Internal Control System (ICS)
The Internal Control System (ICS) of a company consists of systematically designed, technical and organizational regulations, measures and processes for monitoring and controlling essential process controls in the company. The internal control system serves to ensure compliance with guidelines, avoid errors and to avert damage that may be caused by the company's own personnel or third parties.
ICS in Financial Reporting
The necessity for implementing and maintaining an ICS results from various legal requirements, e.g. from the German Stock Corporation Act or the German Commercial Code. An adequate ICS can be derived from existing standards, such as IDW PS 982 and IDW PS 951. Furthermore, control frameworks such as COSO or COBIT are often used as the basis for an ICS.
In financial reporting, and in particular in management reporting, numerous standards refer to internal control systems. These can vary from country to country. The best known are the requirements of the Sarbanes Oxley Act (SOX). Different regulations apply depending on the country:
- USA: SEC regulations
- Germany: IDW Auditing Standards
- Switzerland: including provisions of stock corporation law
The components of IDW PS 982 form the basis for a holistic ICS:
Your challenges in the area of ICS
Our services in the area of the Internal Control System are particularly relevant for you in the following situations:
-
Rapid company growth and high dynamics, resulting in increasing risks and growing relevance of systematic controls
-
Internal requirements for an appropriate ICS, e.g. deficits in reporting, fraud cases, etc.
-
Increasing pressure from stakeholders to establish adequate internal control systems
-
Change of legal form, e.g. to an AG, or of shareholder structure (entry of private equity investors, IPO)
-
Listing in the U.S. or purchase of your company by an SEC-listed company in the U.S.
-
Lack of overview of controls in the area of ICS, SOX and compliance and their adequacy and effectiveness
-
Known deficiencies in the adequacy and effectiveness of implemented controls or measures
-
Lack of segregation of duties to avoid conflicts of interest
- Outdated documentation of processes and controls
Approaches for implementing an Internal Control System
Our services in the area of Internal Control System incl. SOX comprise in particular:
- Analysis of your existing internal control system with regard to the various components such as control environment, organization, processes and controls
- Design and implementation of optimization measures in your internal control system and in relation to processes, individual controls or SOX controls or documentation requirements
- Review of the adequacy and effectiveness (monitoring) of your internal control system
- Setting up reporting to management and supervisory bodies
- Support in selecting software and assisting with the implementation of tools for documenting and testing the internal controls
Solutions to the challenges of existing control processes - control testing
We also support you in the area of control testing with additional resources and our expert know-how:
- Analysis/recording of existing controls in your structures, processes and systems
- Adequacy and effectiveness testing of your controls through testing activities
- Identification of control weaknesses, definition of mitigation measures and follow-up of effective implementation
- Reporting to the management and supervisory bodies on the adequacy and effectiveness of your controls and measures
Solution approaches for the challenges in the context of IT General Controls
Effective IT general controls (ITGC) are a fundamental prerequisite for all IT-based and all pure IT processes. Even though ITGC generally only indirectly influence the financial reporting, they occupy a central position and are becoming increasingly relevant for the audit of financial statements. They are responsible for the technically correct implementation and availability of the applications and (partially) automated controls relevant to the ICS. Conversely, this means that improperly functioning IT controls have a comprehensive impact on all related systems and thus also on the financial reporting based on them.
ITGC basically concern the areas of procurement, development, maintenance of systems, access protection and operations. ITGC can be found in the context of:
- Operating systems
- Applications
- Databases
- Networks
Our range of services includes the following areas:
- Analysis of the existing ITGC and derivation of any necessary adjustments
- Design and implementation of ITGCs in cooperation with your IT department and your IT service provider (keyword SOC reports or ISAE 3402 reports)
- Coordination of audit activities with the auditors and implementation of mitigation measures in the event of findings by the auditors
- Setting up monitoring concepts and reporting to ensure appropriateness and effectiveness
Approaches to the challenges of ensuring segregation of duties
In organizations, segregation of duties (SoD) refers to the organizational separation of organizational units or positions or duties in the business process to avoid potential conflicts of interest. The 4-eyes-principle is probably the best-known principle of segregation of duties. It is intended to prevent important decisions from being made by or critical activities being performed by a single person.
Your challenges when separating duties in the company
Our services in the area of segregation of duties are particularly relevant for you in the following situations:
- Lack of overview and/or documentation of existing structures, processes and systems with regard to appropriate segregation of duties
- Known violations of the principle of segregation of duties
- Identified or known deficiencies in authorization concepts
Support for the introduction of separation of duties
Our services in the area of segregation of duties include in particular:
- Analysis, recording and documentation of structures, processes and systems with relevance for the separation of duties
- Development, alignment and implementation of optimization potentials in the area of separation duties
- Analysis and documentation of the situation as well as the facts in cases of violations of the principle of segregation of duties that have become known and identification of the possible consequences and counter measures
Your contact to us
Do you have any questions about our services or WTS Advisory? We look forward to your message or your call!
