Risk management outsourcing and internal control system

What does risk management outsourcing cover?

Risk management is the second half of the second line of defence. Peak Compliance runs it so that risks are identified early and managed effectively:

• Risk analysis: assessment of market, credit, liquidity and operational risks as well as legal and reputational risks
• Risk management strategy: principles of risk management and risk tolerance, aligned with your business model and size
• Risk and control matrix: drafting and maintenance, linking every control to a risk and an owner
• Second-line controls: performed according to the control plan, with follow-up of measures
• Digital ICS and follow-up management: processes and controls in a fully digital internal control system
• Effectiveness review: ongoing analysis of how risks, controls, policies and reporting interact, so that the control system keeps improving
• Reporting: periodic risk reports to executive management and the board, including the annual risk assessment
• Deputy cover: continuity of all risk management processes during absences

The approach follows the "three lines of defence" model: front-office business is the first line, risk management and compliance the second, and independent audit the third.

How does the engagement work?

1. 1

   Review of the control environment

   Peak Compliance assesses your current risk and control framework with you and defines objectives.
2. 2

   Strategy and objectives

   Peak Compliance develops a risk management strategy that matches your requirements.
3. 3

   Proposal and agreement

   you receive a proposal with scope and a monthly fixed price; the agreement can be accepted online.
4. 4

   Implementation

   Peak Compliance sets up processes, controls and the digital ICS, on site or remotely.
5. 5

   Monitoring and reporting

   ongoing risk monitoring and regular reports for transparency and steering.
6. ✓

   Continuous improvement

   processes are adapted to market conditions and new legal requirements.

Online ICS: digital, traceable, FinIA-ready

An effective internal control system is a licensing requirement and an ongoing duty for portfolio managers and managers of collective assets (Art. 9 FinIA; Art. 26 and 41 FinIO). For larger companies, Art. 728a CO also requires the auditors to confirm that an ICS exists. Peak Compliance runs its clients' ICS in the online ICS, a web-based solution from a Swiss provider. Everything is kept in one place – structured, dated and audit-ready at any time.

What the online ICS covers

• Risk inventory and risk assessment: legal, operational, money laundering, IT and outsourcing risks with likelihood, impact and risk tolerance
• Control plan: every key control with objective, frequency, owner and expected evidence, derived from the risks
• Controls with evidence: results and supporting documents are recorded and filed directly with each control
• Measures and open items: findings from controls, audits and incidents with owners and deadlines until they are closed
• Audit points: findings of the audit firm are recorded and tracked until closure
• Incidents and continuity: operational incidents recorded and analysed, business continuity management kept up to date
• Information security: inventory of IT assets, threats and vulnerabilities as the basis for cyber risks
• Reporting: periodic report to management and the board with control status, open measures and risk profile

Your benefits

• The board and management always have an overview of risks, controls and open items – the basis for overall direction.
• The audit firm and the supervisory organisation find complete, dated evidence in one place; audits become faster and more predictable.
• Day-to-day work runs with clear responsibilities and deadlines.
• Full relief for your team: Peak Compliance sets up and maintains the online ICS, performs the second-line controls and keeps the documentation audit-ready.

Legal basis

• Art. 9 FinIA: a financial institution identifies, measures, manages and monitors its risks, including legal and reputational risks, and ensures effective internal controls.
• Art. 21 FinIA: portfolio managers must have adequate risk management and effective internal control; these tasks may be delegated to a qualified external body (para. 2); those performing them may not be involved in the activities they monitor (para. 3).
• Art. 14 FinIA: delegation to qualified third parties who are carefully selected, instructed and monitored.
• Art. 26 FinIO: principles of risk management and risk tolerance; para. 2 sets out when smaller portfolio managers may organise without functional separation from revenue-generating activities.
• Art. 41 FinIO: managers of collective assets maintain an effective internal control system; risk management and compliance are separated functionally and hierarchically from operating units.

English versions of Swiss federal law are provided for information only; the German, French and Italian texts are authoritative.

Roles and scope

• Peak Compliance: takes over risk management and internal control as the entire second line – with analysis, controls and reports.
• Institution: the board and executive management set the risk tolerance and steer the business on the basis of clear reports, focusing on investment decisions and clients.
• Internal audit and audit firm: form the third line. Peak Compliance prepares the documentation and attends the closing meeting with the audit firm.
• Supervision: portfolio managers are supervised on an ongoing basis by a supervisory organisation (SO); managers of collective assets directly by FINMA.

Risk management works best together with compliance outsourcing. Applicants for a licence will find support under FINMA and FMA licensing; for Liechtenstein see compliance outsourcing Liechtenstein.

Why Peak Compliance

• Focus on portfolio managers, managers of collective assets and family offices in Switzerland and Liechtenstein
• Supervisory experience: mandates with portfolio managers supervised by FINMA and the FMA, cooperation with the supervisory organisations AOOS and OSFINcontrol, experience with licensing procedures before FINMA and the FMA
• Digital ICS as an integral part of the service
• Team: Peak Compliance AG was founded in Zurich in 2024 by Isabelle Ledergerber and Reto Picenoni (About us)
• Insights on IT risks for managers of collective assets, model risk of AI in portfolio management and actively managed certificates

Discuss your risk management with Peak Compliance: book a free initial consultation via the contact page.

Responsible

Isabelle Ledergerber

Managing Partner, Co-Founder · LinkedIn profile