that wakes up for the season
The risk control matrix lives in Excel and evidence arrives by email. Shortly before the audit, everything is tested at once.
- Control matrix in Excel, evidence by email
- Control owners do not know what is due when
- Testing happens just before the audit, all at once
- Findings are recorded but not followed through
An ICS that keeps working all year
Controls are distributed, confirmed and evidenced automatically. Effectiveness builds up over the year, not in December.
- Controls distributed automatically, with due date and reminder
- Evidence attached directly to the control execution
- Control tests and assessments spread across the year
- Findings with action, owner and due date
Your entire ICS,
in one place
Model, link, execute, assess, test and report. Click through the six views.
Processes, risks and controls in one picture
Management, core and support processes modelled, with roles in swim lanes. Risks and controls sit right on the process step.
- Process hierarchy from management to support processes
- Risks marked on the process step, not in a side list
- PDF export, approval and version held on the process
Every risk with its control
The matrix brings process, risk and control together, with owner, frequency and relevance. Control design and effectiveness visible in one column.
- Grouped by process, key controls flagged
- Control frequency from daily to event driven
- Adequacy and effectiveness at a glance
The control reaches the right person
The platform distributes due controls to their owners automatically and reminds them of deadlines. Execution is confirmed and evidenced.
- Automatic notification with a link to the task
- Task with due date, assignment and status
- Evidence and findings attached to the task
Adequate and effective, assessed
Controls are assessed regularly for adequacy and effectiveness. The dashboard shows where it breaks down, by process and organizational unit.
- Controls evaluated by process and effectiveness
- Filter by organizational unit, category and process
- Key controls assessed separately
Effectiveness tested, deficiencies documented
Walkthrough, design test and overall rating structured per control. Findings and recommendations emerge during the test, not afterwards.
- Test questionnaire ordered by area and control
- Walkthrough, design test and overall rating documented
- Findings and recommendations captured directly
Control results for the right audience
Execution status, adequacy and effectiveness in one dashboard. One picture that both management and the statutory auditor can rely on.
- Execution status by open, in progress and completed
- Adequacy and effectiveness per period
- ICS report and risk control matrix as ready analyses
Existence is mandatory.
Effectiveness pays off.
In a statutory audit the auditor verifies that an ICS exists (Art. 728a para. 1 no. 3 Swiss CO, PS 890). Evidencing effectiveness beyond that shortens the audit and produces information you can steer with.
More effectiveness,
less year end pressure
Comprehensive and simple at the same time. That is what drives adoption and lifts maturity.
Process, risk and control connected
Every control hangs on the process step and on the risk. The connection can be queried, not reconstructed.
Continuous operation instead of a year end run
Controls are distributed and confirmed automatically. Effectiveness builds up across the year.
Audit ready at any time
Evidence is produced during execution. The auditor finds what they need without weeks of chasing.
Part of a connected GRC system
The ICS shares one foundation with risk management, ISMS, BCM, compliance and internal audit.
Control owners involved day to day
Workflows and reminders bring the control to the responsible person, without chasing by email.
Higher maturity through standards
Built on COSO: one consistent, automated approach across every process and unit.
See our ICS solution
in action
In a personal demo we walk you through the SwissGRC® Platform and show how processes, risks, controls and evidence work together.
