Module: | MODULE B: RISK MANAGEMENT
Q412: Consider the following statements regarding the Risk and Control Self-Assessment (RCSA) process:
1. RCSA is a forward-looking, subjective assessment process conducted primarily by the business units to identify inherent operational risks.
2. The RCSA process relies exclusively on historical loss data and automated quantitative models to determine future risk capital.
3. Through RCSA, business units evaluate the design and operational effectiveness of internal controls to determine the residual risk.
Which of the statements given above is/are correct?
2. The RCSA process relies exclusively on historical loss data and automated quantitative models to determine future risk capital.
3. Through RCSA, business units evaluate the design and operational effectiveness of internal controls to determine the residual risk.
Which of the statements given above is/are correct?
✅ Correct Answer: B
The correct answer is B. Statement 1 is correct: Risk and Control Self-Assessment (RCSA) is a core qualitative tool in operational risk management.
It is a forward-looking, subjective exercise driven by the business units (First Line) to brainstorm and identify potential inherent risks in their processes before losses actually occur.
Statement 2 is incorrect: RCSA does not rely on quantitative models or exclusively on historical data.
That describes the Loss Data Collection (LDC) methodology.
RCSA is fundamentally a qualitative, expert-judgment-based tool where staff assess what "could" go wrong, not just what mathematically did go wrong in the past.
Statement 3 is correct: The fundamental equation of RCSA is mapping Inherent Risk against the effectiveness of existing internal controls.
Business units assess how well controls are designed and operating to arrive at the 'Residual Risk' (Inherent Risk minus Control Effectiveness).
Therefore:
Option A is incorrect because Statement 2 is false.
Option B is correct as both Statement 1 and 3 are true.
Option C is incorrect because Statement 2 is false.
Option D is incorrect because Statement 2 is false.
It is a forward-looking, subjective exercise driven by the business units (First Line) to brainstorm and identify potential inherent risks in their processes before losses actually occur.
Statement 2 is incorrect: RCSA does not rely on quantitative models or exclusively on historical data.
That describes the Loss Data Collection (LDC) methodology.
RCSA is fundamentally a qualitative, expert-judgment-based tool where staff assess what "could" go wrong, not just what mathematically did go wrong in the past.
Statement 3 is correct: The fundamental equation of RCSA is mapping Inherent Risk against the effectiveness of existing internal controls.
Business units assess how well controls are designed and operating to arrive at the 'Residual Risk' (Inherent Risk minus Control Effectiveness).
Therefore:
Option A is incorrect because Statement 2 is false.
Option B is correct as both Statement 1 and 3 are true.
Option C is incorrect because Statement 2 is false.
Option D is incorrect because Statement 2 is false.