Risk Control Self Assessment [RCSA] – Sound Practice Guidance – March 2010 – The aim of an operational risk framework is to identify, assess, control and mitigate operational risk and to champion effective reporting of risk and emerging risk issues. RCSA forms an integral element of the overall operational risk framework, as it provides an excellent opportunity for a firm to integrate and co-ordinate its risk identification and risk management efforts and generally to improve the understanding, control and oversight of its operational risks. Title: Risk Control Self Assessment Date issued: 10 March 2010 Risk Control Self Assessment March 2010

Table of Contents
1. The Development of RCSA
1.1. Origins
1.2. Overview
1.3. Benefits / Value Add
2. Generic Characteristics of an RCSA Approach
2.1. Risks
2.2. Controls
2.3. Design and Operating Effectiveness
2.4. Verification of Control Assessments
2.5. Risk Assessment
3. RCSA Approaches and Techniques
3.1. Workshop Approach
3.1.1. Planning
3.1.2. Who Should Attend
3.1.3. Pros and Cons of Inviting Management
3.1.4. How Many Should Attend
3.1.5. Thematic Structure of Workshops
3.1.6. Terminology
3.1.7. Top Down and Bottom Up
3.1.8. How Many Sessions Should Be Run
3.1.9. How Long Should the Workshop Last
3.1.10. Ground Rules
3.1.10.1. Facilitation and Other Required Key Skills
3.1.11. Data Collection
3.2. Questionnaire Approach
3.2.1. Structuring the Questionnaire
3.2.2. Timing and Regularity
3.2.3. Effective Questions (Structure and Number)
3.2.4. Effective Responses (Style, Respondent and Hierarchical Sign-off)
3.3. Hybrid Approach
4. Effective Use of RCSA within a Fully Integrated Operational Risk Management Framework
4.1. RCSA and Internal Loss Data
4.2. RCSA and External Data
4.3. RCSA and Scenario Analysis
4.4. Keeping It Alive (post RCSA exercise)
4.5. Central Risk Repository
4.6. Action Plans
4.7. Reporting and Follow-up
4.8. Measurement of RCSA – Quantitative vs. Qualitative
4.9. RCSA and Internal Audit Engagement
5. Appendices
5.1. Specimen Templates
5.1.1. Workshop Record Example No 1
5.1.2. Workshop Record Example No 2
5.1.3. Heat Map Report
5.1.4. Example Questionnaire
5.1.5. Example RCSA End to End Process Evaluation Assessment

http://www.ior-institute.org/public/100310RiskControlSelfAssessment.pdf