RCSA
RCSA is the annual or periodic risk assessment, run as a workflow rather than a spreadsheet. Each company in the group keeps its own risk register, on the group’s one criteria set.
Risk register
Section titled “Risk register”Each company in the group keeps its own register. A risk carries its category, owner, cause, controls, treatment and status.
Scoring
Section titled “Scoring”- Likelihood and multi-dimension impact — financial, regulatory, operational, reputational and any dimension the group defines — against a criteria set owned by the group.
- Computed by the system: scores, tiers and rating bands are never typed by the user.
- Inherent and residual risk: control effectiveness is assessed and residual risk derived.
- Criteria coverage check: before submission the system shows which risks have not been scored on which dimension.
Heat map
Section titled “Heat map”A matrix by entity or across the group, on the residual layer, with drill-down to the risk.
Submission workflow
Section titled “Submission workflow”- The Risk Champion drafts and submits; the Reviewer or Head of Risk validates; the RMC approves.
- Every transition is stamped with who, when and a snapshot of what was approved.
- A return carries a reason.
Reporting periods and cycles
Section titled “Reporting periods and cycles”Open a year, track which entities have submitted, and carry risks forward to the next cycle.
Control testing
Section titled “Control testing”Record test plans, results and findings against each control. Findings flow to the action register with an owner and a due date.