Risk and Control Self Assessment process is a widely accepted methodology used by banks, financial companies, insurance companies and others to identify and assess the operational risk. Even though it’s popular, only few firms have been able to get the benefit of the same, as the process is cumbersome.
The Risk Control Self Assessment process helps the firm to
1. Identify and assess the risk
The RCSA program helps to understand the risks across multiple business lines. As the same is a periodic activity new risks can get added to the list and old risks would be completely mitigated and hence removed from the list. The risks teams, post identifying the risks, carry out the risk assessment part based on the likelihood and impact scale.
2. Set controls and monitor their effectiveness
Once the risks are identified and assessed the next step is to implement the right controls based on the severity of the risk. During the RCSA program, control testing is also carried out to check their effectiveness. During this process, new controls will be introduced, replacing the old ones due to their ineffectiveness.
3. Quantification of residual risk
Inherent risk is the natural risk level in a process and residual risk is the level of risk after applying the controls. Risk managers are primarily interested in high residual risk items as these are risks which can impact the firm and require close monitoring.
Despite RCSA being a widely accepted process, firms use this methodology as a check box items because of the exhaustive manual process. Operational risk managers are required to have complete clarity of the process and should be able to guide and direct the stakeholders.
As a best practice, the firm is required to carry out the following steps:
a) Risk & Control Library
A library of all risks and controls to be maintained depending on the nature of business and a methodology to continuously review the same
b) Risk & Control Model
Depending upon the likelihood and impact, a risk model is to be defined and similarly, based on design and control effectiveness, the control models are to be defined. This helps in computing your Inherent risk and residual risk numbers.
c) Mapping of Risk and Control
For each department or business line the risks to be mapped. This will help you to estimate the inherent risk. In case there is a high inherent risk, risk teams need to apply the right controls. The unattended or open risk i.e. risk after applying the controls are the residual risk and the risk teams have clear idea on the status of the same across multiple business lines.
d) RCSA Automation
Firms should set up a policy to carry out an RCSA at least twice in a year. A standardised checklist of the risks and controls assessment to be created and shared across to the stakeholders for their input. Depending on the periodicity this should go as a task to the stakeholders with constant reminders. Responses should go through a workflow to seek approvals of the senior line function.
e) Action Plan
During the RCSA program, if control weaknesses and deficiencies are identified, firms should look at implementing an action or remediation plan. An action plan is a plan which can be quickly implemented without any major challenges – typically less than a week. However, a remediation plan is something which is a long-drawn process. A remediation will have a series of steps, involving multiple departments and could range anywhere from weeks to months. All action and remediation plans are to be allocated to responsible officials and tracked closely.
Interested to implement an effective Risk and Control Self Assessment process in your organization? Talk to our expert here.
