Risk and control self-assessment
RCSAAlso called control self-assessment, CSA
A risk and control self-assessment is a structured review in which business units identify their operational risks, rate the controls that address them and record gaps. It is a core first-line tool in operational risk management. Results feed the risk register, action plans and reporting to senior management and the board.
How it works
Each business unit runs workshops or questionnaires, usually once a year. It lists the risks in its processes, scores inherent risk, rates control design and effectiveness, and arrives at a residual rating. The second line challenges the scores. Weak controls lead to actions with owners and deadlines, tracked to completion.
The Basel Committee's principles for the sound management of operational risk, revised in March 2021, set expectations for how banks identify and assess operational risk. Supervisors review RCSA output when judging a bank's risk framework. A well-run RCSA links to loss events, key risk indicators and control testing, so ratings reflect evidence.
The rules
Sets the Basel Committee's principles for how banks govern, identify, assess, monitor and control operational risk.
Banks under Basel Committee standardsCommon questions
Who carries out an RCSA?
The first line of defence, the business units that own the risks, carries it out. The second line, typically operational risk, designs the method and challenges the results. Internal audit may review the process as part of its independent assurance.
How often do firms run an RCSA?
Most firms run a full cycle once a year, with updates after material events such as a new product, a system change or a significant loss. Some firms move to continuous assessment linked to key risk indicators.
What is the difference between inherent and residual risk?
Inherent risk is the exposure before controls. Residual risk is what remains after controls are considered. An RCSA rates both, and the gap between them shows how much the firm relies on its controls.
What is the main weakness of RCSAs?
Self-assessment can be subjective, and business units may rate their own controls too generously. Firms address this through second-line challenge, control testing and comparison with loss data and indicators.
