conducting-risk-control-self-assessments

# Conducting Risk Control Self Assessments

## When To Use

- Facilitating periodic (annual, semi-annual, quarterly) RCSA cycles for business units or functions
- Evaluating whether existing controls adequately mitigate identified risks after an organizational change, new product launch, or regulatory shift
- Onboarding a new business line or process into the enterprise risk framework
- Responding to audit findings, regulatory examination results, or incident post-mortems that require control reassessment
- Identifying emerging risks (e.g., market concentration, model risk, cyber exposure) not yet captured in the risk register

## Inputs To Gather

- **Risk taxonomy and universe**: Current enterprise risk taxonomy, including risk categories (credit, market, operational, compliance, strategic, reputational) and sub-categories
- **Existing risk register**: Prior RCSA results, residual risk ratings, and open action items
- **Control inventory**: Documented controls mapped to risks, including control type (preventive, detective, corrective), frequency, and owner
- **Loss event and incident data**: Internal loss history, near-miss reports, and external loss benchmarks relevant to the business unit
- **Key Risk Indicators (KRIs)**: Current KRI thresholds, breach history, and trend data
- **Organizational context**: Business unit org chart, process maps, materiality thresholds, and risk appetite statements [VERIFY: confirm risk appetite statement is current and board-approved]
- **Regulatory requirements**: Applicable regulatory expectations for RCSA (e.g., OCC Heightened Standards, Basel III operational risk, SOX 404) [VERIFY: jurisdiction-specific requirements]

## Workflow

1. **Define scope and methodology**
   - Confirm which business units, processes, or risk categories are in scope
   - Select assessment approach: top-down (risk-based) vs. bottom-up (process-based) vs. hybrid
   - Set the risk rating scale (e.g., 5×5 likelihood/impact matrix) and ensure it aligns with enterprise standards
   - Identify RCSA participants: process owners, control owners, first-line managers, second-line risk officers

2. **Conduct risk identification**
   - Facilitate workshops or structured interviews with process owners to identify risks per process step
   - Map each risk to the enterprise risk taxonomy category
   - Capture inherent risk ratings (likelihood × impact before controls) using the agreed scale
   - Flag risks not currently in the risk register as emerging or newly identified
   - Cross-reference against loss event data and external risk intelligence for completeness

3. **Evaluate controls**
   - For each identified risk, document the key controls that mitigate it
   - Assess control design effectiveness: Does the control address the root cause? Is it preventive or detective? Is frequency adequate?
   - Assess control operating effectiveness: Is the control consistently executed? What is the evidence (logs, sign-offs, reconciliations)?
   - Rate each control as Effective, Needs Improvement, or Ineffective
   - Calculate residual risk rating (inherent risk adjusted for control effectiveness)
   - Identify control gaps—risks with no mapped control or with ineffective controls

4. **Develop action plans**
   - For residual risks exceeding appetite, draft remediation actions with specific owners, target dates, and measurable milestones
   - Classify actions: accept (with documented rationale and approval authority), mitigate (new or enhanced control), transfer (insurance, hedging), or avoid (exit activity)
   - Link action items to KRIs so progress can be monitored between RCSA cycles
   - Escalate risks requiring risk acceptance above business-unit authority to the appropriate risk committee [VERIFY: escalation thresholds per risk appetite framework]

5. **Compile and report**
   - Produce the RCSA summary report: risk heat map, top residual risks, control gap analysis, and action plan tracker
   - Prepare executive dashboard for risk committee or board presentation
   - Update the enterprise risk register with new/changed risk entries and residual ratings
   - Archive supporting evidence (workshop notes, interview records, control testing samples)

## Output

- **RCSA risk register update**: Each risk with inherent rating, mapped controls, control effectiveness rating, residual rating, and risk owner
- **Control gap analysis**: Table of risks with absent, inadequate, or ineffective controls, ranked by residual risk severity
- **Risk heat map**: Visual 5×5 matrix plotting residual risks by likelihood and impact, color-coded to appetite thresholds
- **Action plan tracker**: Remediation items with owners, deadlines, status, and linked KRIs
- **Executive summary**: One-page narrative highlighting material risk movements, new/emerging risks, overdue actions, and escalation items

## Quality Checks

- Every risk in scope has at least one mapped control; any unmapped risk is explicitly flagged as a control gap
- Residual risk ratings are mathematically consistent with inherent ratings and control effectiveness scores
- No action plan is assigned without a named owner and a target completion date
- Risk ratings use the enterprise-standard scale—no ad hoc or inconsistent scales across business units
- Loss event data and KRI trends are reconciled against RCSA findings (material disconnects are investigated)
- [VERIFY] Regulatory-specific RCSA requirements are addressed (OCC Heightened Standards, COSO framework alignment, Basel operational risk standards as applicable)
- All risks rated above appetite have either a remediation plan or a documented risk acceptance approved at the required authority level
- Workshop participation is documented to demonstrate first-line ownership and accountability