Risk and Control Self-Assessment (RCSA)

Overview

A risk and control self-assessment is a structured process in which business and control owners identify risks, evaluate inherent and residual exposure, assess control design and operation, and agree remediation or acceptance actions.

Risk and Control Self-Assessment (RCSA) is closely connected to Governance, Risk and Compliance (GRC), Internal Audit, and Risk Matrix. It is a management self-assessment rather than independent assurance, so results should be challenged, supported by evidence, and connected to internal audit and compliance testing.

Operational implementation should define scope and taxonomy, involve process owners, use consistent scoring, identify control owners, require evidence, challenge optimistic ratings, record issues, aggregate themes, and refresh after incidents or material change.

The principal failure modes include box-ticking, unsupported effectiveness claims, inconsistent scoring, hidden issues, workshop dominance by senior staff, duplicate risks, and remediation that is not tracked to closure.

Useful measures include assessment completion, high residual risks, control failures, overdue actions, rating changes, and differences between self-assessment and independent testing.

Operationally, teams should define scope and taxonomy, involve process owners, use consistent scoring, and identify control owners. Key risks include box-ticking, unsupported effectiveness claims, inconsistent scoring, and hidden issues.

For Risk and Control Self-Assessment (RCSA), the assessment should evaluate evaluation of inherent and residual exposure, assess control design and operation, and agree remediation or acceptance actions. The assessment record should separate observed evidence supporting evaluation of inherent and residual exposure, assess control design and operation, and agree remediation or acceptance actions from assumptions, state the time horizon and existing controls, and identify who owns any remaining exposure. Monitoring should test whether the conditions described in evaluation of inherent and residual exposure, assess control design and operation, and agree remediation or acceptance actions have changed enough to require a new rating, treatment, or approval.