How to Conduct a Risk Control Self-Assessment (RCSA)

Risk Control Self-Assessment (RCSA) Guide

What is RCSA?

RCSA is a process through which key risks and their controls are identified, assessed, and managed by business units with oversight from risk management.

Benefits of RCSA

• Increases risk awareness at operational level
• Identifies control gaps and redundancies
• Promotes accountability for risk management
• Provides bottom-up risk intelligence

RCSA Process Steps

1. Planning & Preparation

• Define scope (business unit, process, or function)
• Identify key stakeholders and participants
• Gather existing documentation (process maps, policies)
• Schedule workshops (2-3 hours typical)

2. Risk Identification

• Brainstorm potential risks using categories:
  • Strategic, Operational, Financial, Compliance, Technology
• Use prompts: "What could go wrong?"
• Document risk statements clearly

3. Control Identification

• Map existing controls to identified risks
• Distinguish control types:
  • Preventive vs. Detective
  • Manual vs. Automated

4. Assessment

Risk Assessment (Inherent):

• Likelihood (1-5 scale)
• Impact (1-5 scale)
• Calculate inherent risk score

Control Effectiveness:

• Design effectiveness (0-100%)
• Operating effectiveness (0-100%)

Residual Risk:

• Inherent risk × (1 - control effectiveness)

5. Action Planning

• Identify gaps where residual risk exceeds appetite
• Define remediation actions with owners and dates
• Prioritize based on risk severity

6. Reporting & Monitoring

• Aggregate results for management reporting
• Track action completion
• Schedule periodic refresh (typically annual)

Workshop Facilitation Tips

• Use independent facilitator
• Encourage open discussion
• Challenge "we've always done it this way"
• Document dissenting views
• Focus on practical outcomes