RCSA Maturity
Scorecard
Pick the statement that best describes your current reality across five dimensions: methodology, first-line engagement, scoring consistency, action follow-through and reporting usefulness. You will get a maturity rating per dimension, an overall score, and a written diagnosis you can download.
How it works
A 10-minute read on whether your RCSA is actually working
Most RCSA programmes look complete on paper and still fail in practice: the first line does not own it, scores drift, actions stall, and the board pack is a fortnight of copy-paste. This scorecard is a structured way to see where that is happening in your firm - without a vendor questionnaire dressed up as a diagnostic.
- Step 1
Fifteen questions
Three questions in each dimension. Choose the statement closest to how the process actually runs today - not how the policy says it should.
- Step 2
A rating you can explain
Each dimension scores out of 9. Combined they produce an overall rating out of 45: Early Stage, Developing, or Established - with a written interpretation.
- Step 3
Take the diagnosis with you
Download a PDF of your responses, dimension scores and findings. Use it internally, or bring it to a conversation if you want to see what closing the gaps looks like in a platform.
The five dimensions
These are the failure modes we see most often in mid-market RCSA programmes. A high overall score with a weak dimension is still a gap the board will feel - usually in first-line ownership or action follow-through.
Methodology
How the RCSA is designed, structured, and maintained.
First-Line Engagement
Whether the first line genuinely owns the process or the risk team does it for them.
Scoring Consistency
Whether inherent and residual risk ratings actually mean something.
Action Follow-Through
What actually happens to findings and issues once they're identified.
Reporting Usefulness
Whether the output is actually decision-useful for boards and committees.
Who this is for
Built for Heads of Risk, CROs and operational risk managers at UK regulated firms who already have an RCSA - a register, a cycle, a committee pack - and want an honest view of whether it is a management tool or a compliance exercise. It is not a substitute for a full framework review, and it is not scored against Initia Risk as a product.
If you want the methodology behind the questions, start with what an RCSA is and why most programmes fail and how to run an effective RCSA. For the software that runs the cycle, see our RCSA software and operational risk software pages.