The Future of RCSA: From Static Assessments to AI-Driven Insights

RCSA – or Risk Control and Self-Assessment – has been a staple of risk management since 1987. Initially introduced by Gulf Canada’s General Auditor, Bruce McCuaig, it is now a universal tool for assessing risk management and control processes. However, evolving technology and new methodologies have significantly reshaped its application. Penny Cagan, Senior Risk Adviser at PwC and lecturer at Columbia University, shares her insights on the evolution of RCSA and its future.

How does the RCSA differ today from when you were first involved in it?
RCSA has evolved from an annual exercise to a real-time program based on defined triggers. Most institutions have established baseline RCSAs, completing at least one cycle for each assessment unit. Many have shifted to a process-based approach, linking RCSA processes to customer journeys and critical organizational processes. This provides an end-to-end view of risks and controls, highlights vulnerabilities, and ensures controls are executed at the right stages. A process approach fosters accountability across functions and aligns RCSA with strategy and business processes.

What was the most effective design and implementation of the RCSA? What made it special?
In a global bank, I restructured the RCSA program by initiating top-down workshops with senior management. The aim was to address a disconnect between a checkbox-focused RCSA program and senior management’s priorities. Workshops identified their main concerns, which I integrated into a bottom-up approach with risk and control executives. Maintaining touchpoints with senior executives ensured alignment and relevance. The dialog shifted from technical jargon to addressing their specific concerns. Ultimately, the most effective RCSA integrates with operational risk frameworks, such as New Business Assessments, Third Party Assessments, governance, and metrics.