Why Spreadsheets Won’t Save Your Risk Strategy

The following article is an abridged version of an article written by Naresh Singhani, Director of Internal Audit Analytics at First Citizen Bank for the January 2025 edition of Connect Magazine

For decades, Risk Control Self-Assessment (RCSA) has been a cornerstone for identifying and assessing risks and evaluating control effectiveness. Amidst cybersecurity threats, regulatory changes, and process evolution, are firms optimally using the latest technology to enhance RCSA processes?

RCSA is vital for identifying strategic, operational, financial, or compliance risks and assessing their likelihood and impact. Legal Entities (LEs) and Business Units (BUs) must perform RCSA periodically, yet stakeholders often find it tedious due to outdated tools like Excel. Upgrading to AI-driven tools with advanced GUIs can make RCSA more efficient and engaging.

Efficient documentation of assessment inputs and proper action plans are critical. Tools like Tableau and Alteryx enhance reporting and charting but often face data silos and restricted access issues. Overcoming these challenges with better data integration and transparency is essential.

RCSA’s periodic nature can lead to stakeholder fatigue, but Enterprise Risk Management (ERM) can address this by leveraging Robotic Process Automation (RPA) and AI. Real-time triggers and AI-based inputs can revolutionize the RCSA process, enabling proactive mitigation of risks and higher efficiency.