RCSA (risk and control self-assessment)

What it is

A risk and control self-assessment (RCSA) is a structured review in which the people who run a process assess their own operational risks and controls. It usually happens once a year, and again when processes, systems or products change.

The steps are similar in most firms:

1. Map the process and list the risks, often using a risk taxonomy.
2. Rate the inherent risk, before controls, on likelihood and impact scales.
3. List the controls and rate their design and operating effectiveness.
4. Derive the residual risk, after controls, and compare it with the risk appetite.
5. Agree actions, owners and dates for any gap.

Basel Committee principles for operational risk list self-assessment as a core tool, alongside loss data, key risk indicators and scenario analysis.

Why it matters

The RCSA gives a forward-looking view of risk. Loss data shows what went wrong in the past, while the RCSA asks what could go wrong now. It also links risks to specific controls and owners, which helps target testing and investment. Weak or copied RCSAs are a common audit finding, so the second line challenges ratings and evidence.

Worked example

Illustrative numbers. A bank uses a 1 to 5 scale for likelihood and for impact, and multiplies them. Scores of 15 or more are high, 8 to 14 medium, below 8 low. The appetite for this process allows medium residual risk at most.

Risk: a client onboarding team activates accounts before sanctions screening is complete.

• Inherent rating: likelihood 4, impact 5, score 20, high.
• Control: the system blocks activation until screening is cleared. Testing shows it works, but staff can override it with no second check.
• Residual rating: likelihood 3, impact 5, score 15, high, above appetite.
• Action: remove the single-person override and add a weekly report of overrides. Expected residual score after the fix: likelihood 1, impact 5, score 5, low.

Who uses it

• Operational Risk Analysts run the RCSA cycle, facilitate workshops and challenge ratings.
• Internal Auditors use RCSA results to plan audits and compare them with their own findings.
• Compliance Officers contribute compliance risks and controls.
• Risk Advisory Consultants and Internal Audit Consultants design methods and scales.
• Cybersecurity GRC Consultants run similar assessments for technology and cyber risks.

Common confusions

• Self-assessment is no self-certification. The second line reviews ratings and asks for evidence.
• Inherent risk ignores controls, while residual risk includes them. Mixing the two hides weak controls.
• An RCSA differs from control testing. The RCSA rates effectiveness, and testing produces the evidence behind the rating.
• High residual risk is acceptable only if a person with the right authority formally accepts it.