The Art of Making Risk and Control Self-Assessments Meaningful

Risk and Control Self-Assessments (RCSAs) are too frequently regarded as a compliance exercise, yet they have the potential to be much more. 

According to the Head of Operational Risk at an international bank, RCSAs should be dynamic, purposeful, and fundamentally linked to both strategic direction and governance.

Opening the discussion at a recent conference, the speaker recounted a personal story involving a near-miss carbon monoxide incident at home - where a detector had been installed but was positioned incorrectly, leading to an undetected emission which could have been fatal. 

The control was present, but ineffective. That is a lesson for business as well: controls only matter if they are effective and regularly tested, the expert noted.

“A control that exists only on paper is not enough; it must be proven in practice,” the expert stated, stressing that the frequency of testing should be in line with the criticality of the risk. 

Annual attestations by risk and control owners can further establish accountability within the business.

Successful RCSAs, the speaker emphasised, rest on three pillars: people, methodology, and tools. 

Without senior support, clear accountability, and suitable tools, any framework is likely to fail. It is essential to have people with adequate skills and knowledge to execute meaningful assessments.

The speaker noted that annual assessments may not be sufficient in today’s rapidly evolving risk environment. RCSAs must be dynamic and updated as the control landscape changes. 

They must be integrated into business decision-making processes and remain timely and relevant.