Every RCSA register has a column for control effectiveness. In most registers, nobody can say where the entries came from.
A process owner writes “Effective” because the procedure exists, last year’s rating said so and nothing has visibly gone wrong. Risk accepts it because the template is complete. The residual rating that follows looks precise and rests on nothing. When the loss comes, the register shows the control was effective all along.
Rate the evidence, not the description
The position this guide takes: a control earns a rating only from evidence that it worked during the period being assessed. A description proves design, at best. It says nothing about whether the control ran. A control with no operating evidence is rated Not assessed, and it gets no credit in the residual rating until someone tests it.
That is a practice standard, not a rule any Kenyan regulator has written down. It follows from what the standards below do say, and it removes the largest single source of false comfort in most registers.
| Evidence for the period | Highest rating allowed | Why |
|---|---|---|
| Independent test passed (internal audit, compliance testing, second-line review), no linked incidents | Effective | Someone with no stake in the answer has seen it work |
| Owner test on a retained sample, reviewed by Risk, no linked incidents | Largely effective | Evidence exists, but the owner is grading their own control |
| Procedure or description only | Not assessed | Proves the control was designed, not that it ran |
| Incident, loss, complaint or audit finding traced to the control in the period | Ineffective, whatever any test said | The control failed where it mattered |
The last row is the one most registers miss. A control can pass a sample test and still have failed the one time it was needed. If the incident log shows the control missed, the rating says so too.
What the standards ask
No Kenyan rule prescribes an RCSA format. The expectations are clear enough without one.
| Source | Expectation | What it means for the register |
|---|---|---|
| CBK Risk Management Guidelines (January 2013), 6.1 | The operational risk framework describes the risk assessment tools and how they are used, and sets tolerances for inherent and residual risk | The rating method, including what evidence supports a rating, belongs in the framework, not in a facilitator’s head |
| Same, 6.4.1 | Loss data shows “the effectiveness of internal controls” and whether failures are isolated or systematic; risk self-assessment is listed as an assessment tool | Loss and incident data are inputs to the rating, not a separate report |
| Same, 6.4.2 | Keep a log of major operational risk events, including frauds, attempted frauds and system downtime | The event log is the first thing to check a rating against |
| Basel Committee, Principles for the Sound Management of Operational Risk (March 2021), para 9 | The first line identifies and assesses its own operational risks and assesses whether its controls are well designed and effective | The business owns the rating; Risk does not fill it in |
| Same, Principle 3, para 25 | Controls should be regularly reviewed, monitored and tested | An untested control has not met the expectation |
| Same, Principle 6, para 35(g) | Compare internal losses with self-assessment results to check whether the self-assessments work | Losses sitting under controls rated Effective mean the RCSA is wrong |
The CBK guidelines are issued to institutions licensed under the Banking Act. Microfinance banks, payment service providers, money remittance providers, forex bureaus and insurers work under other texts, but nothing in any of them makes an untested control effective.
Who owns the rating
Most RCSAs fail on ownership before they fail on method. Risk runs the workshop, drafts the ratings and circulates them for sign-off. The business signs because it is quicker than arguing. The register now belongs to Risk, and every finding in it is treated as Risk’s problem.
| Role | Owns | Does not own |
|---|---|---|
| Process owner (first line) | The risks in the process, the control ratings against the evidence, the actions and their dates | The rating method |
| Risk function (second line) | The method, the evidence standard, challenge of every rating above Not assessed, aggregation and reporting | The ratings themselves |
| Internal audit (third line) | Independent tests that move a control to Effective; assurance over the RCSA process | The remediation |
Challenge means asking for the evidence, not debating the score.
One control, two ratings
An illustrative example, not a real case. A payment service provider’s RCSA rates “daily reconciliation of the settlement account” as Effective. The procedure is sound, and the owner signs a monthly attestation.
Under the evidence standard, the reviewer asks for the reconciliations for a sample of 20 business days. Five were completed after the next day’s cut-off. Two carry no reviewer sign-off. The incident log shows one unreconciled difference that stayed open for nine days.
The rating moves from Effective to Ineffective. The action changes too. It is no longer “remind staff of the procedure”. It is to fix why reconciliations slip, which turns out to be a manual extract that arrives late. Operations owns the fix, it has a date, and the control is retested next cycle.
What practice has shown me
Few exercises expose the gap between paper and practice like the RCSA. I have encountered assessments with careful scores, long control descriptions and tidy registers that said almost nothing about how the controls had actually performed. Process owners carried forward inherited ratings without challenge, optimistic self-assessments hid weak controls, and action plans treated the symptom while the failure came back. The RCSAs that earned their keep put incident history, control-test results and the people who run the process in the same conversation, and ended with changes the business could make itself. An RCSA becomes useful when it stops being completed for Risk and Compliance and becomes how the business manages its own risks.
Running the next cycle
- Before the workshop, pull the period’s incidents, losses, complaints, and audit and inspection findings for the process. Map each one to the control that should have stopped it.
- Cut the register to the risks the unit owns. Inherited risks that belong elsewhere go back to their owner.
- Rate every key control against the evidence table. Anything without operating evidence is Not assessed.
- Recalculate residual risk with no credit for controls rated Not assessed. Expect ratings to rise; that is the point.
- Compare residual ratings with the period’s losses and incidents. Where they disagree, the RCSA is wrong until someone explains why.
- Write each action against a root cause, with an owner, a date and the test that will prove it closed.
- Report the number of key controls rated Not assessed to the management risk committee, with a plan to test them.
When the register starts to matter
An RCSA is not finished when the template is complete. It is finished when every rating can be defended with evidence the business produced and Risk challenged. Holding that line makes the first cycle uncomfortable, because residual ratings go up before they come down. The second cycle is the one people start to use.
Riskill’s RCSA & Risk Register Toolkit includes an RCSA workbook, scoring criteria, a control library, a heatmap, an action tracker and owner validations: riskilled.com/toolkits. For an independent RCSA and control-effectiveness assessment, talk to the advisory desk: riskilled.com/engage.