Risk and control self-assessment · RiskAtoms Academy

By the end you will be able to

1Run the steps of a risk and control self-assessment (RCSA).
2Rate inherent and residual risk, and show how controls move a risk from one to the other.
3Judge a control on its design and on its operation, from evidence.
4Explain the weaknesses of self-assessment and how challenge corrects them.

Why it matters

Larkfield's payments team rates its outage risk medium: there is a backup data centre, and payments switch over automatically. Then someone asks when the switch-over was last tested. It was tested in March. It failed.

Core explanation

Rate the risk, then rate what holds it back

A risk and control self-assessment (RCSA) is how a firm fills in the ratings and controls in its register (L2.4.04: Risk registers). Each business area, usually once a year and after any big change, sits down with the risk function and works through its risks. It is the main tool for operational risk (L2.2.05: Operational risk), though the same method works for conduct and compliance risks.

The seven steps of an RCSA

Scope the area and gather evidence: losses, incidents, indicators, audit findings.
List the risks: last year's register plus anything new.
Rate each one's inherent risk, as if no controls existed.
Name the key controls and assess each one's design and operation.
Rate the residual risk, giving credit only to controls that work.
Compare with risk appetite; agree actions, owners and dates.
The risk function challenges; the owner signs off; the register is updated.

Two questions for every control. First, its design: if it ran exactly as intended, would it deal with the risk? A second signature that never looks at the payee's details is a design gap. Second, its operation: does it actually run, every time? A good control that is skipped on busy days is an operating failure. Only a control test can answer the second question; a description in a policy cannot.

Sort itWhat do the test results say?

Larkfield's control testers report on five controls. Rate each one.

Second approval of payments over €100,000: 25 of 25 sampled payments had both approvals, with the payee checked.
The fraud model scores every card and app payment, but not payments made through the new business banking channel.
The daily reconciliation of payments sent against accounts debited was skipped on 6 of the last 20 days.
The failover to the second data centre stopped after 40 minutes in its March test.
Software changes are approved by a manager who never sees the test results.

Why “self” is both the strength and the weakness. The people who run a process know it best, so they find risks no outsider would. But they are also grading their own work. Ratings drift towards “effective” and “medium”, and an RCSA done the same way every year becomes a box to tick. The cure is challenge: the risk function compares the ratings with hard evidence and asks awkward questions. Guess the challenge before you open each card.

The second line challenges

The formal version

Many firms rate residual risk by judgement. Larkfield uses a simple model to make that judgement consistent. A preventive control with effectiveness $e_P$ removes that share of the chance; a corrective control with effectiveness $e_C$ removes that share of the loss:

p_{\text{res}} = p_{\text{inh}} \times (1 - e_P), \qquad L_{\text{res}} = L_{\text{inh}} \times (1 - e_C)

The expected loss (L2.4.03: Assessing risks: likelihood and impact) then follows, one line at a time:

\begin{aligned} E[\text{loss}]_{\text{res}} &= p_{\text{res}} \times L_{\text{res}} \\ &= p_{\text{inh}}(1 - e_P) \times L_{\text{inh}}(1 - e_C) \\ &= E[\text{loss}]_{\text{inh}} \times (1 - e_P)(1 - e_C) \end{aligned}

Derived on a few lines: it extends the expected loss you already know. The model is a teaching simplification. Real controls overlap, and their effectiveness is an informed estimate, not a measured fact. A control that fails its test gets $e = 0$ until it passes again.

Try it

Here is Larkfield's payments platform outage (R1). At the owner's settings it lands on its register rating. Then tick the failed test and watch the residual risk move.

Try itFrom inherent to residual: payments platform outage

Inherent: a 60% chance a year of an outage costing €20.0m. Set how much each control takes away.

Preventive: release testing and change approval (cuts the chance)50%

Corrective: failover to a second data centre (cuts the loss)60%

The failover test in March failed after 40 minutes.Well designed, but not shown to work: operating effectiveness is in doubt, so it gets no credit.

Residual chance a year30%

Residual loss if it happens€8.0m

Expected loss: inherent → residual€12.0m → €2.4m

Expected loss removed by controls80%

Rating16 High → 9 Medium

Likelihood →

5

10

15

20

25

4

8

12

16

20

3

6

9

12

15

2

4

6

8

10

1

2

3

4

5

1 Minor2 Moderate3 Major4 Severe5 Critical

Impact →

Open circle: inherent. Filled: residual.

Low: score 1 to 4Medium: 5 to 10High: 12 to 25

Worked example

Larkfield's payments RCSA

Each April, Larkfield's payments operations team runs its RCSA with an operational risk partner from the risk function. Here is how R1 went this year. Decide each rating before you open the step.

R1 in the payments RCSA

Step 1 of 5

1
Gather the evidence
Two minor outages last year, one failed software change rolled back, and the March failover test, which stopped after 40 minutes. No open audit findings.

Regulatory lens

The Basel Committee's Principles for the Sound Management of Operational Risk (2011, revised 2021) name risk and control self-assessments among the main tools banks use to identify and assess operational risk, alongside loss data, scenario analysis and indicators. Supervisors look for evidence that the ratings are challenged and backed by control testing, not just signed.

Under the old advanced measurement approach, RCSA results could feed a bank's capital model as “business environment and internal control factors”. The Basel III reforms of 2017 replaced those models with a standardised approach, so today the RCSA is a management tool rather than a capital input. See Level 4: Regulation, Capital & Accounting.

Sparks

SparkBorn in an oil company

Control self-assessment did not start in a bank. It is usually traced to Gulf Canada Resources in 1987, where internal auditors ran workshops in which staff assessed their own controls. Banks adopted the idea in the 1990s and added the risk side, giving the RCSA.

SparkA legal cousin

Since the Sarbanes-Oxley Act of 2002, management of US-listed companies must assess their internal control over financial reporting every year, and the external auditor reports on it (section 404). It is the same idea as an RCSA, applied to the accounts, with the force of law behind it.

Key takeaways

An RCSA is the business rating its own risks and controls, with the risk function facilitating and challenging.
Inherent risk is the risk with no controls; residual risk is what is left with the controls that work today.
Judge each control on design (would it work?) and operation (does it run?); only tests answer the second.
A control that fails its test gets no credit until it passes again, even if it is well designed.
Self-assessment drifts towards optimism; evidence and second-line challenge keep it honest.

Reaction

Check what stuck

Glossary

RCSA: Risk and control self-assessment: a regular exercise in which a business area rates its own risks and controls, challenged by the risk function.
Inherent risk: How big a risk is before any controls.
Residual risk: How big a risk is after the controls that work today.
Design effectiveness: Whether a control, run exactly as intended, would deal with the risk it is meant to.
Operating effectiveness: Whether a control actually runs as intended, every time, as shown by evidence.
Control effectiveness: Here: the share of a risk's chance or loss that a control removes, from 0% to 100%.
Control test: Checking a sample of a control's past runs, or rerunning it, to see whether it worked.
Challenge: The risk function questioning the business's own ratings and asking for evidence.

Deep Dives & Origins

Deep Dives

Chapelle, A., Operational Risk Management: Best Practices in the Financial Services Industry, Wiley, 2019, chapters on RCSA and control testing. Intermediate.
Committee of Sponsoring Organizations of the Treadway Commission (COSO), Internal Control: Integrated Framework, 2013. Intermediate.

Origins

Basel Committee on Banking Supervision, Principles for the Sound Management of Operational Risk, BIS, June 2011.
Basel Committee on Banking Supervision, Revisions to the Principles for the Sound Management of Operational Risk, BIS, March 2021.
Basel Committee on Banking Supervision, Basel III: Finalising post-crisis reforms, BIS, December 2017.
Sarbanes-Oxley Act of 2002, section 404 (management assessment of internal controls).

Watch this lesson

Video version

Prefer to watch? The same lesson as a 10-minute video will sit here, made from this page's script.