How a Scandal Sparked a Risk Management Transformation

My journey with Risk and Control Self-Assessment (RCSA) began in 1996 when I was tasked with creating and leading JP Morgan’s Information Technology Risk Management function. Just a week into the role, I attended a critical meeting prompted by JP Morgan’s involvement in the Sumitomo copper trading scandal, which revealed massive gaps in internal controls.

The directive was clear: implement an RCSA for every process across the organization. Armed with a simple template and a one-year deadline, my team and I embarked on the daunting task of educating staff, conducting over 200 sessions globally, and ensuring completion ahead of schedule. However, what began as a compliance exercise quickly evolved into a transformative initiative.

A New Approach to RCSA

Recognizing the potential to improve the process, we reimagined the methodology. Rather than asking teams to identify risks and controls themselves, we designed templates that required them to evaluate the state of their controls. We enlisted experts from various functions—disaster recovery, information security, HR, and audit—to define key risks and expected controls.

In the second year, we launched a system called Horizon, which simplified data capture and visualization for management. By incorporating algorithms to assess risk and control effectiveness, we provided a more realistic measurement of material risks. Horizon was a game-changer, quickly adopted across JP Morgan, and eventually commercialized in partnership with E&Y, reaching major banks, regulators, and government entities.

From Compliance to Strategic Value

Over time, RCSA matured into a strategic tool for risk management. By integrating loss event data and audit modules, we created a robust system for validating assessments. Moving beyond basic traffic light indicators, we shifted to exposure-based analysis, which provided actionable insights into potential losses and weak controls.