Advanced Risk and Control Self-Assessment and Control Effectivenessfor Financial Institutions

Objective: Moving beyond generic risk lists to identify how processes can fail, why they may fail and the potential impact on a financial institution.

• Apply process mapping, incidents, near misses, complaints, audit findings and business changes to identify material operational risk exposures.
• Develop meaningful risk statements by distinguishing causes, risk events and consequences, including related conduct and compliance impacts.
• Assess likelihood and impact across financial loss, customer harm, service disruption and regulatory consequences using informed judgement.
• Identify key people, process, system, data, technology and third-party dependencies that may increase operational risk exposure.
• Translate relevant BNM expectations into practical risk and control considerations across banking, insurance and takaful operations.

Case study and practical exercise: Examine a financial institution process to identify material operational risks, dependencies and control concerns. Develop clear risk statements and begin building the risk assessment that will be progressively used throughout Day One.

Objective: Creating an RCSA that the business can own, Risk can effectively challenge and reviewers can understand and defend.

• Define appropriate RCSA scope, boundaries and assessment granularity while avoiding duplicated risks and gaps between processes.
• Establish clear risk and control ownership, review responsibilities and accountability across the first line, second line and independent assurance.
• Assess inherent risk consistently and challenge assumptions and inconsistent ratings across comparable risks and processes.
• Link risks to key controls, incidents, KRIs, issues, regulatory obligations and other relevant information to support evidence-based assessment.
• Maintain the RCSA as a dynamic risk management tool by identifying material incidents, product, process, system or outsourcing changes that should trigger reassessment.

Case study and practical exercise: Building on Module 1, develop the RCSA, assess inherent risks, identify key controls and challenge inconsistent assumptions and ratings using relevant BNM expectations.

Objective: Moving beyond confirming that a control exists to determine whether it appropriately addresses the risk and operates effectively in practice.

• Establish clear control objectives, ownership, frequency, evidence and escalation requirements so that controls can be meaningfully assessed.
• Evaluate whether preventive, detective, manual, automated and compensating controls are appropriately designed to address the identified risk.
• Assess operating effectiveness using evidence and distinguish reliable control execution from policies, procedures, training or management assertions.
• Identify weaknesses arising from overrides and dependencies on people, access, systems, configuration and data quality.
• Determine whether control effectiveness supports the residual risk rating without mechanical rating reductions or double-counting related controls.

Case study and practical exercise: Assess key controls within the continuing RCSA scenario, examine available evidence and determine whether the control-effectiveness and residual-risk conclusions can be supported and defended.

Objective: Creating an RCSA that the business can own, Risk can effectively challenge and reviewers can understand and defend.

• Define appropriate RCSA scope, boundaries and assessment granularity while avoiding duplicated risks and gaps between processes.
• Establish clear risk and control ownership, review responsibilities and accountability across the first line, second line and independent assurance.
• Assess inherent risk consistently and challenge assumptions and inconsistent ratings across comparable risks and processes.
• Link risks to key controls, incidents, KRIs, issues, regulatory obligations and other relevant information to support evidence-based assessment.
• Maintain the RCSA as a dynamic risk management tool by identifying material incidents, product, process, system or outsourcing changes that should trigger reassessment.

Case study and practical exercise: Building on Module 1, develop the RCSA, assess inherent risks, identify key controls and challenge inconsistent assumptions and ratings using relevant BNM expectations.

Objective: Bringing together risk identification, assessment and control evaluation to complete and defend an RCSA under structured challenge.

• Establish clear control objectives, ownership, frequency, evidence and escalation requirements so that controls can be meaningfully assessed.
• Evaluate whether preventive, detective, manual, automated and compensating controls are appropriately designed to address the identified risk.
• Assess operating effectiveness using evidence and distinguish reliable control execution from policies, procedures, training or management assertions.
• Identify weaknesses arising from overrides and dependencies on people, access, systems, configuration and data quality.
• Determine whether control effectiveness supports the residual risk rating without mechanical rating reductions or double-counting related controls.

Case study and practical exercise: Finalise the RCSA progressively developed through Modules 1–3 and defend key risk, control and residual-risk conclusions through structured peer challenge.

Objective: Bringing together risk identification, assessment and control evaluation to complete and defend an RCSA under structured challenge.

• Prioritise key controls for testing using risk exposure, incidents, significant changes, previous findings and the strength of existing assurance.
• Define clear test objectives, populations, testing periods, evidence requirements and assessment criteria.
• Select appropriate testing techniques, including walkthrough, inspection, observation, reperformance and data analysis according to the control objective.
• Apply proportionate risk-based sampling and understand the limitations of judgemental sampling when drawing control-effectiveness conclusions.
• Assess automated and technology-dependent controls and determine when third-party assurance is sufficient or additional institution-level testing is required.

Case study and practical exercise: Design tests for selected key controls, develop practical test steps and evidence requirements, and justify the testing and sampling approach.

Objective: Turning control-testing evidence and exceptions into defensible conclusions about whether controls are operating effectively and whether residual risk remains appropriately assessed.

• Validate the completeness, relevance, reliability and timeliness of testing populations and supporting evidence before drawing conclusions.
• Execute and document testing so that the work performed, evidence examined and basis for conclusions can be independently understood and reviewed.
• Distinguish missing evidence, failed control execution and weaknesses in control design when analysing testing exceptions.
• Determine whether exceptions are isolated or potentially systemic and when further investigation or expanded testing is warranted.
• Assess the implications of testing results for control effectiveness, residual risk, remediation and escalation.

Case study and practical exercise: Examine control-testing evidence and exceptions, assess their significance and reach a defensible conclusion on control effectiveness and its implications for residual risk.

Objective: Turning identified control weaknesses into clear findings and remediation actions that address underlying causes and deliver sustainable risk reduction.

• Develop clear findings that explain the control weakness, underlying cause, risk impact and implications for the relevant control objective.
• Prioritise deficiencies according to actual risk exposure and urgency rather than exception count alone.
• Develop remediation actions that address root causes with accountable owners, realistic timelines and appropriate interim safeguards.
• Establish measurable closure criteria and distinguish completion of an action from evidence that the control is operating effectively and risk has been reduced.
• Strengthen governance over overdue actions, repeated extensions and risk acceptance, with appropriate escalation of significant or recurring weaknesses.

Case study and practical exercise: Challenge a proposed response to a recurring control failure and develop a practical remediation plan with clear ownership, interim safeguards and evidence required to demonstrate effective closure.

Objective: Translating RCSA and control-testing results into meaningful risk information that enables senior management and the Board to understand the organisation's operational risk profile and exercise effective oversight.

• Integrate material RCSA and control-testing results with relevant incidents, loss data, KRIs, control indicators and risk appetite information to develop a consolidated view of operational risk.
• Identify material changes in risk exposure, significant control weaknesses, recurring issues and overdue remediation requiring management or Board attention.
• Distinguish detailed operational information required by business and risk owners from information appropriate for senior management and Board oversight.
• Apply materiality and judgement to determine what should be reported, how much detail is appropriate and what matters require escalation or decision.
• Translate detailed RCSA information into concise management and Board reporting that highlights significant exposures, risk trends, control concerns, remediation status and decisions required.

Case study and practical exercise: Prepare a concise senior management or Board-level risk briefing using RCSA and control-testing information. Determine what should be escalated, the appropriate level of detail and the management or Board attention or decision required.