An internal control system (ICS) makes visible in an SME which important processes are safeguarded and whether the planned controls actually take place. A signature or a green tick is not enough. It needs a clear object of inspection, a responsible person and traceable evidence. This guide separates the legal classification of the ordinary audit from organisational recommendations for daily work. It does not describe a generally prescribed catalogue of controls.
What the law says about the ICS
The Code of Obligations (CO, OR) mentions the internal control system in connection with the auditor. It does not describe in detail what such a system must look like. The provisions in detail:
- Art. 728a CO, para. 1, point 3: In an ordinary audit, the auditor checks whether an internal control system exists. The law expressly names the existence of the ICS here; how the auditor checks this is laid down by the auditing standards of the profession. Findings on the ICS belong in the report to the board of directors (Art. 728b CO, para. 1).
- Art. 728a CO, para. 2: The auditor takes the ICS into account when carrying out the audit and when determining its scope.
- Art. 728a CO, para. 3: The management of the board of directors is not subject to audit by the auditor.
- Art. 728b CO, para. 1: The auditor submits a comprehensive report to the board of directors with findings on accounting, the internal control system and the performance and result of the audit.
Art. 727 CO governs who must be audited ordinarily. Under para. 1 these are, first, publicly traded companies; second, companies that exceed two of the following figures in two consecutive financial years; and third, companies required to prepare consolidated accounts. The figures are total assets of CHF 20 million, sales revenue of CHF 40 million and 250 full-time positions on annual average. Under para. 2 an ordinary audit must also take place if shareholders representing together at least 10 per cent of the share capital request it. Under para. 3 the articles of association or the general meeting may provide for an ordinary audit where the law does not require one. For the auditor of a limited liability company (GmbH), the provisions of stock corporation law apply by analogy under Art. 818 CO, para. 1.
| Type of audit | When | ICS within the audit scope |
|---|---|---|
| Ordinary audit | Cases of Art. 727 CO | Yes: existence under Art. 728a CO, para. 1, point 3 |
| Limited audit | If the conditions for an ordinary audit are not met (Art. 727a CO, para. 1) | Not mentioned in Art. 729a CO, para. 1 |
| No audit (opt-out) | With the consent of all shareholders and no more than ten full-time positions on annual average (Art. 727a CO, para. 2) | No audit by an auditor |
Irrespective of the type of audit, Art. 716a CO, para. 1, point 3 assigns to the board of directors, as a non-transferable task, the structuring of accounting, financial control and financial planning, where necessary for managing the company. In a GmbH a corresponding task falls to the managing directors under Art. 810 CO, para. 2, point 3. The law does not expressly equate “financial control” with the ICS under Art. 728a. The provision does show, however, that the design of control lies with top management.
For your company, clarify the specific audit obligation with your fiduciary or auditor; the guide to working with fiduciaries explains who remains responsible for what. In particular, Art. 728a does not mean that every small company must build the same volume of documented controls. Suitable controls can nevertheless make organisational sense. The recommendations that follow are practice, not statutory requirements.
From risk to a suitable control
Start with one essential process and one concrete way it can go wrong. When changed payment details are recorded, for example, an unauthorised or wrongly copied bank account could be used. The control should address exactly this risk. “Check finances” would be too broad as a control objective.
Describe who compares which information against which independent basis. A control that merely compares two copies of the same unchecked entry adds little assurance. The quality of the basis of comparison is decisive, not the number of documents involved.
Set the frequency to suit the process. A control at every change of master data has a different purpose from a periodic overview of all changes. The two can complement each other. A monthly date is not automatically appropriate, though, if the decisive step takes place immediately after a change.
Link the control to the risk described. In a risk register you can trace the starting situation, existing safeguards and the reassessment. This makes it possible to explain later why a control was introduced or adjusted.
Performing controls and keeping evidence
An executable control description answers the questions of object, comparison, scope and response. Record whether all transactions or a deliberately selected sample are examined. For a sample, its delimitation is part of the description. Otherwise nobody can judge how meaningful the result is.
The result should be able to distinguish between OK, deficiency and not applicable. “Not applicable” needs a reason, for example because no such transaction occurred in the period. A control that was not carried out must not disappear under the same label.
Evidence includes date, person performing the control, basis examined and result. A reference to the list examined may be enough if it can still be clearly found later. Avoid uncontrolled copies of confidential data where a regulated reference supports the evidence equally well. How long business records must be retained is explained in the guide to bookkeeping obligations.
Also determine the deputy arrangements and the handling of exceptions. If the person carrying out the control was involved in a transaction, a traceable alternative is needed. A segregation of duties that makes sense in principle helps little if holidays or sick leave regularly cancel it out in daily work.
Practical example: Muster Handel AG
Muster Handel AG is a fictitious company. It wants to better safeguard changes to supplier accounts. The example illustrates an organisational procedure and says nothing about whether the company is subject to an ordinary audit.
In the month under review, ten bank account details were changed. The company has agreed internally to check each change against an independently confirmed basis before it is used for a payment. The person carrying out the control should not be the person who recorded the change.
In the monthly overview the finance manager finds complete evidence for eight changes. For one change the confirmation of the basis of comparison is missing, and for another the documented independent check.
| Result of the monthly overview | Number | Share |
|---|---|---|
| Evidence complete | 8 | 80 % |
| Confirmation of basis of comparison missing | 1 | 10 % |
| Independent check not documented | 1 | 10 % |
| Total | 10 | 100 % |
Two of ten pieces of evidence are therefore incomplete, that is twenty per cent. This rate describes documented control performance, not a proven fraud rate.
The two cases are investigated individually. Until clarified, the intended safeguard counts as not demonstrated. A check carried out later is documented with its actual date. It must not give the impression that the original control was carried out on time.
The root cause analysis shows unclear deputy arrangements. The company adjusts the allocation of tasks and checks the next comparable changes specifically. Only when the new rule takes hold in daily work does it rate the action as effective. Ten completed check items alone would not show this connection.
Handling deficiencies and improving controls
A deficiency that has been found needs an appropriate response. First clarify the immediate impact and secure open transactions. Then determine the cause and the improvement needed. For in-depth handling, a corrective action process separates implementation from checking the effect.
Also examine the control itself. Was it described clearly? Was the basis of comparison available? Was the responsible person able, in terms of expertise and time, to carry it out? A reminder does not solve a missing permission or an impractical check instruction.
Repeated results without deficiency are also a reason to reflect. Perhaps the process works well. Perhaps, though, the control is too superficial or does not look at the relevant transactions. If needed, draw on individual records to test how meaningful the performance is.
Introducing a small ICS
Start with a few important processes and understandable controls. Draw up the description together with the people who will later perform the checks. Have a realistic transaction played through and see whether ambiguities or missing information arise.
Then agree a joint review of the first results. Decide which control is kept, adjusted or replaced. Each change should show why it achieves the control objective better. A few suitable check points are often more valuable than a long list with no visible link to risk.
For management, an overview of due, performed and deficient controls is helpful. These categories must not be mixed. A control carried out on time can uncover a significant deficiency and thus fulfil its purpose. A missed control remains open, even if by chance no damage is known. At year-end it is worth looking at the controls that play a role there; the year-end checklist lists the typical steps.
Checklist
- The audit question (Art. 727 CO) is clarified separately from practical design.
- Each control has a concrete risk and objective.
- Basis of comparison and scope of checking are understandable.
- Frequency and timing suit the transaction.
- Responsibility and deputy arrangements are settled.
- Result and actual date of performance remain traceable.
- “Not applicable” and “not carried out” are justified.
- Deficiencies receive actions with their own follow-up.
- Missing performance does not count as a positive result.
How KMU | base helps
In QMS | base you open the controls in the menu under “Operations and records”, at “Internal controls (ICS)”. You create one with “New control”.
ICS controls with frequency. You define controls with objective, link to risk and process, responsible person, frequency from daily to yearly, and check items. This lets you manage the planned control cycle in a structured way. A link to an entry from “Risks and opportunities” is possible. Whether the control is professionally suitable, you decide on the basis of your business process.
Carry out a control. You answer the check items; a deficiency creates an action if you wish, and the next due date is calculated. The action is created if the option “Create an action if a deficiency is found” is set for the control. A check item marked “not applicable” does not count as a deficiency; in the portal the form requires a remark for it. A control that was not carried out is recorded with a reason. Record a result only after the actual check and describe the basis specifically enough.
Due ICS controls. The responsible person receives a notification on the due date. The reminder confirms neither that the control was carried out nor the effectiveness of the control system. It helps to make the agreed task visible in good time.
What the software does not check: whether the person carrying out the control is someone other than the person who recorded the transaction. You regulate this segregation of duties organisationally.
The guide to QMS | base explains how to use it. Take a look at the demo, open a trial account or get in touch via the contact page.
Sources
- Code of Obligations (OR, SR 220), Art. 727, paras. 1–3, Art. 727a, paras. 1 and 2, Art. 728a, paras. 1–3, Art. 728b, para. 1, Art. 729a, para. 1, Art. 716a, para. 1, point 3, Art. 810, para. 2, point 3 and Art. 818, para. 1, as at 1 October 2026: fedlex.admin.ch (German original), accessed on 27.10.2026.
The organisational procedures and examples are editorial practical aids and not statutory requirements.
This guide does not replace legal or tax advice. Information as at 27 October 2026.