The anatomy of a weak RCSA

A strong Risk and Control Self-Assessment (RCSA) is one of the clearest signals of whether a firm actually understands its operational risks or is simply documenting them. When regulators challenge a firm, the scrutiny almost always traces back to the same root cause: the RCSA was not credible, evidence-based, or connected to how the business actually works.

That is why the RCSA sits at the centre of operational and financial resilience, SMCR accountability, conduct and Consumer Duty, and financial crime prevention. It is the foundation on which every other part of the risk framework stands.

Why the RCSA matters

Regulators expect firms to demonstrate ownership, evidence and challenge. A weak RCSA undermines resilience planning, scenario testing, financial crime controls and board decision-making. When the RCSA is superficial, the entire risk framework becomes fragile.

Common RCSA failures

Across banks, insurers, investment firms and brokers, the same issues appear again and again:

• Generic risks with no context or time horizon.
• Residual risk always green, regardless of evidence or incidents.
• No linkage to real events such as incidents, complaints or audit findings.
• No meaningful challenge from the second line.

These weaknesses create blind spots that only surface when something breaks, and they undermine the firm's financial and operational resilience.

What “good” looks like in financial services

High-quality RCSAs share a set of characteristics:

• Clear ownership at both SMF and process-owner level.
• Traceability from process to risk to control to evidence to residual risk.
• Quantified impacts aligned to risk appetite and tolerance.
• Evidence-based control assessments, not optimistic scoring.
• Independent challenge from risk and audit.
• Integration with reality: incidents, KRIs, complaints, audit findings and change programmes all feed into the assessment.

When these elements come together, the RCSA becomes a living model of how the business operates, where it is vulnerable and what needs to improve.

The shift happening now

Firms are moving away from static spreadsheets and towards dynamic, data-driven RCSAs that connect risks, controls, evidence and incidents in real time. Operational resilience requirements and SMCR accountability are accelerating this shift.

A strong RCSA is no longer a compliance exercise. It is the backbone of resilience, accountability and trust.