Reporting, Issue Management, and Integration with ERM
Core concepts
RCSA outputs feed risk registers, heat maps, dashboards, board and committee reporting, capital and stress-testing inputs, and issue management. Effective reporting is audience-appropriate: the board needs aggregated top risks, trends, appetite breaches, and emerging risks; management needs process-level detail, control gaps, and remediation status. Candidates must understand aggregation and roll-up logic, including how unit-level risks combine and where correlations or concentrations matter.
Issue management covers identification, logging, severity rating, root-cause analysis, remediation planning, ownership, tracking, validation of closure, and escalation. Integration with enterprise risk management means consistent taxonomy, aligned scoring, shared data, and linkage to risk appetite, KRIs, scenario analysis, and capital. Integration also means RCSA results inform audit planning and compliance monitoring.
Traps
Frequently tested: reporting only residual risk without inherent context; heat maps with undefined scales; closing issues without validation; and treating RCSA as a standalone exercise disconnected from ERM. Another trap is aggregating risks by simple averaging rather than by considering concentration and correlation.
Worked example / rule of thumb
Rule of thumb: "Report inherent and residual, with trend and appetite status; close issues only after validation." Example: a unit reports a high inherent, medium residual risk with a rising trend and an open remediation issue past due. The board summary shows the risk against appetite, the trend, and the overdue action, not just the residual color. This demonstrates the integration and reporting discipline exam questions reward.