RCSA APRCSA Exam cheat sheet

RCSA is a structured process where business owners identify risks in their processes, assess them, and evaluate the controls that mitigate them.

Three lines model: first line owns and performs the RCSA; second line sets methodology and challenges; third line (internal audit) independently assures.

Governing policy must define scope, risk taxonomy, rating scales, assessment frequency, roles, approval, and record retention.

Board or board risk committee approves the RCSA framework; senior management executes it and attests to results.

Frequency rule of thumb: annual full refresh, with event-driven reassessment after incidents, process change, or new products.

Accountability rule: each risk and control has one named owner; shared ownership without a single accountable owner is a design defect.

Segregation rule: the person who performs a control should not be the sole person who assesses that control's effectiveness.

Governance evidence includes approved methodology, assessment calendar, sign-offs, challenge logs, and issue escalation records.

Risk is the effect of uncertainty on objectives; it is stated as cause-event-consequence so it is testable and measurable.

Risk taxonomy levels: category (e.g., strategic, operational, financial, compliance) then sub-category then specific risk statement.

Risk statement test: does it name a cause, an event, and an impact on a stated objective? If not, rewrite it.

Common operational sub-categories: process execution, people, technology, data, fraud, third party, legal/regulatory, model.

Inherent risk is assessed before controls; residual risk after controls; both use the same scales to be comparable.

Risk identification sources: process maps, loss events, audit findings, regulatory changes, KRIs, scenario analysis, external events.

Avoid control-embedded risk language; a risk statement describing a missing control is a control gap, not a risk.

Risk register fields: ID, statement, category, owner, inherent rating, key controls, residual rating, KRIs, linked issues.

Control types by timing: preventive (before), detective (after), corrective (remediation), and directive (guides behavior).

Control nature: manual, automated, or IT-dependent manual (manual step relying on a system-generated report).

Control design attributes: owner, frequency, precision/threshold, source data, evidence retained, and escalation path.

Design effectiveness asks whether the control, as designed, would prevent or detect the risk within tolerance; it precedes operating effectiveness.

Key control criteria: directly addresses a significant risk, is the primary mitigation, and failure would not be caught elsewhere.

Segregation of duties is a preventive design control; compensating detective controls (review, reconciliation) apply when SoD is impractical.

Automated controls require testing of the system logic and the report/configuration, including access and change management around it.

Control taxonomy mapping to risk category enables coverage analysis: each significant risk should map to at least one key control.

Typical rating dimensions: impact and likelihood, each on a 1-5 scale; risk score = impact x likelihood (range 1-25).

Define each scale point with concrete criteria (e.g., financial thresholds, regulatory consequence, customer harm) to reduce subjectivity.

Velocity and persistence are optional secondary dimensions used to differentiate fast-moving or long-tail risks.

Inherent score is rated assuming no controls; residual is rated with current controls operating as designed.

Control effectiveness rating (effective, partially effective, ineffective) is the bridge between inherent and residual scores.

Risk appetite/tolerance statement sets the threshold above which residual risk must be escalated or remediated.

Calibration sessions across business units reduce scale drift; document rationale for each score to support challenge.

Aggregation rule: roll up residual scores by category and process, but do not average away high individual risks.

Program design choices: top-down (risk-led, enterprise risks) versus bottom-up (process-led); mature programs combine both.

Pilot the methodology in one or two representative processes, refine templates, then scale in waves by risk materiality.

Templates should be short enough to complete accurately; excessive fields reduce quality and increase gaming.

Stakeholder map: process owners, control owners, second line, internal audit, senior management, board, and regulators.

Training must cover risk language, scale definitions, evidence expectations, and the challenge/attestation process.

Rollout sequencing rule: prioritize processes with highest inherent risk, recent losses, or upcoming regulatory change.

Change management: communicate purpose (better decisions, not blame), provide helpdesk support, and publish quality expectations.

Success metrics: completion rate, assessment timeliness, challenge findings rate, issue closure rate, and rework rate.

Evidence standard: sufficient (enough samples), appropriate (relevant to the control), and retained per policy.

Sample sizing depends on control frequency: more frequent controls require larger samples; document the basis.

Operating effectiveness testing: inquiry alone is insufficient; corroborate with inspection, observation, or reperformance.

Test attributes: was the control performed, by the right person, timely, accurately, and was evidence retained?

Quality assurance layers: first-line self-review, second-line challenge and sampling review, third-line audit of the RCSA process itself.

QA sampling should target high inherent risk processes, prior weak ratings, and newly onboarded assessors.

Common defects: risk statements that are actually controls, unsupported ratings, missing evidence, stale assessments, orphan risks.

Findings from QA feed the issue management process with owner, action, due date, and validation of closure.

Report content: risk profile heat map, movement versus prior period, top residual risks, overdue issues, and control failures.

Audience tailoring: board gets aggregate and appetite breaches; management gets process-level detail and actions.

Issue lifecycle: identify, log, assign owner, root cause, remediation plan, due date, track, validate, close.

Aging and severity drive escalation; overdue high-severity issues must be reported to senior management or the board.

Integration rule: RCSA risks map to the enterprise risk taxonomy so operational results roll up into the ERM profile.

Link RCSA outputs to KRIs, loss events, scenario analysis, and capital/limit setting to close the ERM feedback loop.

Root cause categories: design deficiency, execution failure, people/resource, system, third party, or change management.

Validation of closure requires evidence that the remediation operated, not just that an action was marked complete.

Objectivity: assessors must disclose conflicts and recuse from assessing controls they own or operate.

Integrity of reporting: ratings and issues must not be suppressed or softened to protect a unit's appearance.

Regulators expect a documented, risk-based RCSA framework with board oversight, challenge, and evidence of remediation.

Records must be accurate, complete, and retained per policy; backdating or altering evidence is misconduct.

Escalation duty: known control failures or appetite breaches must be raised through defined channels without delay.

Confidentiality: risk and control data is shared only with authorized parties and handled per data protection rules.

Whistleblowing protections should exist so staff can report concerns about suppressed risks or control overrides.

Professional skepticism: challenge optimistic self-assessments, unsupported 'effective' ratings, and vague risk statements.

Program design choices: top-down (risk-led, enterprise risks) versus bottom-up (process-led); mature programs combine both.

Pilot the methodology in one or two representative processes, refine templates, then scale in waves by risk materiality.

Templates should be short enough to complete accurately; excessive fields reduce quality and increase gaming.

Stakeholder map: process owners, control owners, second line, internal audit, senior management, board, and regulators.

Training must cover risk language, scale definitions, evidence expectations, and the challenge/attestation process.

Rollout sequencing rule: prioritize processes with highest inherent risk, recent losses, or upcoming regulatory change.

Change management: communicate purpose (better decisions, not blame), provide helpdesk support, and publish quality expectations.

Success metrics: completion rate, assessment timeliness, challenge findings rate, issue closure rate, and rework rate.