RCSA

Risk and control self-assessment is the mechanism by which the people who own a process rate their own risks and the controls meant to contain them. Its strength is proximity: nobody understands a payments process better than the team running it. Its weakness is the same thing. Self-assessment invites optimism, and an RCSA where every control is rated effective is telling you about the culture, not the controls.

What separates a useful RCSA from theatre is unglamorous: a scoring scale that forces discrimination between ratings, evidence requirements attached to every control score, challenge from a second line with the authority to disagree, and actions that carry owners and dates.

This section covers the complete RCSA process, workshop design and scoring matrices, bank-specific templates, and the regulatory compliance and anti-money laundering context that drives RCSA in financial services. It connects to operational risk as the discipline RCSA serves, risk assessment for the wider methodology, and key risk indicators for the ongoing monitoring that should follow every assessment.