A risk and control self-assessment run as an interview: agents draft every rating from cited evidence, a Challenger checks it for the second line, and people sign
Every risk rating grounded in the incidents, losses and tests behind it, then signed.
See one case, screen by screen ↓A risk and control self-assessment (RCSA) is how each business line rates its own operational risks and the controls over them: inherent risk, control effectiveness and residual risk. Risk & Control Self-Assessment (RCSA), the solution, runs it as an interview, one risk at a time. Agents draft every rating from the year's incidents, losses, control tests, findings and key risk indicators, each fact cited; the process owner accepts, changes or asks, a Challenger agent checks it for the second line, and the ERM Officer signs.
AI use cases in banking: a buyer's guide to agentic AI for bank and credit union operations →
Updated
A risk and control self-assessment (RCSA) is how every business line rates its own operational risks and the controls over them, once a year and again when things change. Today the process owner fills a form or a spreadsheet in an afternoon. The year's incidents, loss postings, failed control tests, audit findings and key risk indicators sit in five systems nobody opens at rating time, so ratings drift positive and rarely match the losses. The same risk is rated High by one unit and Low by another, and a loss a week after signing waits a year for the next cycle.
The second line spends the cycle chasing owners instead of challenging ratings on evidence, and challenge sessions argue about opinions because the evidence is not on the table. Risk & Control Self-Assessment (RCSA) turns each rating into a short interview: the agents read the year's evidence first, the agent speaks first with a cited proposal, and the owner accepts it, changes it with a reason, or asks. A Challenger agent checks every rating for the second line, and the ERM Officer signs every change.
Estimated split of the owner's and the second line's minutes for one risk, by hand and with the agents. The 'after' column totals about 20 minutes, the target the working solution is designed to; our arithmetic, kept modest.
Agents gather the year's evidence and propose each rating, cited; a Challenger checks it; owner and ERM Officer sign.
Debit card fraud is risk 9 of 14 for Card Services at Norrell Federal Credit Union, a fictional $6.8 billion credit union with 520,000 members. Last year it was rated Moderate inherent, Effective control, Low residual. Here is what happens to it in the 2026 cycle, screen by screen, in the working solution.
The 2026 annual RCSA opened October 1; owner interviews are due October 30, ERM review November 13 and the Risk Committee December 10. Naomi sees four numbers: 98 of 186 risks signed, 41 awaiting her, 8 open challenges and 47 still with owners. Under them, progress for each of the 14 business units and a short briefing from the agents.
23 ratings disagreed with their evidence; debit card fraud losses rose from $176,200 to $389,400.
For the evidence window October 1, 2025 to September 30, 2026, the Evidence agent read 214 incidents with member details masked, matched 1,186 postings in general ledger account 5410-220, read 12 months of KRI-CS-03, three control tests and one audit finding. The Prefill agent scored them on the credit union's rating scale v4 and residual matrix, with confidence 0.91.
Dana Whitfield, VP Card Services, opens My RCSA on risk 9 of 14. There is no form: the agent opens with last year's rating, what happened since and its proposal, High inherent risk, a control that needs improvement and High residual risk, above the appetite of Moderate or lower. She has three choices: Accept, Change with reason, or Ask.
Since then: 214 incidents, $389,400 in gross losses, a red KRI in August, one failed control test and one audit finding.
Dana clicks the gross loss. The source opens with the value highlighted: general ledger 5410-220, 1,186 postings, gross loss $389,400 against $176,200 the year before, recoveries of $121,800 posted to 5410-221, net loss $267,600, and a link into the general ledger.
Monthly gross loss runs against the key risk indicator's bands: August reached $48,900, over the $40,000 red line. The largest incident, INC-2026-08812, was a card-not-present ring across 31 cards, $22,860. The monthly velocity rule review failed its July 14 test, two of six months not evidenced, and internal audit finding IA-2026-031 is open.
Dana knows something the draft could not credit. She changes control effectiveness from Needs improvement to Partially effective with reason R1, new or improved control since the evidence window, and attaches the rule change CHG-2026-0918 and the retest CT-2026-1006. Residual risk recalculates before she sends it: High with Partially effective is Moderate.
"VR-22 went live September 18; the September review was done with a second approver, and Card Fraud QA retested it October 6."
The Challenger agent tests the change against rule C-02: the control failed on July 14 and passed an independent retest on October 6, which supports Partially effective but not Effective. It sets a retest for January 8, 2027 and keeps action plan AP-2026-118 open. Residual risk is now Moderate, within appetite, and the change goes to Naomi Brandt at 10:15 AM.
Accepted: Partially effective, not Effective.
Naomi sees last year's rating, the agents' proposal and the owner's rating side by side, with Dana's reason, the evidence and the Challenger's verdict. Viewed as Dana, the Sign button is disabled: no one signs a rating they made. Naomi signs; she could also return it with a reason code or escalate it to the Risk Committee.
Signed by Naomi Brandt at 10:31 AM. The rating is final for the 2026 cycle and on the audit trail.
AP-2026-118 covers the monthly velocity rule review, owned by Dana and due December 31, 2026. It is linked to issue ISS-2026-0418 and answers finding IA-2026-031. One of three steps is done; internal audit validates it after three clean months.
Every step, by people and by agents, is on the audit trail with the reason and the evidence: 2,418 entries this cycle. Naomi builds the pack for NCUA examiners, 186 assessments with a manifest and SHA-256 hash, with member names and account numbers masked and SAR-related evidence counted, never listed.
The same 2026 cycle, seen by four of the people who run it, from the process owner to the board: what their RCSA looked like, and what it looks like now.
Agents gather the year's evidence and propose each rating, cited; a Challenger checks it; owner and ERM Officer sign.
Gathers each risk's incidents, general ledger losses, recoveries, control tests, findings and KRIs for the evidence window, and masks member details.
Scores likelihood and impact, rates control effectiveness from tests and findings, applies the residual matrix, and cites every fact.
Runs the conversation with the process owner one risk at a time and answers questions with citations.
Acts for the second line: tests every proposal and every owner change against rules C-01 to C-07.
Drafts action plans for controls rated Needs improvement or Ineffective, linked to the issue register.
Proposes new risks from unmapped incidents, merges duplicate controls and retires unused ones.
Runs the calendar, reminders, SLAs and escalations, and reopens a signed rating when its evidence moves.
Drafts the Risk Committee memo, the appetite comparison and the export packs.
The owner rates, a different person signs. The agents propose; a named person decides.
Ask about any risk, rating, challenge or deadline in the 2026 cycle, or say what to prepare. Every answer cites the incident, loss, test or finding behind it and opens the screen where you can act.
Which ratings disagree with the evidence?
Eight open challenges. Three on fraud risks: indirect auto dealer fraud, rated Moderate with three losses over $25,000; wire transfer fraud, control rated Effective after a failed callback test; account takeover through password reset, rated Low where peer units rate it High.
Why is debit card fraud rated High inherent?
Likelihood 5 and impact 3 on scale v4: 214 incidents and $389,400 in gross losses, up from 151 and $176,200 last year.
Why High, and not Critical?
Critical needs a score of 20 or more: likelihood 5 with impact 4, meaning an annual gross loss over $1 million or a single event over $100,000. The largest event was $22,860 and the year $389,400, so impact is 3 and the score 15: High.
Who is behind, and what escalates next?
Third-Party Risk has not started its 10 risks; the Cycle agent escalates to the ERM Officer on Monday, October 26. Payments and Information Technology have 5 and 6 risks left, due Friday, October 30.
13 screens from the working solution, on its sample data. Pick one to see it large.
How the credit union runs its RCSA is a set of settings. Every one is versioned, and every change is approved by a second person.
| Setting | Default | Choose from |
|---|---|---|
| Rating scale | v4: likelihood 1–5 × impact 1–5 | Low 1–5, Moderate 6–11, High 12–19, Critical 20–25 (over $1 million a year or $100,000 in one event); four control effectiveness levels and a residual matrix |
| Prefill confidence | Proposes at 0.70 or higher | Below the threshold the Prefill agent proposes nothing and asks the owner |
| Bulk sign | Confidence 0.90 or higher | Only ratings accepted as proposed, unchanged from last year and unchallenged; each is signed separately on the trail |
| Challenger rules | C-01 to C-07, rules v3 | Thresholds: $25,000 per loss, three losses, two clean quarters after a failed test, two red KRI months, a two-level gap from peer units |
| Refresh triggers | T1 to T5 | A loss over $25,000, a KRI turning red, a failed control test, a new audit or exam finding rated Moderate or higher, incidents that map to no risk |
| Reason codes | R1 to R5 | New or improved control since the evidence window; evidence incomplete or delayed; evidence attributed to the wrong risk; business change; other, explained in the note |
| Reminders and escalation | 7 and 3 days before due | Escalation to the ERM Officer the day after the due date, or at 4 days left with nothing started |
| Retention and redaction | RCSA records 7 years | BSA-related evidence 5 years (31 CFR 1010.430); member names, account and card numbers masked in incident text |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate. Regulations are named as context only: 31 CFR 1010.430 (five-year retention of BSA records) and 12 CFR Part 749 (records preservation). Norrell Federal Credit Union and the people, units, incidents and records named on this page are fictional: characters and sample data in the working solution.
A risk and control self-assessment (RCSA) is how each business line rates its own operational risks and the controls over them: inherent risk, control effectiveness and residual risk. Risk & Control Self-Assessment (RCSA), the solution, runs it as an interview, one risk at a time. Agents draft every rating from the year's incidents, losses, control tests, findings and key risk indicators, each fact cited; the process owner accepts, changes or asks, a Challenger agent checks it for the second line, and the ERM Officer signs.
Inherent risk is likelihood times impact before controls; on the sample scale, 12 to 19 is High. Control effectiveness is rated from tests and findings, and a residual matrix combines the two. In the sample case, High inherent risk with a control that needs improvement stays High residual; with a partially effective control it becomes Moderate.
Debit card fraud at a fictional credit union: last year Moderate, Effective, Low. This year the agent brings 214 incidents, $389,400 in gross losses, a red KRI in August, a failed control test and an audit finding, and proposes High. The owner credits a new velocity rule that passed its retest, the Challenger accepts Partially effective but not Effective, and residual risk is Moderate, within appetite.
It runs seven versioned rules on every proposal and every owner change: losses against the rating, a failed test against Effective, residual lowered without new evidence, a red KRI against a Low residual, an open finding against Effective, peer calibration and evidence gaps. It never overrides a rating; it raises a challenge with the rule and the evidence, and the ERM Officer decides it with a reason.
The Cycle agent reopens a signed rating only when its evidence moves: a loss over $25,000, a KRI turning red, a failed control test, a new finding rated Moderate or higher, or incidents that map to no risk. In the sample month 3 of 97 signed ratings reopened, one by a $62,400 loss posted six days after signing.
People decide. The agents gather, propose, challenge and draft; they never sign, submit, change the risk and control library or close an action plan. The owner rates, a different person signs every change, the ERM Officer decides every challenge, and the Risk Committee approves the cycle, all on the audit trail.
Member names, account and card numbers are masked in incident text, and the agents read every source system without changing it. SAR-related evidence is counted, never listed, for anyone outside the BSA team, only the BSA Officer's pack lists it, and no RCSA content reaches a member-facing view.
The Agentic Solution Engine builds and deploys it from your requirements and documents, such as your rating scale, risk and control library, appetite statement and last cycle's ratings, and it goes live once every quality gate has passed. We will walk you through it on your own last RCSA first.
Every loss in the ledger captured, and the loss database tied to the GL each month.
1-min demoAudit Issue & MRA TrackingClosures asked for only when the proof is there, and MRA dates kept on the record.
1-min demoOperational Resilience ManagementEvery recovery time proven by test evidence, every breach fixed with an owner and a date.
1-min demoWe'll run Risk & Control Self-Assessment (RCSA) on your risk and control library, last cycle's ratings and a year of your evidence.