Skip to content
Docs

Submission and sign-off

An RCSA filing is prepared by the Risk Champion, reviewed by the Reviewer and approved by the Approver, all inside the entity that owns it. Either reviewer can return it with a reason. Approval records a snapshot of exactly what was approved.

Who may do it: Risk Champion (prepare and submit) · Reviewer (review, return) · Approver (approve, return) · Entity Risk Manager (reopen). Every act is limited to the entity where the role is granted. See Roles and permissions.

RCSA submission and sign-offThe Risk Champion prepares and submits, and the filing locks. The Reviewer reviews and the Approver approves; either can return it with a reason. Approval records a snapshot. Only the entity's own Entity Risk Manager reopens an approved filing. Every step stamps who and when.LOCKED AFTER SUBMISSIONREOPEN · THE ENTITY'S OWN ENTITY RISK MANAGERSUBMITRETURN WITH REASONRETURN WITH REASONRisk Championprepares · coverage checkReviewerreviews · may returnApproverapproves · may returnApprovedsnapshot of what was approvedEVERY STEP STAMPS WHO · WHEN · NOBODY REVIEWS OR APPROVES THEIR OWN FILINGLEGENDStepApprovalSnapshotReturnReopen
Prepare → review → approve inside the entity. The filing locks on submission; a return carries a reason; only the entity's own Entity Risk Manager reopens an approved filing.

Risk Champion — prepare and submit

Section titled “Risk Champion — prepare and submit”
  1. Complete your team’s risks: register, scores and controls.
  2. Run the coverage check and score anything still missing.
  3. Submit the filing. From this moment its risks are locked.

Reviewer — review

Section titled “Reviewer — review”
  1. Open the submitted filing.
  2. Review each risk, its scores and its controls.
  3. Pass the filing on for approval, or return it to the Risk Champion with a reason. A returned filing can be edited again.

Approver — approve

Section titled “Approver — approve”
  1. Open the reviewed filing.
  2. Approve it, or return it to the Risk Champion with a reason.
  3. On approval the system records a snapshot of what was approved. The approved position is what the heat map, the dashboards and report-up read.

Entity Risk Manager — reopen

Section titled “Entity Risk Manager — reopen”

When an approved filing must change, the entity’s own Entity Risk Manager reopens it. The filing goes back to the Risk Champion for editing and runs through review and approval again. The earlier snapshot is kept.

What the system does or refuses

Section titled “What the system does or refuses”
  • Separation of duties. You cannot review or approve your own filing. The action does not appear for you, and the database refuses it.
  • A return needs a reason. A return without a reason is not saved.
  • Locked after submission. Risks in a submitted filing cannot be edited until the filing is returned or reopened.
  • Only the entity reopens. Reopening is an act of the entity’s own Entity Risk Manager. A user at a parent entity cannot reopen, review or approve a subsidiary’s filing — see Subsidiary-Independence.
  • Every step is stamped with who did it, when, and — on approval — a snapshot of what was approved. See Who-filed is stamped.
Section titled “Related”