Register

Session Descriptions

RCSA in Practice: Starting Strong, Scaling Smart, and Sustaining Value

Wednesday, August 26, 2026

11:15 a.m. to 12:30 p.m.

Risk and Control Self-Assessments (RCSAs) are a cornerstone of an effective risk management framework—but the path from concept to sustainable practice looks different for every organization. In this session, two practitioners share complementary perspectives: one representing a program preparing to launch its first formal RCSA cycle, and the other from an organization already embedded in the RCSA journey.

Together, the presenters will explore how early design decisions, stakeholder engagement, and governance structures shape long-term outcomes. The discussion will highlight common challenges faced at different stages—such as defining scope, avoiding "check-the-box" assessments, aligning RCSA outputs with decision-making, and maintaining momentum over time.

Rather than focusing on a single "right way," this session emphasizes practical lessons learned, tradeoffs encountered, and strategies that scale as programs mature. Attendees will leave with actionable insights they can apply immediately—whether they are standing up their first RCSA, refining an existing program, or looking to extract more value from current assessments.

LEARNING OUTCOMES:

  1. Understand the foundational decisions that matter most early in an RCSA program. Identify key design choices—such as scope, assessment units, risk taxonomy, and ownership—that influence scalability and sustainability over time.
  2. Recognize how RCSA challenges evolve across maturity stages. Compare common pain points for organizations starting RCSAs versus those further along, and understand how solutions must adapt as programs grow.
  3. Apply practical strategies to drive meaningful engagement from the first line. Learn techniques to position RCSA as a value add exercise that supports business objectives, rather than a compliance burden.
  4. Translate RCSA results into actionable risk insights. Explore ways to connect inherent and residual risk assessments, control effectiveness, and issues management to real decision-making and prioritization.
  5. Strengthen governance and continuous improvement across RCSA cycles. Identify approaches for refining methodologies, calibrating assessments, and using RCSA outcomes to inform broader risk management and oversight.