In-depth guide · Governance
The internal control system (ICS) in a family office
Updated: · Leutrim Miftaraj, FLIORE · Editorial standards · Other languages: Deutsch · Français · Español
Short answer
An internal control system (ICS) ensures that payments are properly approved, holdings reconciled, valuations checked and access restricted – and that this can be evidenced. It consists of control objectives, a risk-control matrix, documented key controls and regular testing. For a family office it must be appropriate: lean, but complete for the material risks.
Why an ICS even in a small family office
Family offices manage large fortunes with small teams. A few people can trigger payments, change master data and produce reports – exactly the constellation in which errors and abuse go unnoticed. An ICS protects family and team alike: it prevents errors, detects them and shows that work was done properly. In Switzerland, the statutory auditor checks in an ordinary audit whether an ICS exists (Art. 728a Code of Obligations); with a limited audit or an opting-out it remains a matter of good management.
The building blocks under COSO
- Control environment: management's attitude, clear roles, the four-eyes principle as culture.
- Risk assessment: which errors or abuses would have material consequences?
- Control activities: concrete controls that prevent or detect these risks.
- Information and communication: everyone knows their controls and reports deviations.
- Monitoring: regular tests of whether the controls work, and improvement.
Risk-control matrix (example)
| Risk | Control | Frequency | Evidence |
|---|---|---|---|
| Erroneous or fraudulent payment | Entry and approval by different people, limits | Every payment | Approval log |
| Changed bank details of a payee | Call-back to a known number, separate approval of master data | Every change | Note with date and person |
| Wrong holdings in the report | Reconciliation of accounts and portfolios with bank statements | Monthly | Reconciliation record |
| Outdated or embellished valuation | Independent review, valuation date visible | Quarterly | Valuation evidence |
| Unauthorised access | Role-based rights, review, two-factor sign-in | Every six months | Rights review report |
| Missed deadline | Central calendar with responsible persons | Ongoing | Completion note |
| Unreviewed business relationship | Approval after KYC, periodic review | Ongoing | KYC file, audit trail |
Building it in steps
- Identify processes with material risks: payments, master data, valuation, reporting, access, compliance.
- Describe and assess the risks of each process.
- Define key controls: who, what, when, with what evidence.
- Build controls into processes and systems rather than separate checklists.
- Test once a year whether the controls work; remedy and document deficiencies.
- Report the results to management and the responsible governing body.
Appropriateness rather than bureaucracy
An ICS is not good because it has many controls, but because it covers the material risks and is actually lived. A family office with four employees does not need a hundred controls, but it does need complete payment approval, a monthly bank reconciliation, an access rights concept and a deadline calendar. Where segregation of duties is not possible because of size, compensating controls help, such as a subsequent review by management or an external mandate.
Worked example (simplified)
In one family office, an experienced bookkeeper used to enter and approve payments alone; management saw a list every month. After a risk assessment, approval becomes two-stage: payments over CHF 10,000 need a second person, and changes to bank details are confirmed by telephone using a known number and approved by another person. The first annual test reveals a gap: standing orders had not been covered. They are added to the control, and the deficiency is documented and remedied.
Typical control weaknesses
Certain weaknesses appear again and again in family offices. The most common is combining master data maintenance and payment approval in one pair of hands: anyone who can change payee data and approve payments needs no accomplices. Equally widespread are bank mandates of former employees, reconciliations that are carried out but not documented, and valuations prepared and checked by the same person.
In small teams, controls also lapse during holidays because there is no deputy. And controls are often not adapted to change: a new bank, a new account or a new payment channel – such as credit cards or crypto assets – arises outside the existing controls. An annual review of which processes, accounts and access rights have been added closes this gap.
In FLIORE
FLIORE builds central controls into the processes: approvals under the four-eyes principle, role-based rights with enforceable two-factor sign-in, controls with due dates in the compliance calendar and a complete audit trail as evidence.
At a glance
| Framework | COSO Internal Control – Integrated Framework |
|---|---|
| Switzerland | In an ordinary audit, the auditor checks that an ICS exists (Art. 728a CO) |
| Core controls | Payment approval, master data, bank reconciliation, valuation, access, deadlines |
Terms on this page
- Four-eyes principle
- Control principle under which important transactions, such as payments, are checked and approved by a second authorised person.
- Audit trail
- An unalterable log that records who created, changed, approved or deleted which data and when.
Frequently asked questions
Is an ICS mandatory for a family office?
In Switzerland it is directly required in particular in the context of an ordinary audit. For supervised financial intermediaries, requirements arise from supervisory law. For everyone else it is an expression of careful management.
How many controls are needed?
As many as necessary to cover the material risks. In small family offices, ten to twenty key controls are often enough.
What if the team is too small for segregation of duties?
Use compensating controls: a subsequent review by management, limits, confirmations from the bank or external support with approvals.
How is an ICS tested?
With samples per control: was it performed, on time, by the right person, with evidence? Results and deficiencies are documented.
Who is responsible for the ICS?
The head of the family office or the company's supreme management body. Implementation can be delegated to the CFO or compliance.
How does the ICS relate to the access rights concept?
The access rights concept is part of the ICS: it governs who may do what. The ICS also covers reconciliations, approvals, valuations and their monitoring.
How can controls be documented without much effort?
By building them into the systems: approvals, reconciliations and rights reviews then automatically leave evidence with date and person. Separate checklists, by contrast, are often forgotten.
Who tests the ICS?
In small family offices often management or an external specialist, in larger ones an internal audit function. What matters is that the tester does not perform the control themselves.
Sources
- Swiss Code of Obligations (OR, SR 220) – Fedlex
- COSO – Internal Control – Integrated Framework
- EXPERTsuisse – Swiss auditing standards
- Institut der Wirtschaftsprüfer (IDW) – German institute of public auditors
- ISO/IEC 27001 – information security management systems
This page provides orientation and does not replace legal or tax advice. The cited legal sources in their applicable version are authoritative.
Read more
More on Operations, security & technology
FLIORE in your family office
See structures, compliance and consolidated wealth with your own questions – in a personal demo.