Glossary
RCSA (risk and control self-assessment)
RCSA is a structured exercise in which business units identify their own risks, rate the controls that manage them, and record the evidence.
RCSA (risk and control self-assessment) explained
In a risk and control self-assessment, the people who run a process, rather than a central risk team, assess the risks in it and how well the controls are working. The results are documented, challenged by the second line and, over time, tested by internal audit.
RCSA is usually run on a cycle, with each unit reassessing its risks and controls at set intervals, and it produces the control-effectiveness ratings that feed residual risk scores and action plans.
For example, a branch operations team might assess the risk of unauthorised transactions, rate the dual-authorisation control as partially effective because it is bypassed at month-end, and raise an action to fix it.
Why it matters in life insurance
RCSA is a widely used method in Zambian banks, insurers and pension funds and is often the evidence a regulator asks for when checking that risk management is embedded in the business rather than held in a central spreadsheet. ERMAML, the Ontech Risk & Compliance Suite, schedules RCSA cycles, attaches evidence and reviewer sign-off to each control, and links incidents back to the controls that failed.
Related terms
KRI (key risk indicator) · Residual risk · Three lines of defence