Ordinary audit and ICS audit

Last updated: October 2026 · fastview ag, Suhr

Professionally responsible: Marco Zanetti and Reto Ackermann, fiduciaries and certified auditors, fastview ag

The ordinary audit requires an audit with reasonable assurance, a statement on the existence of the internal control system (ICS) and a comprehensive report to the board of directors. This page explains the differences from the limited statutory examination and describes how the audit software pruvia maps the ordinary audit.

When the ordinary audit applies

Required to have an ordinary audit are public companies and companies that exceed two of the three thresholds in two consecutive financial years: total assets CHF 20 million, revenue CHF 40 million, 250 full-time positions on annual average (Art. 727 para. 1 CO). Added to these are companies required to consolidate, voluntary opting-up and the demand of shareholders together representing at least 10 per cent of the capital.

Unlike in the limited statutory examination, the auditor examines on a risk basis with reasonable assurance whether the financial statements comply with the statutory provisions, the articles of association and the chosen financial reporting framework, whether the proposal on the appropriation of the balance sheet profit complies with the law and the articles of association, and whether an ICS exists (Art. 728a para. 1 CO). In addition to the summary report to the general meeting, it prepares a comprehensive report to the board of directors (Art. 728b CO).

Risk assessment

In the ordinary audit, you assess five assertions per audit area in pruvia: completeness, existence/occurrence, valuation/accuracy, rights and obligations, and presentation and disclosure. For each assertion you record inherent risk and control risk; the risk of material misstatement is the higher of the two levels. pruvia proposes the control risk from the ICS. Significant risks require assertion-level tests of detail; they raise the scope of the audit area to “increased”.

For each file you choose the audit approach: substantive, controls-based or combined. Under “Fraud” you document, in accordance with ISA-CH 240, the factors of the fraud triangle (incentive/pressure, opportunity, attitude/rationalisation) with ten standard factors and your own additions, the assessment of the presumption regarding revenue recognition, the team discussion and the three mandatory procedures on management override of controls. Identified risks go into the risk register as significant risks.

ICS: existence, design and operating effectiveness

The page “Internal control system (ICS)” guides you through the audit in three steps:

1. Existence check. Eight components: control environment/organisation, risk assessment by management, controls for purchasing/payables, sales/receivables, personnel/payroll, closing/accounting, IT controls/access protection, and monitoring/documentation. For each process you record the overall assessment, significant findings, impact on the audit strategy and recommendations to the supervisory body.
2. Control inventory and tests of operating effectiveness. For each control: nature (preventive, detective), type (manual, IT-dependent, automated), frequency, key control, assertions, responsible persons, IT system and risk. The test of design documents design and implementation with a walkthrough; the test of operating effectiveness documents the test with sample and type of evidence. Inquiry alone is not sufficient. Automated controls count as reliable only if the IT general controls are effective.
3. Overall assessment. “An ICS exists (individual deficiencies possible)”, “Confirmed with qualification” or “No ICS in place”. The conclusion flows into the comprehensive report.

A library with six standard processes and 19 model controls (purchasing, sales, personnel, closing, payments, IT general controls) makes it easier to build the inventory. You record the IT environment in accordance with ISA-CH 315 with systems, processes, audit relevance and service providers in case of outsourcing (ISA-CH 402). A risk-control matrix shows assertions, design, operating effectiveness and control risk per key control. In the following year you carry over components, descriptions, control structure and risks from the previous year; tests of operating effectiveness, evidence and the existence conclusion are gathered anew. From a process description, the AI suggests key controls that you adopt or discard; how this interacts with the other AI functions is shown in AI and automation in the audit.

Performance

The audit programme extends the 20 audit areas by 64 procedures of the ordinary audit, based on ISA-CH 240 to 580, including on external confirmations, related parties, opening balances in first-time audits and going concern. In the ordinary audit, all procedures are in scope. You adopt findings of the journal entry analysis as a suggestion into the procedure “Journal entry testing” (A/O02). For tests of controls and substantive procedures, attribute sampling and monetary unit sampling (MUS) with error projection are available.

Comprehensive report to the board of directors

The auditor’s report to the general meeting follows the wording of the EXPERTsuisse model collections in German, French, Italian and English. pruvia structures the comprehensive report to the board of directors into engagement and position, performance of the audit, result, findings on financial reporting, internal control system, independence and concluding remarks. pruvia fills the paragraphs from the file: materiality, audit approach, significant risks, ICS findings and recommendations, audit opinion, and corrected and uncorrected misstatements. You add your own text to each section; the report can be output as a Word file.

What the auditor decides

• Audit approach, classification of risks as significant and assessment of control risk;
• Selection of key controls, extent of testing and assessment of design and operating effectiveness;
• the conclusion on the existence of the ICS and the recommendations to the board of directors;
• Audit opinion and content of the comprehensive report.

Frequently asked questions

Is the ordinary audit available in pruvia?

Yes. The ordinary audit is included in pruvia: risk assessment per assertion, ICS existence and control testing, risk-control matrix in the audit programme and comprehensive report to the board of directors. You choose the type of audit per file.

What does the auditor examine in the ICS?

In the ordinary audit, it confirms whether an internal control system exists (Art. 728a para. 1 no. 3 CO). With a controls-based audit approach, tests of design and operating effectiveness of the key controls are added.

Which ICS areas does pruvia map?

Eight components from control environment to monitoring, a control inventory with tests of design and operating effectiveness, the IT environment with IT general controls, and a risk-control matrix.

What does the comprehensive report to the board of directors contain?

Engagement and position, performance, result, findings on financial reporting, internal control system, independence and concluding remarks. pruvia fills the paragraphs from the file; you add to them and approve.

Can I carry over the ICS from the previous year?

Yes, as long as the inventory is empty. Components, descriptions, control structure and risks are carried over; tests of operating effectiveness, evidence and the existence conclusion are gathered anew each year.

Try pruvia

The system tour shows pruvia with sample data, without registration. For questions about your audit firm, book an online demo.

Further Knowledge pages