Insight
What are RCSA and key risk indicators?
In short
Risk and control self-assessment (RCSA) is a structured exercise in which the people who own a process assess the risks in it and test whether the controls that are supposed to manage those risks are designed properly and operating as intended. Key risk indicators (KRIs) are measurable quantities, tracked over time with thresholds, that signal when a risk is moving towards or beyond appetite.
RCSA looks backwards at whether controls worked; KRIs look forward at whether risk is rising. Together with the incident register, which records what actually went wrong, they give a risk function three views of the same control environment.
What an RCSA cycle looks like
A cycle starts by scoping the processes and risks to be assessed, usually from the risk register. Process owners then rate each linked control on two questions: is it designed to address the risk, and did it operate as designed during the period? They attach evidence, such as reconciliations, approval records or system reports, and a reviewer from the risk function or a second line challenges the ratings before sign-off. Findings become actions with owners and due dates.
The word self in self-assessment is deliberate. The first line owns the assessment because it knows the process; the second line reviews it because self-assessment alone is optimistic. The three lines model describes this division.
Design versus operating effectiveness
A control can be well designed and never performed, or performed faithfully while addressing the wrong risk. Rating design and operation separately makes both failure modes visible. A control that fails either test should reduce the confidence placed in the residual risk score of every risk it is linked to.
Evidence
Evidence is what separates an assessment from an opinion. For each control tested there should be an artefact that a third party could inspect: a signed reconciliation, a system log, a sample of approved transactions. Storing evidence with the control, versioned and dated, means audit preparation becomes retrieval rather than reconstruction.
- Name the control and the risk it addresses.
- Record who tested it, when and how (sample size, period).
- Attach the artefact and the rating with a short rationale.
- Log the reviewer's challenge and the final sign-off.
Key risk indicators
A good KRI is specific, measurable from data the organisation already has, and leads the risk rather than lagging it. Staff turnover in a critical team, the age of the oldest open alert, the number of failed reconciliations in a month and system downtime hours are typical examples. Each KRI carries thresholds, often green, amber and red, agreed with reference to risk appetite.
Thresholds and escalation
A KRI without a defined response is just a chart. When an indicator crosses amber the risk owner should be notified; when it crosses red the escalation should reach someone with authority to act, and the breach should be recorded. Automating the notification removes the dependence on someone remembering to look at the dashboard.
Connecting RCSA, KRIs and incidents
Incidents are the ground truth. When something goes wrong, the incident record should identify which controls failed and which KRIs, if any, should have warned. That feedback loop tightens the next RCSA cycle, retires indicators that never moved, and adds ones that would have caught the event. A register where incidents, controls and indicators are linked is far more useful than three separate lists.
How ERMAML handles this
ERMAML, the Ontech Risk & Compliance Suite, schedules RCSA cycles with design and operating ratings, attached evidence and reviewer sign-off, tracks KRIs with thresholds and automatic escalation to the accountable owner, and links incidents and operational losses back to the controls involved so the residual risk scores reflect reality. See enterprise risk management.
Frequently asked questions
How often should an RCSA be performed?
Commonly annually for the full register, with higher-risk processes assessed more often and an out-of-cycle assessment after a significant incident or change. The frequency is a policy decision that should be documented and aligned with what your regulator expects.
What makes a good key risk indicator?
It measures something that moves before the risk materialises, can be calculated from data you already collect, has an owner, and carries thresholds tied to risk appetite with a defined response when they are crossed. Indicators that never change or cannot be acted on should be retired.
Who owns the RCSA: the first or second line?
The first line performs the self-assessment because it owns the process and the controls. The second line, typically the risk function, sets the method, reviews and challenges the ratings, and reports the results. Internal audit, the third line, independently tests both.
What is the difference between a KRI and a KPI?
A key performance indicator measures how well an objective is being achieved. A key risk indicator measures exposure to a risk that could prevent the objective being achieved. The same metric can serve both purposes, but a KRI is defined by its thresholds and escalation, not just by being reported.
Sources
See ERMAML on your own data
Request a demo with Ontech Solutions in Lusaka and see sanctions screening, KYC, transaction monitoring, goAML reporting and the risk register working together in one platform.