Risk toolkit/Build the case
RCSA Methodology Pack
Fill the four decisions before you build or migrate a register. Taxonomy, residual ownership, how residual is produced, and the split between review and assessment are expensive to reverse.
Excel workbook
What is in the file
- Four decisions - taxonomy depth, who owns residual, calculated vs typed residual, review vs assessment cycles.
- Sample taxonomy - six types you can lift (strategic, financial, operational, compliance, conduct, technology).
- Impact and likelihood calibration - worked examples to replace with your own numbers.
- Control effectiveness - design vs operating, with ratings that can survive challenge.
The four decisions
2-level taxonomy is the default for a mid-market firm. Add a third level only if the board already reports on a short list of principal risks.
First line owns the residual score. Second line owns the methodology and the challenge. If second line scores the risks, you have an audit file, not a risk process.
Inherent is a register field. Residual comes from the assessment of linked controls. Nobody types a residual in a cell - that is how every risk becomes amber.
A risk review (is the definition still true?) is not a risk assessment (what is residual vs appetite right now?). The same split applies to controls: design review vs operating effectiveness.
Want this running as BAU, not a file
Initia is the platform these templates were taken from. Same fields, without the reconciliation.