Audit · Last reviewed August 8, 2026
Internal control system (ICS): what the auditor means by it
Anyone reading an auditor's or tax advisor's report on the EWKFondsG will almost always come across the term internal control system (ICS) — without it being clear what exactly is meant. In short: the ICS answers the question of how reliable the processes are that a producer uses to determine and document its leviable quantities. And that answer directly determines how extensive the audit will be.
Why the ICS determines the scope of the audit
The UBA audit guidelines for the EWKFondsG (as of Oct 13, 2025) require the auditor to first assess the design and operating effectiveness of the ICS. The result determines the further approach:
ICS missing or inadequate
Under the guidelines, the auditor must "significantly expand the audit procedures, which may lead to a full audit" — in doubt, of every single product.
ICS demonstrably effective
The auditor can rely on a sample-based examination (audit field B.2.2), the scope of which depends on the size of the product range — not on a complete individual review.
What an ICS specifically covers in the EWKFondsG context
According to the guidelines, this includes: a traceable process for maintaining product master data, clear responsibilities including deputisation rules, adequately trained staff, and — for IT-supported bulk determination — involvement of the relevant department in developing and maintaining the software used. A commonly cited weak point: spreadsheets that link sales volumes to master data frequently produce errors through incorrect references or accidental overwrites, according to the guidelines.
What EWKPilot covers of this — and what it doesn't
EWKPilot covers the data-side core of an ICS: every change to a quantity report is logged tamper-evidently via a database trigger, the audit assistant automatically checks completeness before every export (master data, receipts, data sheets), and the audit binder makes this audit trail traceable for the auditor. What EWKPilot does not replace: organizational elements such as deputisation rules, training records, or job descriptions for the responsible staff — these remain the producer's responsibility regardless of the tool used.
Frequently asked questions
Do I need to have an ICS as a producer?
Yes, implicitly. The UBA audit guidelines for the EWKFondsG (as of Oct 13, 2025) require the auditor to assess the design and operating effectiveness of the ICS when determining leviable quantities — without a robust ICS, the auditor has no choice but a full audit. No specific form or certification is prescribed for it.
Is a spreadsheet enough as an ICS?
In principle yes, if it offers a traceable change history, clear responsibilities, and a documented process for maintaining master data. In practice, that's exactly the weak point: according to the guidelines, spreadsheets frequently produce errors through incorrect references or accidental overwrites — the auditor must take that into account when assessing operating effectiveness.
Does EWKPilot cover the ICS completely?
The data-side core, yes: tamper-evident audit trail via database trigger, completeness check before every export, traceable master data maintenance. Organizational elements such as deputisation rules, training, or job descriptions for the responsible staff remain the producer's responsibility — the guidelines require these regardless of the tool used.
What happens without a functioning ICS?
Under the guidelines, the auditor is required to significantly expand the audit procedures — in doubt, up to a full audit of every single product. The scope of the audit thus grows directly with the number of products, instead of being limited to a sample.
Sources · last reviewed August 8, 2026
This page summarizes the basic legal rules and doesn't replace a legal case-by-case review. EWKPilot does not replace legal or tax advice.