Chapter 5 Learning Outcomes

Question 1

What is RCSA?

Answer 1

RCSA stands for Risk and Control Self-Assessment. It is a process for identifying, recording and assessing potential risks and related controls.

(Introduction, para 1)

Question 2

What is the purpose of RCSA and what can it be used for?

Answer 2

The purpose is to enable a firm to manage key risks to avoid impacting objectives. It involves identifying, assessing, monitoring and reporting risks and controls. It enables risks to be proactively managed.

(5.2, para 1)

Question 3

What are the key elements of an RCSA process?

Answer 3

Key elements are:
* identifying risks,
* assessing inherent and residual exposures,
* assessing controls,
* assigning owners,
* deciding on responses,
* taking action,
* monitoring,
* reporting.

(Fig 5.3.1)

Question 4

How do you assess operational risk exposure?

Answer 4

By judging the likelihood of occurring and expected impact (financial or non-financial) if it does occur. These are combined on a matrix to show level of exposure.

(5.5, 5.5.1, 5.5.2)

Question 5

What are the benefits of an effective RCSA process?

Answer 5

Benefits include:
* cultural change,
* alignment to strategy,
* consensus building,
* clear accountability,
* anticipating threats,
* process efficiencies.

(Table in 5.2)

Question 6

How do you identify which risks to include?

Answer 6

• Use risk categories,
• internal loss data,
• external loss data,
• indicators,
• objectives,
• complaints,
• planning
• outputs,
• performance data,
• upcoming changes,
• analysis reports.

(5.3.2, 5.3.3)

Question 7

What’s the difference between inherent and residual risk exposures?

Answer 7

Inherent is untreated exposures.
Residual is remaining exposure after accounting for effectiveness of controls.

(5.5.3, Fig 5.5.3)

Question 8

What 4 types of actions can you take to address risk exposure?

Answer 8

Accept, reduce (add controls), transfer (insure), avoid (eliminate).

(5.7.2)

Question 9

What’s a control?

Answer 9

Any action taken to reduce likelihood or impact. E.g. preventative, detective, corrective controls.

(5.6)

Question 10

What roles do controls play in risk management?

Answer 10

Prevent underlying causes, detect if an event occurs, take corrective action, direct through policies. Overall reduce exposures.

(5.6, Fig 5.6)

Question 11

What key things are included in reporting of RCSAs?

Answer 11

Scope, changes in profile, risk assessments, controls, actions, heat map.

(5.8.1 to 5.8.6)

Question 12

What’s the difference between a risk owner and a control owner?

Answer 12

Risk owner manages the risk identification, assessment etc.
Control owner designs and operates controls.

(5.7, 5.7.1)