Skip to content

FRM Exam Part II · Risk Identification

Risk and Control Self-Assessment (RCSA) for FRM Part 2

Updated 11 October 2026 · Fact-checked

RCSA is a process where business units identify their own operational risks, rate them for likelihood and impact, assess the controls that mitigate them, and derive residual risk (inherent risk after controls). To solve exam questions, separate inherent from residual risk, test control effectiveness, and watch for bias and subjectivity.

Understand Risk and Control Self-Assessment (RCSA)

Risk and Control Self-Assessment (RCSA) is a tool in the operational risk framework. The people who run a business process, the first line of defense, list what could go wrong, rate how bad it could be, and judge how well their controls work. The second line, operational risk management, sets the method, challenges the ratings and aggregates the results.

The key idea is the split between two ratings. Inherent risk is the exposure before any controls are considered. Residual risk is what remains after the controls are applied. The gap between them shows how much the controls are doing. A high inherent risk with a weak control leaves a high residual risk, and that is where action is needed.

Each risk is usually scored on likelihood and impact, often on a scale such as 1 to 5, and mapped to a rating such as low, medium, high or critical. Controls are rated on design effectiveness (would it work if followed?) and operating effectiveness (does it actually work in practice?). A control can be well designed but poorly operated, and both matter.

RCSA is forward looking and uses business knowledge, which is its main strength. It builds ownership of risk, covers risks with little loss history, and feeds action plans, risk appetite monitoring and capital discussions. Its weaknesses are subjectivity, optimism bias, anchoring on past events, inconsistent scales across units, and low engagement when it becomes a tick-box exercise. Because it is self-reported, it needs challenge, and it works best alongside loss event data, key risk indicators (KRIs), scenario analysis and audit findings.

Key formulas to remember

Residual risk (conceptual)
Residual risk = Inherent risk after the effect of controls
A qualitative relationship, not a precise calculation. Better controls lower residual risk. Inherent risk itself does not change.
Risk score (common scoring convention)
Risk score = Likelihood score × Impact score
One common convention. Some firms use matrices or add instead. Use the method the question gives.
Control effectiveness
Overall control effectiveness = judgement of design effectiveness and operating effectiveness together
A control must be both well designed and working in practice to be rated effective.
Control reduction (illustrative)
Residual score = Inherent score × (1 − control effectiveness %)
Illustrative only. Many firms apply this style of adjustment but it is not a prescribed Basel formula.

How to solve Risk and Control Self-Assessment (RCSA) questions

Use this order for any RCSA question, whether it asks for a rating, a definition or a critique.

  1. 1Identify the business process and the risk event, with its cause and its effect.
  2. 2Rate the inherent risk first, assuming no controls, using likelihood and impact.
  3. 3List the controls linked to the risk and judge both design and operating effectiveness.
  4. 4Derive the residual risk from the inherent risk and the control effectiveness.
  5. 5Compare residual risk with risk appetite or tolerance to decide whether action is needed.
  6. 6Choose the response: accept, reduce through better controls, transfer (for example insurance) or avoid.
  7. 7Check for bias and subjectivity, and say what would challenge the ratings, such as loss data, KRIs or scenario analysis.

Quickest way: Inherent, control, residual, challenge

When to use it: Use for multiple-choice questions that give a short case and ask which rating, conclusion or weakness is correct.

  1. Underline whether the question asks about inherent or residual risk.
  2. If inherent, ignore every control mentioned.
  3. If residual, ask which controls actually operate, not just exist.
  4. Eliminate options that treat self-assessment as objective or as a replacement for loss data.
  5. Pick the option that matches the Basel-style principle: self-assessment needs independent challenge.

Common mistakes in Risk and Control Self-Assessment (RCSA)

  • Rating inherent risk after considering controls

    Candidates mix the two ratings because controls are described in the same case.

    Fix: Rate inherent risk first as if no controls existed. Only then apply controls to reach residual risk.

  • Treating a control as effective because it exists

    Candidates focus on design and ignore whether it is followed.

    Fix: Always test both design and operating effectiveness. A control that is not performed gives little risk reduction.

  • Assuming RCSA is objective

    Numerical scores look precise.

    Fix: Remember the ratings are judgements, open to optimism bias, anchoring and inconsistent scales. They need independent challenge.

  • Saying RCSA replaces loss data or KRIs

    Candidates see it as the main identification tool.

    Fix: RCSA complements loss data, KRIs and scenario analysis. Each tool covers gaps in the others.

  • Believing controls change inherent risk

    The word risk is used loosely.

    Fix: Controls reduce residual risk only. Inherent risk is defined before controls.

  • Ignoring risk appetite in the conclusion

    Candidates stop at the rating.

    Fix: Compare residual risk to appetite or tolerance. Action is needed when it is above.

Worked examples

Example 1

A payments unit rates the risk of erroneous USD wire transfers as inherent score 20 (likelihood 4 × impact 5). It judges its dual-approval control to be 60% effective. Using the illustrative approach Residual = Inherent × (1 − effectiveness), what is the residual score, and what should the risk manager check?

Show the solution
  1. Inherent score = 4 × 5 = 20.
  2. Control effectiveness = 60% = 0.60, so 1 − 0.60 = 0.40.
  3. Residual score = 20 × 0.40 = 8.
  4. The 60% figure is a self-assessed judgement, so check operating effectiveness, for example whether approvers actually review each payment.
  5. Compare the score of 8 with risk appetite and challenge the rating against loss events and KRIs such as payment error counts.

Answer: Residual score = 8. The risk manager should test that the control operates as designed and challenge the self-assessed 60% against loss data and KRIs.

Example 2

A trading operations team rates a settlement failure risk as low residual risk. Its controls are well designed, but recent audit testing shows reconciliations were skipped for three months. Which conclusion is best supported, and which bias may be present?

Show the solution
  1. Design effectiveness is good because the controls are well designed.
  2. Operating effectiveness is weak because reconciliations were not performed.
  3. A control that is not operating gives little real mitigation, so the low residual rating is not supported.
  4. The team likely showed optimism bias, rating the controls by design rather than by performance.
  5. The rating should be revised upward and the issue given an action plan and owner.

Answer: The low residual rating is not supported. Operating effectiveness is weak, so residual risk should be rated higher, and the original rating likely reflects optimism bias.

Exam tips

  • Read whether the question asks for inherent or residual risk before doing anything else.
  • Expect cases where a control exists but is not working. The answer is usually a higher residual risk.
  • For limitations questions, name subjectivity, bias, inconsistent scales and lack of independent challenge.
  • Know how RCSA fits with loss data, KRIs and scenario analysis. Questions often ask which tool fills which gap.
  • Do not expect a prescribed formula. Use the scoring approach given in the question.

Practice questions from Risk Identification

Risk and Control Self-Assessment (RCSA) in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Risk and Control Self-Assessment (RCSA): frequently asked questions

What is the difference between inherent risk and residual risk?

Inherent risk is the exposure before any controls are applied. Residual risk is what remains after controls. If controls are weak or not operating, residual risk stays close to inherent risk.

Who performs an RCSA?

The business unit that owns the process, the first line of defense, performs it. The operational risk function in the second line sets the method, challenges the results and consolidates them.

What are the main limitations of RCSA?

It is subjective and can be affected by optimism bias, anchoring and inconsistent rating scales. It can also become a tick-box exercise. Independent challenge and cross-checks with loss data, KRIs and scenarios reduce these problems.

Is there a formula for residual risk in the FRM exam?

There is no single prescribed formula. Residual risk is conceptually inherent risk after controls. If a question gives a scoring method, apply that method exactly.