An RCSA completed in January tells you almost nothing about the risk environment in November, yet a large share of programs still treat it as a once-a-year exercise. Regulators have started saying so directly, and the shift toward continuous, evidence-based self-assessment is no longer just a best practice recommendation sitting in an advisory document somewhere.
What Is RCSA in Operational Risk Management?
RCSA, or Risk and Control Self-Assessment, is the process by which business units evaluate their own operational risks and the effectiveness of the controls meant to manage them, typically through structured questionnaires or facilitated workshops.
Within operational risk management, RCSA is the primary mechanism for capturing risk data directly from the people closest to a process, rather than relying solely on an external audit view.
RCSA's Place in the Three Lines of Defense
RCSA output is only as credible as the governance structure around it, and that structure runs through all three lines of defense, each with a distinct role.
First line ownership
Business unit and process owners complete the self-assessment, since they hold the operational knowledge of where a process actually strains or where a workaround has quietly become the normal way of doing things.
Second line facilitation
Risk or compliance functions set the RCSA methodology, facilitate workshops, and challenge overly optimistic self-ratings. Their independence from day-to-day process ownership is what keeps the assessment honest rather than becoming a formality the business fills out to check a box.
Third line assurance
Internal audit tests whether RCSA results hold up against actual evidence as part of a broader operational audit risk assessment, providing the independent check that gives the whole exercise credibility with external regulators.
Why DORA and CPS 230 Are Pushing RCSA Toward Continuous Monitoring
Two current regulatory frameworks illustrate the shift away from static, annual RCSA. The EU's Digital Operational Resilience Act, in force since January 2025, requires financial entities to maintain an ongoing, current view of ICT and third-party risk rather than a point-in-time snapshot revisited once a year. [Source: European Union, Digital Operational Resilience Act, effective January 2025] Australia's APRA CPS 230 standard follows a similar logic, expecting institutions to demonstrate operational resilience on a continuing basis, not through an annual attestation exercise alone.
The practical effect is that an RCSA completed in isolation, disconnected from real-time monitoring data, increasingly fails to meet what regulators expect a mature program to demonstrate. Self-assessment still matters. It just cannot be the only input feeding the risk register anymore.
Loss Events and KRI Thresholds as RCSA Inputs
A modern RCSA does not stand alone. Loss event data, actual incidents that materialized, should feed back into the next self-assessment cycle as evidence that either confirms or contradicts what business owners rated as low risk. If a process was self-assessed as low risk but generated three loss events in the same period, that gap is itself a finding worth escalating.
Key risk indicator thresholds work the same way. When a KRI crosses its defined threshold between formal RCSA cycles, that breach should trigger an interim reassessment rather than waiting for the next scheduled review, closing the gap that static, calendar-driven RCSA cycles leave open.
How ComplyScore® Supports Continuous RCSA
ComplyScore®'s Self-Assessment module structures RCSA around documented policy coverage, defined roles and RACI, and standing oversight committees, so the process runs as governed workflow rather than a periodic form-filling exercise within a broader operational risk management platform. Continuous monitoring feeds loss events and KRI breaches directly into the same system that houses RCSA results, giving second-line reviewers a way to check self-assessment ratings against what is actually happening in real time.
Because inherent and residual risk scores are tracked continuously rather than only at RCSA checkpoints, a threshold breach can trigger an interim reassessment automatically instead of waiting for the next scheduled cycle.
See how ComplyScore® supports continuous RCSA. Book a demo
.webp?width=387&height=387&name=image%20(5).webp)
%20(1).jpg)
