Appearance
Risk Assessments (RCSA)
Where to find it: Risk Management, then RCSA (/rcsa).
A Risk and Control Self-Assessment campaign runs control assessment at scale: a defined population of controls, assessed by their owners, within a defined period.
What a campaign is for
Individual control assessments work well for a handful of controls. A campaign is what you need when 280 control owners each have to assess their controls in the same six-week window and someone has to know who has not started.
A campaign provides scope, progress and completion for the whole exercise.
Campaign lifecycle
| Stage | What happens |
|---|---|
| Draft | Define the population of controls, the owners, the period and the assessment type |
| Active | Assessments are created and routed to owners through the Workbench |
| Sync | Scope is refreshed to pick up controls added or removed since activation |
| Closed | The campaign is complete; results are frozen for reporting |
Scoping a campaign
Scope by what you are trying to learn.
| Scoping approach | Use when |
|---|---|
| By business unit | Assessing operational risk within a division |
| By control category | Assessing a control theme across the organisation |
| By framework | Preparing for a certification or regulatory cycle |
| By risk rating | Concentrating effort on controls supporting high-rated risks |
| Everything | An annual full-population cycle |
Scope smaller than feels complete
A campaign covering 400 controls with a 40% completion rate tells you less than one covering 120 controls with 95% completion. Assessment quality falls sharply once owners feel the exercise is unmanageable.
Running a campaign
- Create the campaign in draft with its period and assessment type.
- Define the scope of controls and confirm each has an owner. Controls with no owner have nobody to assess them, and this is the point at which that becomes visible.
- Activate. Assessments are created and appear in owners' Workbenches with notifications.
- Monitor progress. The campaign view shows completion by owner and by business unit.
- Review submissions. Each assessment goes through its own review chain, with the assessor unable to approve their own work.
- Close when review is complete.
Requires rcsa.manage to create, activate, sync and close; rcsa.read to view.
What campaigns produce
Assessments — one per control in scope, each with a design and operating verdict.
Findings — deficiencies identified during assessment become findings with the source RCSA / Control Assessment, carrying that source's status vocabulary: open, remediating, closed. See Findings.
Coverage insight — which controls were assessed, which were not, and why.
Segregation of duties
Assessment review follows the same rule as everywhere else: the person who performed an assessment cannot approve it.
The break-glass override (assessment.review_self_override) exists but is off by default and granted to no system role. See Control Assessment.
Permissions
| Action | Permission |
|---|---|
| View campaigns, scope and progress | rcsa.read |
| Create, activate, sync and close campaigns | rcsa.manage |
| Submit assessments | assessment.submit |
| Review assessments | assessment.review |
All require the control_assurance entitlement.
Example
Campaign: H1 2026 Operational Risk RCSA.
| Element | Value |
|---|---|
| Scope | 186 controls across four business units |
| Assessment type | Design and operating effectiveness |
| Period | Six weeks |
| Owners | 47 |
Progress at week 4:
| Business unit | Controls | Submitted | Reviewed |
|---|---|---|---|
| Retail Banking | 62 | 58 | 41 |
| Corporate Banking | 44 | 44 | 39 |
| Operations | 51 | 31 | 22 |
| Technology | 29 | 29 | 27 |
Operations is behind. The campaign view makes that visible in week 4 rather than in week 7, and the reason turns out to be that eleven controls were assigned to a role that changed hands during the period.
Outcome at close:
| Result | Count |
|---|---|
| Assessed effective | 128 |
| Assessed partially effective | 44 |
| Assessed ineffective | 11 |
| Not assessed — no owner | 3 |
Findings raised: 55, from the partially effective and ineffective assessments.
The three unassessed controls are not counted as effective. They are reported as unassessed with the reason, which is what generates the action to assign owners before the next cycle.
Troubleshooting
"Controls in scope have no assessment." They have no owner. Assign owners before activation.
"Owners say they have not received anything." Check that the campaign is active and that owners hold the assessment permissions. Assessments appear in the Workbench, and notifications depend on notification configuration.
"Scope changed after activation." Use sync to refresh the population.
"An owner cannot approve their own assessment." Correct. Assessment review is independent.