RCSA APRCSA Exam key terms

A structured process in which business process owners identify risks, evaluate their significance, and assess whether the controls intended to manage them are designed and operating effectively.

A governance framework separating management and process ownership, independent risk and compliance oversight, and internal audit assurance, so that assessment, challenge, and assurance responsibilities remain distinct.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed qualitatively or through quantitative limits and thresholds that guide assessment decisions.

The acceptable variation around a risk appetite statement, often expressed as a measurable threshold or limit that determines when a risk exposure requires escalation or remediation.

The documented roles, committees, policies, and approval paths that determine who owns risks, who challenges assessments, and who accepts residual exposure above defined thresholds.

A hierarchical classification of risk categories and subcategories used consistently across an organization so that risks can be aggregated, compared, and reported without duplication or gaps.

The shared vocabulary and definitions an organization adopts so that terms such as risk, control, impact, and likelihood carry the same meaning across business units and reporting levels.

A structured sentence describing a cause, an uncertain event, and its consequence, written so that the risk can be assessed, owned, and linked to specific controls.

A writing convention that separates the underlying driver of a risk, the uncertain occurrence itself, and the resulting impact, preventing vague labels that cannot be tested or measured.

A facilitated session in which process owners and subject experts systematically surface risks using prompts, historical loss data, and process walkthroughs before any scoring or control discussion begins.

A risk that is newly developing or changing in nature and may not yet be captured by historical data, requiring forward-looking scanning rather than reliance on past loss experience.

The central record of identified risks, their owners, assessments, linked controls, and remediation actions, serving as the primary evidence trail for the RCSA program.

A policy, procedure, system, or manual activity that reduces the likelihood or impact of a risk event, and which can be tested to confirm it operates as intended.

A control designed to stop a risk event from occurring, such as an approval requirement, system access restriction, or segregation of duties between incompatible activities.

A control that identifies a risk event after it has occurred, such as reconciliation, exception reporting, or monitoring review, allowing timely correction but not prevention.

A control identified as critical to managing a significant risk, warranting more frequent and rigorous testing because its failure would materially affect the achievement of objectives.

The separation of incompatible responsibilities, such as initiation, approval, and recording of a transaction, so that no single person can complete and conceal an error or fraud.

An alternative control that reduces risk when a primary control is absent or ineffective, often applied temporarily while a permanent remediation is designed and implemented.

A maintained catalogue of standardized controls with unique identifiers, descriptions, and owners, enabling consistent mapping of controls to risks across processes and business units.

The documented linkage between each identified risk and the controls that address it, revealing risks with no coverage and controls that address no meaningful risk.

A situation where an identified risk lacks a control, or where existing controls are insufficiently designed to reduce the risk to within the approved tolerance level.

The level of risk before considering the effect of controls, assessed on the assumption that no mitigating activity exists, and used as the starting point for evaluating control value.

The level of risk remaining after controls are taken into account, calculated by adjusting inherent risk for the design and operating effectiveness of the mapped controls.

The defined rating levels for likelihood and impact, with written descriptors for each level, ensuring that different assessors assign comparable scores to similar exposures.

The assessed probability that a risk event will occur within a stated time horizon, expressed as a frequency estimate or a rating on the organization's defined scale.

The assessed magnitude of consequence if a risk event occurs, measured across dimensions such as financial loss, customer harm, regulatory breach, and reputational damage.

A judgment of whether a control is suitably designed and operating as described, typically rated on a scale from effective to ineffective, and used to derive residual risk.

A visual display plotting risks by likelihood and impact, often color-coded against appetite thresholds, to help committees prioritize attention and compare exposures.

The defined process for raising a risk, control failure, or exceeded tolerance to the appropriate level of management or committee within a specified timeframe.

The criteria determining which processes, legal entities, and risks are included in the assessment cycle, based on size, complexity, and significance to the organization's objectives.

An assessment performed for a single business process, focusing on the risks and controls within that process rather than on enterprise-wide or entity-level exposures.

A step-by-step review of how a process actually operates, used to confirm that documented controls exist in practice and to identify informal or missing steps.

Independent review and questioning of business-produced risk and control assessments by the risk or compliance function, testing whether conclusions are supported by evidence and consistent with peers.

A procedure that examines evidence to determine whether a control operated as designed during a defined period, using inquiry, observation, inspection, or reperformance.

An evaluation of whether a control, as documented and structured, is capable of preventing or detecting the relevant risk on a timely basis, performed before testing operation.

An examination of whether a control actually functioned as designed throughout the review period, typically through sampling transactions or observing activity over time.

The selection of a subset of control instances for testing, using a documented and defensible method, so that conclusions about the population are supportable.

The defined quality and sufficiency requirements for documentation supporting an assessment conclusion, specifying what constitutes acceptable proof that a control operated.

A periodic independent check of completed RCSA documentation against methodology standards, verifying scoring consistency, evidence sufficiency, and adherence to defined procedures.

The retained record showing who performed each assessment step, when, on what evidence, and what changes were made, enabling later verification and challenge.

A structured set of reports presenting risk profiles, control status, breaches, and trends to management and committees, tailored to the decisions each audience must make.

A metric tracked over time that signals rising or falling exposure to a specific risk, used alongside RCSA ratings to detect deterioration before a loss event occurs.

The managed process of correcting an identified control weakness, including assigning an owner, agreeing a target date, and validating that the fix actually resolves the deficiency.

The alignment of RCSA outputs with capital assessment, strategy setting, and enterprise risk aggregation, so that process-level results feed consistently into organization-wide risk views.

The extent to which internal audit can use RCSA results and control testing evidence as input to its own work, dependent on the documented quality and independence of that work.

The risk that business practices, employee behavior, or incentive structures cause harm to customers, markets, or the integrity of the institution, assessed alongside financial risks.

The standards supervisors set for governance, risk management, and record-keeping, which shape how RCSA programs must be documented, challenged, and evidenced.

The requirement that those who assess, challenge, or test risk and control activities are free from conflicts of interest and are not reviewing work they themselves performed.