RCSA in practice: a risk score nobody can type

One criteria set, computed scores

• You choose, the system computes. The assessor chooses a likelihood level and a level on each impact dimension — financial, regulatory, operational, reputational, and any dimension the group defines. The inherent score, the residual score, the tier and the rating band are computed from those choices and from the effectiveness of the controls.
• The criteria set belongs to the group. It describes each likelihood and impact level, how the dimensions combine into a score and where the bands fall. Every entity scores on the set that applies to it and cannot change it, so the figures consolidate.
• Residual is never above inherent. Control effectiveness can only reduce the score. A residual score above the inherent score is not recorded.
• A coverage check before submission. The check lists the risks not yet scored and the dimensions still missing on each, so the reviewer receives a complete filing.

The filing: prepare, review, approve, snapshot

• Prepare and submit. The Risk Champion completes the team's risks, scores and controls, runs the coverage check and submits. From that moment the risks are locked.
• Review. The Reviewer passes the filing on or returns it with a reason. A return without a reason is not saved; a returned filing can be edited again.
• Approve. The Approver approves or returns. On approval the system records a snapshot of exactly what was approved. The heat map, the dashboards and the parent's view all read the approved position, not the working draft.
• Reopen. When an approved filing must change, the entity's own Entity Risk Manager reopens it; it runs through review and approval again and the earlier snapshot is kept.
• Separation of duties. Nobody reviews or approves their own filing. The button is absent for that user, and the database refuses the action regardless of the screen.

Controls: effectiveness, testing, findings

Each risk records the controls that reduce it, and each control carries an effectiveness assessment; that assessment is what turns inherent risk into residual risk. Control testing then checks that the controls work as recorded: a test plan says what will be tested and when; a result is passed or failed; findings are written down. A failed test creates an action item in the action register with an owner, a due date and a status — nobody re-keys it — and earlier test results stay on the control.

Where it usually breaks

• A typed residual score. The spreadsheet has a column for it, so it gets filled in. Once a rating can be typed it can be argued down, and the heat map becomes a record of negotiations.
• Scales that differ by unit. Finance scores on a five-point scale, operations on four, a subsidiary on its own matrix. The group roll-up looks precise and means nothing.
• No snapshot. The file is edited after the committee saw it. When an auditor asks what was approved, the answer is a reconstruction.
• The cycle restarts from a blank sheet. Without a roll-forward, last year's risks, scores and controls are copied by hand, and the links to loss events and indicators are lost on the way.

In Risk Core

Risk Core — powered by Qirin X · ComplyWise. In its ERM Core module the RCSA runs as described above: one risk register per entity on the group's one criteria set; a risk code issued by the system (for example CM-RISK-2026-001); inherent and residual scores, tier and band computed with no field to type them; a heat map whose cells follow the residual scores and cannot be moved by hand; and a filing that locks on submission, is reviewed and approved inside the entity, and records a snapshot on approval.

Reporting periods are opened once, at the group root, so every entity assesses on the same cycle, and at the end of a cycle each entity rolls its own register forward — risks, scores and controls copied into the next period for updating. A parent company reads the approved position of each subsidiary through report-up and cannot score, review, approve, reopen or roll forward on its behalf.

Platform summary and the ComplyWise services around it: Risk Core. Product documentation: RCSA, Scoring a risk and Submission and sign-off on Risk Core Docs.

The series

Six articles, one stage at a time. Each one explains the framework first and ends with how Risk Core implements it.

1. 1

   Enterprise risk management in practice: the six-stage risk life cycle

   ERM in practice · 1 of 6 · October 2026

2. 2

   RCSA in practice: a risk score nobody can type

   ERM in practice · 2 of 6 · October 2026

3. 3

   Loss events in practice: the tier is computed, the month is always filed

   ERM in practice · 3 of 6 · October 2026

4. 4

   Key risk indicators in practice: three bands, versioned thresholds, every Red is an action

   ERM in practice · 4 of 6 · October 2026

5. 5

   From the business impact analysis to the continuity plan: how a recovery time becomes a call-tree order

   ERM in practice · 5 of 6 · October 2026

6. 6

   Group risk governance in practice: each company runs its own, the parent reads up

   ERM in practice · 6 of 6 · October 2026

Frequently asked questions

What does RCSA stand for and who does it?

Risk and control self-assessment. The first line — the team that owns the risk — identifies and scores its risks and records its controls; the second line reviews and the designated approver signs off. In a group, each company runs its own RCSA and reports the approved result up.

What is a criteria set in risk assessment?

The definitions of each likelihood level and each impact level, how the impact dimensions combine into a score, and where the rating bands fall. When one criteria set is owned at group level and applied to every entity, scores from different companies can be compared and consolidated.

Why lock a filing on submission?

So that what the reviewer reads is what the assessor submitted, and what the approver signs is what the heat map and the parent will show. A filing that needs changes is returned with a reason or reopened by the entity's own risk manager, and the earlier snapshot is kept.

How often should an RCSA be run?

Most regulated firms run it annually, with a roll-forward that carries risks, scores and controls into the next cycle for updating rather than starting from a blank sheet. Some run it half-yearly or quarterly for higher-risk areas; the cycle is set by the group.

Sources

1. Risk Core Docs — RCSA: register, scoring, controls, heat map, submission and sign-off, reporting periods
2. Risk Core Docs — Scoring a risk: inherent and residual risk, tier and band computed; the coverage check
3. Risk Core Docs — Submission and sign-off: prepare, review, approve; return with a reason; snapshot
4. Risk Core Docs — Product rules: the seven rules Risk Core enforces in the database
5. Risk Core Docs — Standards mapping: COSO ERM (2017), ISO 22301:2019 and the Basel event types
6. COSO — Enterprise Risk Management: Integrating with Strategy and Performance (2017), guidance page
7. ISO 22301:2019 — Security and resilience — Business continuity management systems — Requirements

Accessed and last reviewed 21 October 2026. Each figure and table cell is traced to a source above.