Skip to content

Risk Assessments (RCSA)

Where to find it: Risk Management, then RCSA (/rcsa).

A Risk and Control Self-Assessment campaign runs control assessment at scale: a defined population of controls, assessed by their owners, within a defined period.


What a campaign is for

Individual control assessments work well for a handful of controls. A campaign is what you need when 280 control owners each have to assess their controls in the same six-week window and someone has to know who has not started.

A campaign provides scope, progress and completion for the whole exercise.


Campaign lifecycle

StageWhat happens
DraftDefine the population of controls, the owners, the period and the assessment type
ActiveAssessments are created and routed to owners through the Workbench
SyncScope is refreshed to pick up controls added or removed since activation
ClosedThe campaign is complete; results are frozen for reporting

Scoping a campaign

Scope by what you are trying to learn.

Scoping approachUse when
By business unitAssessing operational risk within a division
By control categoryAssessing a control theme across the organisation
By frameworkPreparing for a certification or regulatory cycle
By risk ratingConcentrating effort on controls supporting high-rated risks
EverythingAn annual full-population cycle

Scope smaller than feels complete

A campaign covering 400 controls with a 40% completion rate tells you less than one covering 120 controls with 95% completion. Assessment quality falls sharply once owners feel the exercise is unmanageable.


Running a campaign

  1. Create the campaign in draft with its period and assessment type.
  2. Define the scope of controls and confirm each has an owner. Controls with no owner have nobody to assess them, and this is the point at which that becomes visible.
  3. Activate. Assessments are created and appear in owners' Workbenches with notifications.
  4. Monitor progress. The campaign view shows completion by owner and by business unit.
  5. Review submissions. Each assessment goes through its own review chain, with the assessor unable to approve their own work.
  6. Close when review is complete.

Requires rcsa.manage to create, activate, sync and close; rcsa.read to view.


What campaigns produce

Assessments — one per control in scope, each with a design and operating verdict.

Findings — deficiencies identified during assessment become findings with the source RCSA / Control Assessment, carrying that source's status vocabulary: open, remediating, closed. See Findings.

Coverage insight — which controls were assessed, which were not, and why.


Segregation of duties

Assessment review follows the same rule as everywhere else: the person who performed an assessment cannot approve it.

The break-glass override (assessment.review_self_override) exists but is off by default and granted to no system role. See Control Assessment.


Permissions

ActionPermission
View campaigns, scope and progressrcsa.read
Create, activate, sync and close campaignsrcsa.manage
Submit assessmentsassessment.submit
Review assessmentsassessment.review

All require the control_assurance entitlement.


Example

Campaign: H1 2026 Operational Risk RCSA.

ElementValue
Scope186 controls across four business units
Assessment typeDesign and operating effectiveness
PeriodSix weeks
Owners47

Progress at week 4:

Business unitControlsSubmittedReviewed
Retail Banking625841
Corporate Banking444439
Operations513122
Technology292927

Operations is behind. The campaign view makes that visible in week 4 rather than in week 7, and the reason turns out to be that eleven controls were assigned to a role that changed hands during the period.

Outcome at close:

ResultCount
Assessed effective128
Assessed partially effective44
Assessed ineffective11
Not assessed — no owner3

Findings raised: 55, from the partially effective and ineffective assessments.

The three unassessed controls are not counted as effective. They are reported as unassessed with the reason, which is what generates the action to assign owners before the next cycle.


Troubleshooting

"Controls in scope have no assessment." They have no owner. Assign owners before activation.

"Owners say they have not received anything." Check that the campaign is active and that owners hold the assessment permissions. Assessments appear in the Workbench, and notifications depend on notification configuration.

"Scope changed after activation." Use sync to refresh the population.

"An owner cannot approve their own assessment." Correct. Assessment review is independent.


OrviQ Enterprise Governance, Risk & Compliance Platform