display-middle-ads-here
For decades, top firms across the globe have been performing Risk Control Self-Assessment (RCSA) across their firm to identify and assess risks, and to evaluate the effectiveness of their controls.
With a constant barrage of cybersecurity threats, competitive threats to their moat, frequent process changes, and an evolving regulatory landscape are firms using the latest technology most optimally to conduct their RCSA?
Experiencing the maturity process of RCSA and technology throughout my career, and having my boots on the ground assisting them, my perspective would be that firms can derive major advantages leveraging the current and most advanced technology available to them at their discretion for streamlining their RCSAs.
The importance of RCSA for any sized firm cannot be understated in identifying potential risks, whether they are strategic, operational, financial, or compliance related.
The likelihood and impact of risks assessed using qualitative or quantitative methods can quickly highlight their weak and strong areas.
Each Legal Entity (LE) or Business Unit (BU) within the firm should be mandated to perform their RCSA periodically. However, the fact of the matter is that most risk management stakeholders and respective BU experts detest conducting the RCSA, especially occasionally.
Perhaps we can lay the blame on the usage of time-consuming and archaic tools with a poor graphical user interface (GUI). It wouldn’t be a far stretch for some to still use Excel to do their RCSAs. Making RCSA fun and taking out the drudgery of conducting them with the advent of the latest available technologies and tools, along with a smart AI-driven GUI, should be the ideal goal.
An additional technical hurdle faced is how efficiently and timely are the results documented after assessment inputs are completed. Proper action plans to address any control gaps or weaknesses along with advanced reporting and charting tools are crucial to their success.
Many sophisticated tools do exist for charting (e.g., Tableau) and building sophisticated reports by assembling them with simpler data collection tools with no programming skills (e.g., Alteryx).
However, the challenge that developers of such graphs and reports face is that many times the data they have access to, or are allowed to collect and report on, is on a silo basis. Quite often we see that second line (i.e., Risk Areas) struggling to have complete unfettered access to data across different regions, risk areas, and dimensions.
Furthermore, even the third line (i.e., Internal Audit) surprisingly faces such challenges even during the process of auditing a specific business area. The payroll department, for example, even with certain key fields masked is hesitant to share their information.
RCSA process as we know isn’t a one-time exercise and stakeholders responsible for inputs sometimes wish it was, or that it simply not be part of their task list.
The Enterprise Risk Management (ERM) department plays an important role in managing RCSA as it’s an integral success factor to the organization’s risk strategy. This allows senior executives to take appropriate action proactively when some process, control, or risk event has a high probability of failure.
Given that we could leverage the latest technologies and tools, one may reconsider the human resources allocated to inputting RCSA. Utilizing Robotic Process Automation (RPA) tools along with AI inferencing logic, dynamic inputs of such content will produce meaningful results in a real-time fashion.
Reimagining the whole activity of evaluating existing processes and controls within the RCSA framework, rapidly identifying weak controls, and mitigating identified risks with near real-time triggers is a possibility.
By leveraging the latest AI-driven technology, forward-looking firms can catapult to the next level of competitiveness. In such an environment, the people and process efficiencies with measured and manageable risks can bring about higher revenue generation capabilities with minimal operational risk events and operational losses.
First and foremost, ERM has to overcome the data collection challenges. Multiple software vendors and in-house systems with different architecture and data models across different risks such as Credit, Market, Liquidity, Operational Risk, etc. create a constant problem of data feeds and/or data quality (DQ) errors.
Correcting data feeds and/or DQ errors at source often becomes a time-consuming process. Identifying and correcting DQ errors on target does not reflect an accurate picture of the relationship between source and target systems.
So, critical reporting periods, such as the end of the quarter, make accurate reporting a difficult endeavor. Building timely exception reports and triggering notifications does help, but when data feeds are involved Murphy’s Law holds at the most inopportune time.
