Overview Module 3 / Session 2 | Conducting a Structured Risk and Control Self-Assessment (RCSA)

Welcome to Session 2

This session helps you convert process knowledge into structured operational-risk assessment. You will learn how to define scope, write strong risk statements, evaluate controls, and produce a practical RCSA output that management can use.

Learning objectives

1. Explain the purpose of risk and control self-assessment (RCSA) in operational risk management.
2. Define the scope, boundaries, and evidence requirements of an RCSA for a business area, process, or case scenario.
3. Identify key risks, existing controls, control gaps, and residual exposures within a structured RCSA template.
4. Apply practical rating logic to assess risk severity, control effectiveness, and priority actions.
5. Prepare a concise RCSA output that supports management discussion, issue ownership, and action tracking.

Core ideas for this session

• RCSA is a structured management tool, not just a spreadsheet exercise.
• A good RCSA combines risk statements, controls, evidence, ratings, ownership, and actions.
• Clear scope prevents workshops from drifting into unrelated topics.
• Control evaluation should test both design and actual operation.
• Residual-risk views should follow honest assessment of current controls.