Conduct RCSA Campaigns

This guide explains how Risk Managers launch and oversee Risk and Control Self-Assessment (RCSA) campaigns (/rcsa).

---

Step 1: Creating an RCSA Campaign

1. Navigate to Risk Management > RCSA Campaigns (/rcsa).
2. Click + New Campaign.
3. Configure campaign parameters:
   • Campaign Title: E.g., Annual IT & Cybersecurity RCSA 2026.
   • Target Units / Departments: Select participating business units.
   • Controls & Risks in Scope: Filter by risk category or domain.
   • Submission Deadline: Set target completion date.
4. Click Launch Campaign. Notification emails and workbench tasks are automatically generated for all assigned control and risk owners.

---

Step 2: Completing Self-Assessments

1. Business unit owners receive tasks in their My Work queue (/my-work).
2. Owners rate inherent risk exposure, assess control operational health, attach recent evidence, and record known operational incidents.
3. Once complete, owners click Submit Assessment.

---

Step 3: Review & Triage

1. The Risk Manager reviews submitted campaign items.
2. The Risk Manager can approve submissions, request revisions, or promote identified gaps into new Findings (/findings).