RCSA Rating Dispute in Payments Operations
Westbridge Retail Bank operates a payments unit processing 2.1 million outbound transfers a month. In the latest RCSA, the first line rated control C-14 - manual reconciliation of three suspense accounts - as 'Strong' and the residual risk as 'Medium'. The control relies on two staff matching exceptions to the general ledger; there is no automated matching. Second-line control testing sampled 25 reconciliations and found six exceptions, including four where aged items over 30 days had been cleared without evidence. The team leader's daily sign-off, cited as a compensating control, was missing on 3 of 12 sampled days. The suspense KRI has been 9 items over five days old for three consecutive months against an appetite threshold of 5; volumes rose 12% after a new merchant client went live. No customer loss has been recorded. The business argues that 'no loss' and the daily sign-off justify keeping the residual rating at Medium. The operational risk function must finalise the RCSA before the audit committee in three weeks and month-end close is in ten days.
1. Is the proposed residual rating of Medium defensible? Explain your reasoning and state the rating you would support.
Read the worked answer
The rating is not defensible on the evidence. Residual risk is a function of inherent risk and control effectiveness; a key manual reconciliation with a 24% test failure rate (6 of 25) cannot be rated 'Strong'. The failures include aged items cleared without evidence, which goes to the reliability of the reconciliation, not just documentation. The daily sign-off is itself a control and was missing on 25% of sampled days, so it cannot offset the failure. 'No loss' is weak evidence: losses are lagging, near misses are not captured, and the KRI has been above appetite for three months. With volumes up 12%, inherent risk is at least unchanged. I would rate residual High, or Medium-High if the impact scale supports it, until remediation is tested. The rating should be owned by the first line but challenged and recorded by the second line. The RCSA should show the control as 'Partially effective' or 'Ineffective', with a documented rationale, an action plan, and a re-test date. The audit committee should see the disagreement and the basis for the final rating.
2. How much reliance can be placed on the team leader's daily sign-off as a compensating control, and what would make it credible?
Read the worked answer
A compensating control must be independent of the failed control, operate at the same frequency and coverage, be documented and tested, and address the same risk. The daily sign-off fails on several counts: it is performed by the same team, it is detective and after the event, it covers only aged items rather than the matching itself, and it was missing on 3 of 12 days. A missing sign-off means the control did not operate, not that it was merely undocumented. To be credible it would need a defined population and checklist, evidence of review before month-end, independent sample testing by second line, escalation of exceptions, and a track record of at least three months. Even then it would reduce, not eliminate, the risk because it does not prevent mis-matching. The business should not use it to avoid a High rating. If used, it should be labelled a temporary mitigating control with an expiry date, and the residual rating should reflect its limited effect.
3. What actions and reporting would you require in the next 30 days?
Read the worked answer
Immediate actions: clear the suspense backlog and re-perform a risk-based sample of items cleared in the last 90 days; reinstate daily sign-off with evidence and escalate missing sign-offs; assign an accountable owner and a 30-day remediation plan; increase reconciliation capacity or automate matching for the highest-risk accounts before month-end; tighten the KRI trigger so a breach escalates to the Operational Risk Committee within five days. Reporting: update the RCSA to reflect tested control effectiveness; report the breach, the disagreement and the remediation plan to the Operational Risk Committee and audit committee; disclose the issue in the monthly risk dashboard. Re-testing: second line to re-test 25 items after 30 days, with a target of zero unexplained aged items. Longer term: automate matching, reduce the number of suspense accounts, and introduce a static-data control. If the audit committee meets before remediation is complete, present the residual risk as High with a clear path to Medium, not as Medium with an action plan.