Risk and Control Self-Assessment (RCSA)

The people who run a process usually understand its risks better than anyone else. They know where errors tend to happen, which steps are skipped when work gets busy and which controls are more form than substance. A risk and control self-assessment puts that knowledge to work. Business teams, often guided by the risk function, review their own processes, identify the main risks, rate how well controls are working and agree actions where controls fall short. The results feed into the organization's wider view of risk, while building ownership of risk in the teams closest to it. It also gives the risk function a structured way to engage with every part of the business.

RCSA is most common in banking and insurance, where it is a standard tool in operational risk management and is expected by supervisors as part of a sound operational risk framework. It is also used in other sectors to support enterprise risk management, SOX programs and internal control reviews. The process is sometimes called control self-assessment or risk self-assessment. For risk, compliance and business teams, a well-run RCSA brings risk discussions into the business rather than leaving them to specialists.

Definition of Risk and Control Self-Assessment

A risk and control self-assessment is a structured process through which business units and process owners identify and assess the risks in their activities, evaluate the design and operating effectiveness of related controls, rate residual risk and agree action plans, with the results reviewed and challenged by an independent risk function.

RCSA is a core tool in operational risk management, reflects first line ownership in the three lines of defense and produces ratings of inherent and residual risk.

How an RCSA Works

Scoping selects the business unit, process or product to assess and gathers relevant information, such as process maps, past incidents, audit findings and key risk indicators.

Risk identification lists the main risks in the process, usually guided by a risk taxonomy so that risks are described consistently. Teams should consider recent changes, such as new systems or products, that may have created new risks.

Control evaluation identifies the controls for each risk and rates how well they are designed and how reliably they operate. Evidence such as test results and incident data should support each rating.

Risk rating assesses inherent and residual risk using the organization's standard scales.

Action planning agrees actions, owners and dates for risks above appetite or controls that are not effective. Actions should address root causes, not just symptoms.

Review and challenge by the risk function, and sometimes internal audit, checks that the ratings are realistic and supported by evidence.

Common RCSA Formats

Workshops bring the process team together with a facilitator to discuss risks and controls and agree ratings.

Questionnaires ask process owners to answer structured questions about risks and controls, which is efficient across many units but can be less thorough. Answers may be optimistic when there is no discussion or challenge.

Hybrid approaches use questionnaires for routine areas and workshops for high-risk processes.

Many organizations run RCSAs annually, with updates when processes, systems or risks change significantly.

Importance of RCSA in Risk and Compliance

RCSA builds ownership. Teams that assess their own risks are more likely to see risk management as part of their job. They are also more likely to follow through on actions they helped design.

It draws on front-line knowledge. Process teams often identify risks and control weaknesses that central functions and auditors would not see. Informal workarounds, staff shortages and system quirks often surface only in these conversations.

It also provides a consistent view. Using common scales and taxonomies across units allows results to be combined into an enterprise picture of operational risk.

RCSA and Financial Management

RCSA results show where control weaknesses could lead to losses, helping direct spending on control improvements.

Consistent ratings across units allow comparison of risk exposure, which can inform budgets and capital allocation for operational risk.

Running RCSAs takes significant time from business teams, so the scope and frequency should match the level of risk.

Linking RCSA results to actual losses and incidents over time shows whether assessments are accurate and where they need recalibrating.

Common Challenges

Self-assessments can be optimistic, with teams rating their own controls as effective without evidence. Requiring evidence for effective ratings helps keep results realistic.

RCSAs can become a yearly form-filling exercise that copies last year's answers. Starting each assessment with what has changed since the last one helps avoid this.

Inconsistent interpretation of ratings across units makes results hard to compare. Calibration sessions across units improve consistency.