An IT risk and control self-assessment (RCSA) is a process that helps organizations identify and
evaluate operational risks and assess the effectiveness of their control measures12. It is a structured
approach that involves identifying, assessing, mitigating, and monitoring risks across all levels of an
organization12.
A report to senior management is a document that summarizes and communicates the results and
findings of the RCSA, and provides recommendations and action plans for improving the risk
management and control processes34.
The most important aspect of an IT risk and control self-assessment to include in a report to senior
management is an increase in residual risk, which is the risk remaining after risk treatment, and
represents the exposure or potential impact of the risk on the organization’s objectives56.
An increase in residual risk is the most important aspect because it indicates the level of risk that the
organization is willing to accept or tolerate, and the gap between the current and desired risk
profile56.
An increase in residual risk is also the most important aspect because it requires the attention and
decision of the senior management, who are responsible for defining the organization’s risk appetite,
strategy, and criteria, and for ensuring that the residual risk is within the acceptable range56.
The other options are not the most important aspects, but rather possible components or outcomes
of an IT risk and control self-assessment that may support or complement the report to senior
management. For example:
Changes in control design are components of an IT risk and control self-assessment that involve
modifying or updating the control measures to address the changes in the risk environment or the
organization’s objectives56. However, changes in control design are not the most importantaspect
because they do not measure or reflect the residual risk, which is the ultimate goal of the risk
treatment56.
A decrease in the number of key controls is an outcome of an IT risk and control self-assessment that
indicates the improvement or optimization of the control processes, and the reduction of the
complexity or redundancy of the control measures56. However, a decrease in the number of key
controls is not the most important aspect because it does not indicate or imply the residual risk,
which may depend on other factors such as the effectiveness or efficiency of the controls56.
Changes in control ownership are components of an IT risk and control self-assessment that involve
assigning or reassigning the responsibility and accountability for the control processes to the
appropriate individuals or groups within the organization56. However,changes in control ownership
are not the most important aspect because they do not affect or determine the residual risk, which is
independent of the control owners56. Reference =
1: Risk and control self-assessment - KPMG Global1
2: Control Self Assessments - PwC2
3: How-To Guide: Implementing Risk Control Self-Assessment Steps4
4: RISK MANAGEMENT SELF-ASSESSMENT TEMPLATE - Smartsheet5
5: Risk IT Framework, ISACA, 2009
6: IT Risk Management Framework, University of Toronto, 2017
