Risk and Control Self-Assessment (RCSA)

The people closest to a process usually know best where it can go wrong. In an RCSA, each business unit lists its main risks, scores likelihood and impact, rates the controls in place, and arrives at a residual risk figure. Methods include workshops, questionnaires and facilitated discussion. The risk function sets the template and rating scales, challenges the results and reports them upwards, while the unit owns the answers. Gaps lead to action plans with owners and dates. It is run on a cycle, often yearly, or after major changes. A known weakness is optimism, since teams may mark their own controls too kindly, so results are checked against loss data, indicators and audit findings. It is a main route by which operational risk gets identified and owned by the business rather than left to the risk function.

A bank's trade finance team holds a half-day RCSA workshop. They list fifteen risks, including forged documents, and rate the document check as partly effective. Risk management compares this with three recent loss events and raises the rating. The team agrees to add a second review for high-value cases.