Charta is on Google Play: practise on the go. Get the app
Charta

Set out how operational risk is assessed, covering risk control self-assessments (RCSAs), scales for rating likelihood, and heatmaps.

FRM® Part II · Operational Risk and Resilience · Risk Measurement and Assessment · FRM2.ORR.4.b

The idea

A risk and control self-assessment (RCSA) has the business identify its risks and controls and rate the inherent risk before controls. It then judges how effective the controls are, and so arrives at residual risk, which is compared with appetite. Ratings use scales for likelihood and impact. Likelihood is best anchored on frequencies, such as once in one to five years, and impact on money bands, so that different assessors rate consistently. A heatmap plots likelihood against impact, with colour zones showing priority. Its weakness is that ratings are ordinal. Multiplying ranks does not give an expected loss, and equal scores can hide very different risks. Self-assessment also tends toward optimism, so the second line should challenge ratings against loss data and indicators.

A practice question

From the question bank, with the reason each wrong option is wrong.

In a risk and control self-assessment (RCSA), what does residual risk mean?

  1. The level of risk before any controls are applied, assuming a normal operating environment and no mitigation.Why not: Describes inherent risk, which is assessed before controls.
  2. The level of risk that remains after taking account of the effectiveness of existing controls. - correct
  3. The share of identified risks that management has decided to transfer through insurance.Why not: Confuses residual risk with risk transfer; insurance is only one possible mitigant.
  4. The risk that the RCSA process itself is completed late or incorrectly.Why not: Mistakes residual risk for the process risk of the RCSA exercise itself.

RCSAs rate inherent risk, assess control effectiveness, and derive residual risk. Management then compares residual risk with appetite to decide whether more action is needed.

A harder one

A firm rates likelihood on this scale: 1 Rare = less than once in 20 years; 2 Unlikely = once in 5 to 20 years; 3 Possible = once in 1 to 5 years; 4 Likely = between once a year and once a quarter; 5 Almost certain = more than four times a year. A manual payment error is expected 0.5 times a year. Which rating applies?

  1. 4, because 0.5 per year is a high number compared with the low numbers on the scale.Why not: Reads the 0.5 as a frequency larger than one a year; likely requires at least one event per year.
  2. 2, because the interval of two years is shorter than the 5 to 20 year band on the scale.Why not: Misplaces two years in the 5 to 20 year band; two years lies within the 1 to 5 year band.
  3. 5, because errors in manual processes should always receive the highest likelihood rating.Why not: Applies a blanket judgement instead of the scale's frequency anchors.
  4. 3, because 0.5 events a year means about one event every two years. - correct

Frequency of 0.5 a year = one event every 1 / 0.5 = 2 years, which sits in the 1 to 5 year band, rating 3. Anchoring the scale with frequencies makes ratings consistent across assessors.

The hardest tier

Business units' RCSA results rate nearly all risks as low or medium residual risk, yet the firm's loss data show repeated large losses in the same units. Which action most directly addresses the likely bias?

  1. Expand the scales from five to ten levels so that assessors can express more precise views.Why not: Adds false precision; more levels do not remove optimism bias in the underlying judgements.
  2. Ask each risk owner to repeat the self-assessment more frequently and sign it off personally each time.Why not: Repeats the same biased self-assessment more often without independent challenge or evidence.
  3. Replace likelihood-impact scoring with a single overall rating from internal audit.Why not: Discards the structured RCSA; audit is a third-line assurance function, not a substitute for the assessment.
  4. Introduce second-line challenge calibrated against loss data, KRIs and scenario analysis. - correct

Self-assessments tend toward optimism. Second-line challenge and cross-checking against objective evidence (losses, indicators, scenarios) is the standard remedy; finer scales or repetition do not remove the bias.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Risk Measurement and Assessment