Why is an internal control system (ICS) needed?
The obligation to introduce an ICS is not an invention of FinIA (Financial Institutions Act), which came into force in January 2020. The Swiss Code of Obligations has for some time required larger Swiss companies to implement an ICS as a risk management tool (Art. 728a). The CISA (now the FinIA) also explicitly prescribed the requirement of an effective ICS for asset managers of collective assets. With the FinIA, this obligation is now extended to all prudentially supervised financial service providers (regardless of size and business model).

In addition to this regulatory requirement (without an effective ICS, the FINMA licence will not be granted), it should not be forgotten that with the ICS, the management and board of directors have a valuable tool at their disposal to systematically identify risks in their company and to counter them in a timely and effective manner through control activities.