display-middle-ads-here
RCSA – or Risk Control and Self-Assessment – has been around for a while now and is part of the accepted fabric of the risk function.
It’s a technique used almost universally since its introduction in 1987 – an innovation widely credited to Gulf Canada’s General Auditor at the time, Bruce McCuaig – and allows organizations including corporations, charities and government departments, to assess the effectiveness of their risk management and control processes.
But nearly 40 years on, technology and new thinking has reshaped the way we perceive, mitigate and manage risk.
Here we ask Penny Cagan, Senior Risk Adviser with PwC and a lecturer in Enterprise Risk Management at Columbia University in New York, to look at how the shifting sands of the risk landscape have impacted on the way we self-police our systems and processes.
How does the RCSA differ today from when you were first involved in it?
RCSA has migrated for the most part from a once a year exercise to a more real time program, that is based on defining triggers.
For the most part, most institutions have created their baseline RCSAs, which means they have gone through at least one cycle for each of their assessment units.
Many organizations have moved to a process based approach and made connections with the processes in their organizations, such as linking the RCSA processes to the customer journey and the identified critical processes in the organization.
This approach allows for an end to end view of how risks and controls flow through the system, where they are vulnerable, such as the handoff points, and if controls are in fact being executed in the right stage of the operation. When a process approach is appointed, it allows for end to end accountability across a process that might cross functions.
It also allows the RCSA program to align more completely with strategy and business processes.
What was the most effective design and implementation of the RCSA? What made it special?
Years ago, when I was hired to restructure a RCSA program in a global bank, I introduced the concept of top down workshops with senior management.
At the time, I sensed a disconnect between a RCSA program that had become mostly a testing and ‘check the box’ exercise with what senior management most cared about.
I kicked off the redesigned RCSA program with workshops held with each of the direct reports to the CEO and their teams, and simply asked them what concerned them most. I then sat with their risk and control executives and mapped out a more bottom up approach that incorporated their concerns.
After that, I made sure there were touchpoints with these executives – and they were not easy to get hold of! – along the way, as RCSA was being executed.
