How Banks Are Refining RCSA Programs

Risk and control self-assessments (RCSAs) are a cornerstone of operational risk management, helping banks identify gaps, manage controls, and respond to emerging risks. RMA’s latest RCSA survey, conducted in collaboration with PwC, reveals how institutions are developing, using, and improving these critical programs. Here’s a quick breakdown of the findings: 

• How RCSAs Are Developed: Most institutions spend two to three months creating an RCSA, though 15% either work continuously or wrap up in under a month. Updates can be triggered either by an established cadence or by changes in risk levels, products, or regulations. To gather input for an RCSA, 61% of respondents use a mix of workshops and offline work—emphasizing the value of in-person discussions for robust assessments. 

• How Banks Use RCSAs: Nearly half of respondents use them to link control gaps to action plans, prioritize control testing, and inform annual risk profiles. Other uses include identifying emerging risks, aligning with regulatory controls, and planning audits. Smaller banks focus on enhancing control environments, while larger institutions prioritize meeting regulatory expectations. Still, the survey indicates untapped opportunities, such as integrating RCSA insights into strategic planning. 

• Where RCSAs Can Improve: Obstacles like resource constraints and skill gaps remain common. While institutions are refining methodologies, technology adoption is slow—just 20% report using modern tools like AI. Respondents also see room for improvement in integrating RCSA with other risk programs to strengthen coordination across the three lines of defense. 

Banks continue to enhance RCSA practices, with promising strides in methodology, training, and technology. While challenges persist, the RMA survey reveals growing momentum to transform RCSA into a fully integrated, value-adding process for operational risk management. Read the complete survey summary on our website.