How do I run an effective Risk and Control Self-Assessment (RCSA) that doesn't become a check-the-box exercise?

Question

AcadiFi · Accepted Answer

An RCSA is a structured process where business units identify risks, evaluate controls, and assess residual risk in their own operations. When done well, it empowers front-line risk ownership and surfaces blind spots invisible to centralized risk functions. When done poorly, it produces thousands of rows of generic risks rated 'low' with no action taken.

For Pinewood Trust Company, a high-value RCSA includes: (1) Facilitated workshops rather than questionnaire completion — an experienced facilitator draws out tacit risks. (2) Risk taxonomy alignment — risks are mapped to enterprise categories so RCSA outputs aggregate meaningfully. (3) Inherent and residual assessment — rate before and after controls to expose control effectiveness gaps. (4) Control testing — don't just assume controls work; sample-test key controls annually. (5) Action plans with owners and deadlines — every medium/high residual risk must have a remediation plan. (6) Periodic refresh — full RCSA annually, interim updates quarterly for changed risks.

Red flags that indicate check-the-box: every risk rated low, identical risks copy-pasted across units, no challenge from Line 2, no follow-through on actions, and stable ratings year-over-year despite business changes. Best-practice RCSAs evolve with the business, integrate with scenario analysis and KRI monitoring, and inform operational risk capital calculations. They also feed the audit plan — high-residual-risk areas identified in RCSA should receive audit attention in the following year. Integration with technology (GRC platforms) helps but doesn't substitute for engaged participation.

How do I run an effective Risk and Control Self-Assessment (RCSA) that doesn't become a check-the-box exercise?

Master Part II with our FRM Course

Related Questions

Practice Questions