RCSA APRCSA Exam flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

RCSA definition

A structured process in which business process owners identify risks to their objectives, assess inherent and residual risk, and evaluate the design and operating effectiveness of related controls.

Three lines model

First line owns and performs risk and control activities; second line sets methodology and provides challenge and oversight; third line, internal audit, gives independent assurance to the board.

Risk owner accountability

Each risk has one named accountable owner responsible for assessment accuracy and remediation, even when mitigation activities are shared across several teams or functions.

Assessment frequency rule

Perform a full RCSA refresh at least annually, plus event-driven reassessment after significant incidents, process changes, new products, acquisitions, or major regulatory change.

Risk definition

The effect of uncertainty on objectives, commonly expressed as a cause, an event, and a consequence, so that the statement is measurable and testable.

Risk statement structure

A well-formed risk statement names the cause, the event that may occur, and the impact on a specific objective, avoiding vague labels such as operational failure.

Risk taxonomy hierarchy

A structured classification from broad category, such as strategic, operational, financial, or compliance, down to sub-category and then individual risk statements used in registers.

Control gap versus risk

A risk describes uncertain future events affecting objectives; a missing or weak control is a control gap, and writing it as a risk statement confuses the two concepts.

Preventive versus detective control

Preventive controls stop an error or event before it occurs, such as approval gates; detective controls identify it after occurrence, such as reconciliations or exception reports.

Automated control testing

Verification that system logic performs the control as intended, including configuration review, test of the rule, and access and change management over the system.

Design effectiveness

An evaluation of whether a control, as designed and assuming it operates properly, would prevent or detect the risk within the stated tolerance.

Key control criteria

A control is key when it directly mitigates a significant risk, is the primary mitigation, and its failure would not be detected by another control.

Segregation of duties control

A preventive design control separating incompatible activities, such as initiation, approval, recording, and reconciliation, so no single person can complete and conceal a transaction.

Risk score formula

A common rating method multiplying impact by likelihood on defined scales, for example each from one to five, producing a score from one to twenty-five.

Inherent versus residual risk

Inherent risk is assessed before considering controls; residual risk is assessed after accounting for current controls operating as designed, using the same rating scales.

Risk appetite threshold

The level of residual risk an organization is willing to accept, above which escalation, remediation, or additional controls are required by policy.

Rating calibration session

A facilitated review across business units to align use of rating scales, resolve inconsistent scoring, and document the rationale supporting assigned impact and likelihood ratings.

Top-down versus bottom-up RCSA

Top-down starts from enterprise risks and maps down to processes; bottom-up starts from process-level risks and aggregates upward. Mature programs combine both approaches.

RCSA pilot approach

Test the methodology in a small number of representative processes, refine templates and guidance based on results, then scale in waves prioritized by risk materiality.

RCSA stakeholder map

The set of parties involved or informed, including process and control owners, second line, internal audit, senior management, the board, and relevant regulators.

RCSA success metrics

Measures such as assessment completion and timeliness, challenge findings rate, rework rate, issue closure rate, and coverage of high-risk processes.

Sufficient appropriate evidence

Evidence that is relevant to the control tested and reliable in source, retained in the required form and for the period defined by records policy.

Sample sizing by frequency

The number of items tested increases with control frequency and risk; the basis for sample size is documented and consistent with methodology.

Operating effectiveness testing

Confirmation that a control operated as designed throughout the period, using inspection, observation, or reperformance, since inquiry alone is not sufficient evidence.

RCSA quality assurance layers

First-line self-review, second-line challenge and sampling review of assessments, and third-line audit of the RCSA process itself for design and operating effectiveness.

Common RCSA quality defects

Frequent weaknesses include risks written as controls, unsupported ratings, missing evidence, stale assessments, orphan risks without owners, and inconsistent scale application.

Issue lifecycle stages

Identify, log, assign an accountable owner, determine root cause, define remediation, set a due date, track progress, validate closure with evidence, and formally close.

RCSA to ERM integration

Mapping process-level risks to the enterprise risk taxonomy so operational results aggregate into the enterprise risk profile, KRIs, loss data, and capital discussions.

Root cause categories

Standard classifications used in issue analysis, such as design deficiency, execution failure, people and resourcing, system limitation, third-party failure, and change management weakness.

Board risk reporting content

Aggregated risk profile, movement from prior period, appetite breaches, top residual risks, significant control failures, and status of overdue high-severity issues.

Assessor objectivity rule

Individuals must disclose conflicts of interest and avoid assessing controls they perform or own, preserving independence in the self-assessment and challenge process.

Regulatory RCSA expectations

Supervisors expect a documented, risk-based framework with board oversight, credible challenge, retained evidence, and demonstrated remediation of identified control weaknesses.

Escalation duty

An obligation to raise known control failures, appetite breaches, or suppressed risks promptly through defined channels, without alteration or backdating of supporting records.