RCSA practice benchmark
- 28 January 2020
At the end of 2019, ORX ran a study on Risk Control Self Assessment (RCSA) with more than 70 banking and insurance firms based around the world. The study looked at how the industry is using RCSAs, what value is being derived from them and how to get the most benefit from this assessment.
Find out how mature your RCSA practice is
This study is part of ORX's practice benchmark series. Practice benchmarks help assess the maturity of an institution’s operational risk management practices against the industry. Each institution that takes part receives a customised benchmark report, showing where their practice sits in comparison to the other participants.
Practice benchmarks aren’t only available to ORX members. You can get an individual report benchmarking your practice for a small fee, even if you’re not currently a member of ORX. Prices start from just £2,000, so if you're interested in finding out more, please contact Roland Kennett.
Download the free summary report
As well as the individual benchmark reports that each participant received, we produced a detailed report analysing the results of the study and our findings on RCSA practice as a whole. This report is available to all members of ORX (sign in required). We've also created a summary report, with some of the study highlights, which you can download for free.
The RCSA should enable risks to be proactively managed. It should facilitate taking timely actions to address unacceptable levels of exposure and to ensure controls are effective. However, in our study we observed the following challenges across the industry:
- RCSAs are often out of date
- RCSAs are often not informative enough
- RCSAs can be inefficient
1. The challenge of RCSAs being out of date
RCSAs should provide a current view of risks, an understanding of the current exposure to those risks and the ability to manage those risks within the firm’s appetite. Over half of the institutions we surveyed had moved, were in the process of moving, or are intending to move to an RCSA approach of combining regular and trigger-based RCSA (a hybrid approach). They felt that this approach was beneficial because it is seen as being more efficient, focusing more on material risk issues (risk-based prioritisation) and regulators endorse it.
2. The challenge of RCSAs not being informative enough
Lots of time and resources are invested in running an RCSA process. However, there is a perception that the process has become more of a tick-box exercise. Our survey highlighted that a considerable amount of time and effort has been spent setting up frameworks and policies and tooling. But, there seems to be a notable lack of success in using the RCSA to support decision-making. We found that while senior management does review and discuss RCSA information, it is not sufficiently used to influence business decisions and for proactively managing risk.
RCSA should also support the maintenance of an efficient and robust control environment. Our survey showed that this remains an area of weakness, with many institutions noting that RCSAs are not giving a clear view of control effectiveness.
3. The challenge of RCSA being inefficient
The RCSA can be labour-intensive and too procedure-focused. Some institutions have, or are trying to, move towards integrated and aligned risk assessment across their organisation. The 1st line would like to be able to complete assessments in a more holistic and streamlined fashion. A GRC tool that meets the needs of both the 2nd and 1st line would help address this.
Could you improve your RCSA process?
RCSA is one of the most important tools in a firm’s operational risk management and control framework. But are you making the most of RCSA? The RCSA practice benchmark can show you what you're doing right, and more importantly, where you could be doing better.
To get a customised benchmark showing your practice compared with the more than 70 leading financial firms that participated in the study, and to receive the full report analysing the findings from the survey, get in touch with Roland Kennett. You don't need to be a member of ORX to take part in a practice benchmark, and prices start from as little as £2,000.