Risk and Control Self-Assessment Fundamentals and Governance
Core concepts
RCSA is a structured, repeatable process by which business owners identify risks in their own processes, evaluate them, and attest to the controls that mitigate them. Candidates must distinguish the three lines model: the first line owns and performs the assessment, the second line designs the framework, sets taxonomy and scoring standards, challenges results, and aggregates, and internal audit (third line) provides independent assurance. Governance elements include a board-approved policy, defined roles and accountabilities, a documented methodology, a challenge and sign-off protocol, and records retention.
Key vocabulary: risk owner (accountable for the risk and its response), control owner (accountable for design and operation of a specific control), assessment unit or process scope, attestation, and the risk appetite statement that anchors scoring thresholds. Understand the difference between an RCSA cycle (periodic, scheduled) and event-driven reassessment triggered by process change, loss events, or new regulation.
Traps
Questions often blur ownership: the risk owner accepts residual risk, not the second line. Another trap is treating RCSA as an audit exercise; it is a management tool, and audit reliance is a secondary benefit. Watch for answers that let the second line "own" risks or that treat challenge as optional. Also beware of confusing a control's design effectiveness with its operating effectiveness.
Worked example / rule of thumb
Rule of thumb: "First line owns, second line challenges, third line assures." Example: a payments manager identifies duplicate-payment risk, rates it, maps the dual-approval control, and signs off; the risk function reviews the scoring against the taxonomy and challenges an implausibly low rating; audit later tests the control independently. If an answer assigns any of these three roles to the wrong line, eliminate it.