What it is about
Supervisory organisations and audit firms increasingly look at whether directives are applied in practice and supported by a functioning internal control system (ICS). For an independent portfolio manager, the ICS is the tool that makes compliance visible: it shows which risks exist, which controls address them, who performs them and what the results were. This article explains the legal basis, the building blocks and a set of example controls. How Peak Compliance runs the ICS for its clients is described at the end of this article.
What applies
- Organisation: a financial institution identifies, measures, controls and monitors its risks, including legal and reputational risks, and organises effective internal controls (Art. 9 para. 2 FinIA).
- Risk management and internal control: portfolio managers have an appropriately defined risk management system and an effective internal control structure that ensures, among other things, compliance with legal and internal provisions (Art. 21 para. 1 FinIA).
- Independence: the persons performing these tasks are separate from the activities they supervise (Art. 21 para. 3 FinIA).
- Principles and risk tolerance: portfolio managers set out guidelines for risk management and define their risk tolerance (Art. 26 para. 1 FinIO).
- Proportionality: smaller firms with a business model without high risks may combine risk management and internal control with revenue-generating activities (Art. 26 para. 2 FinIO).
- Delegation: the tasks may be delegated to a qualified external entity (Art. 21 para. 2 FinIA); delegated tasks remain open to inspection by the audit firm, the supervisory organisation and FINMA (Art. 17 para. 4 FinIO).
The framework for licensing and supervision is set out in our FinIA knowledge hub.
The building blocks of an ICS
| Building block | Content |
|---|---|
| Risk inventory | legal, operational, money laundering, sanctions, IT and outsourcing risks, each with likelihood, impact and risk tolerance |
| Control plan | key controls derived from the risks, each with objective, frequency, owner and expected evidence |
| Control execution | results and evidence recorded with each control, dated and traceable |
| Open items | findings from controls, audits and incidents with owner and deadline until closure |
| Reporting | periodic report to executive management and the board on control status, open items and risk profile |
Example controls for portfolio managers
| Area | Example control | Basis |
|---|---|---|
| Anti-money laundering | risk-based periodic review of client records completed on schedule | Art. 7 para. 1bis AMLA |
| Anti-money laundering | annual decision of executive management on continuing relationships with foreign PEPs documented | Art. 19 AMLO-FINMA |
| Anti-money laundering | AML risk analysis approved and updated | Art. 25 para. 2 AMLO-FINMA |
| Sanctions | client base screened promptly after new sanctions list entries | FINMA expectations, see our article on sanctions and embargoes |
| FinSA | sample check of client segmentation, suitability and documentation | Arts. 4, 12 and 15 FinSA |
| Delegation | review of reports from service providers and exercise of control rights | Art. 17 FinIO |
| IT and data | access rights reviewed and backups tested | Art. 9 para. 2 FinIA |
| Governance | changes to licence-relevant facts notified to the supervisory organisation | Art. 22 FinIO |
The current audit focus on FinSA processes and the ICS is described in our article on the 2026 supervisory review.
Step by step to an audit-ready ICS
- 1Define the risk toleranceexecutive management and the board set the risk tolerance and the principles of risk management.
- 2Build the risk inventoryrecord the material risks of your business model and assess them.
- 3Derive the control planassign at least one key control with owner, frequency and evidence to every material risk.
- 4Choose the toolkeep risks, controls, evidence and open items in one place, ideally in a digital ICS.
- 5Run and document controlsperform controls on schedule and record results and evidence directly with each control.
- ✓Report and improvereport periodically to executive management and the board and adjust controls after audits, incidents and regulatory changes.
Checklist
- Risk management principles and risk tolerance adopted
- Risk inventory complete and assessed
- Control plan with owners, frequencies and evidence approved
- Independence of the control function ensured or proportionality documented
- Controls for AML, sanctions, FinSA, IT and delegated tasks in place
- Open items tracked with owners and deadlines
- Periodic ICS report to executive management and the board
- Audit findings recorded and followed up until closure
How Peak Compliance supports you
Peak Compliance sets up and runs the internal control system for portfolio managers and managers of collective assets in a digital online ICS, performs the second-line controls and reports to executive management and the board – as part of risk management outsourcing together with compliance. For a first conversation, reach us via the contact page.
