Rollout Pressure: A First-Year RCSA That Everyone Signs but Nobody Uses
A logistics group is rolling out RCSA to 14 business units in one year. To meet the timeline, the risk function issues a standard template with 60 pre-populated risks and asks each unit to score them and return within three weeks. Completion reaches 100%. Six months later, unit managers describe the exercise as 'a form we sign'. Two units have risks in the register that no one can explain. Internal audit finds that no unit has used its RCSA output to change a control. The group risk committee asks whether the rollout succeeded. The head of risk must propose changes for year two without losing executive sponsorship, which was built on the 100% completion metric.
1. Evaluate whether the rollout succeeded and identify the design choices that caused the outcome.
Read the worked answer
The rollout achieved coverage, not risk management. The test of an RCSA is whether it changes decisions about controls; by that test it failed in all 14 units. Completion is a process metric and was the wrong success measure to promise the executive.
Three design choices caused this. First, 60 pre-populated risks removed the identification work, which is where owners build ownership of the risk. Scoring someone else's list produces signatures, not insight. Second, a three-week window across 14 units forced a paper exercise; workshops that surface real exposures take longer. Third, there was no requirement to link any output to a control change, so the exercise had no consequence and no feedback loop. The two unexplainable risks are a symptom: entries were accepted without a named owner who could defend them.
The year-two proposal should keep the coverage achievement and reframe success around use: number of control changes initiated from RCSA, number of risks with an owner who can explain the exposure, and evidence that residual scores moved for a documented reason.
2. Propose a year-two design that improves quality without losing executive sponsorship. Address the metric change directly.
Read the worked answer
Do not abandon the completion metric abruptly; replace it in stages. Keep coverage reporting but add a quality dimension: for each unit, report the proportion of risks with a named owner who can articulate the exposure, and the number of control changes or issue actions arising from the assessment. Present year one as having built the foundation and year two as moving from coverage to insight - a narrative that credits the executives rather than embarrassing them.
Design changes: replace pre-populated lists with a facilitated identification workshop per unit, seeded with a short list of prompts rather than 60 answers. Reduce scope to the unit's top 10 to 15 risks so depth is possible. Require each risk to have an owner who signs and can explain it. Require at least one documented action per unit, even a small one, so the loop closes. Stagger units across the year to allow workshop time. Pilot with two willing units and use their results as the internal case study for the rest. This keeps the sponsorship intact because it delivers visible use, which is what the executives actually wanted.