RCSA APRCSA Exam study guide
RCSA APRCSA Exam · Work through your exam, one topic at a time.
The APRCSA is an advanced-level certification in risk and control self-assessment (RCSA) offered by RCSA International (the Risk and Control Self-Assessment association). It is aimed at risk practitioners who already understand the mechanics of RCSA and want to demonstrate that they can design, run, and defend a programme at an organisational level - people moving from running workshops to owning the framework, or from control testing into second-line oversight. The RCSA APRCSA Exam study guide has 8 sections and about 2,513 words.
01Risk and Control Self-Assessment Fundamentals and Governance
RCSA is a structured, repeatable process by which business owners identify risks in their own processes, evaluate them, and attest to the controls that mitigate them. Candidates must distinguish the three lines model: the first line owns and performs the assessment, the second line designs the framework, sets taxonomy and scoring standards, challenges results, and aggregates, and internal audit (third line) provides independent assurance.
341 words, about 2 min02Risk Identification, Taxonomy, and Risk Language
Risk identification must be systematic and complete enough to support aggregation. Candidates should know the common identification techniques: process mapping and walkthroughs, workshops with subject-matter experts, interviews, loss-event and near-miss analysis, scenario analysis, external loss databases, key risk indicator (KRI) thresholds, regulatory change review, and brainstorming.
328 words, about 2 min03Control Identification, Design, and Control Taxonomy
Controls are actions, policies, devices, practices, or mechanisms that modify risk. Candidates must know the common classification schemes: preventive versus detective versus corrective; manual versus automated; and key (primary) versus secondary or compensating.
324 words, about 2 min04Risk Assessment, Inherent and Residual Risk Scoring
Risk assessment converts qualitative judgment into a consistent rating using defined likelihood and impact scales. Candidates must understand scale design: number of levels (often 3–5), clearly defined anchors, defined impact dimensions (financial, customer, regulatory, reputational, operational), and the aggregation rule (usually the higher of likelihood or impact determines the rating on a matrix).
324 words, about 2 min05RCSA Program Design, Rollout, and Stakeholder Engagement
Program design choices include scope (entity-wide, process-based, or risk-based), assessment frequency, tooling, templates, scoring methodology, aggregation and roll-up rules, and the level of granularity. A phased rollout - pilot in a representative unit, refine templates and guidance, then scale - reduces disruption and improves data quality.
304 words, about 2 min06Testing, Evidence, and Quality Assurance over RCSA Outputs
Testing validates that controls operate as described. Candidates must know the distinction between design effectiveness and operating effectiveness, and between tests of one (a single instance) and tests of many (a sample).
305 words, about 2 min07Reporting, Issue Management, and Integration with ERM
RCSA outputs feed risk registers, heat maps, dashboards, board and committee reporting, capital and stress-testing inputs, and issue management. Effective reporting is audience-appropriate: the board needs aggregated top risks, trends, appetite breaches, and emerging risks; management needs process-level detail, control gaps, and remediation status.
291 words, about 1 min08Professional Ethics, Conduct, and Regulatory Expectations
RCSA professionals must act with integrity, objectivity, competence, confidentiality, and professional care. Ethical risks in RCSA include pressure to understate risks or overstate control effectiveness, optimistic self-assessment, and conflicts of interest where the assessor also owns the risk.
296 words, about 1 min