ControlPoint RCSA

✓ RCSA framework operating within configured methodology Residual risks, control effectiveness and actions are recalculated automatically.

Risk records 0 Across business processes

High & critical residual 0% Outside or near appetite

Control effectiveness 0% Average combined rating

Overdue actions 0 Require attention

Residual risk distribution

Current portfolio classification

RCSA register

Risk events, controls and accountable actions

Business process / risk	Inherent	Control	Residual	Appetite	Owner	Action due

Risk and control self-assessment

Capture the risk event, controls, residual exposure and treatment.

RCSA v1.0

Context

Business unit Process Risk ID Risk owner Risk event Risk category Risk appetite

Inherent risk

Likelihood Impact Inherent risk rationale

Key control

Control description Control type Frequency Design effectiveness Operating effectiveness Control evidence / test result

Treatment and action

Treatment Action due date Management action

LIVE RISK VIEW

9 / 25

Moderate

CONFIGURABLE METHODOLOGY

Transparent residual-risk calculation

Inherent risk is likelihood × impact. Control effectiveness combines design and operating effectiveness. Residual risk applies the configured control-reduction curve, while risk appetite determines whether treatment or escalation is expected.

Inherent score Likelihood × Impact Control score (Design × weight) + (Operation × weight) Residual score Inherent × control reduction factor

Governance note

This is a configurable framework, not a validated regulatory model. Your operational-risk and model-risk functions should approve definitions, calibration, evidence standards and governance before production use.

Model configuration

Adjust control weighting and residual thresholds

Design effectiveness weight Operating effectiveness weight

Residual score thresholds

Moderate starts at High starts at Critical starts at

5×5 inherent-risk matrix

Likelihood by impact

↑

Import RCSA records

Upload CSV, XLS or XLSX. Known headers map automatically; unmapped values are flagged.

API INGESTION & CALLS

Connect a risk data source

Fetch JSON arrays, test a connection, or POST computed RCSA results.

Endpoint URL Bearer token (optional) JSON array path (optional)

Expected fields

Use the template for predictable ingestion.

id, businessUnit, process, riskEvent, category, owner, likelihood, impact, design, operation, appetite, controlDescription, treatment, action, actionDue