AssureSwarm

workflow

Risk & Control Self-Assessment (RCSA) Program

Risk & Control Self-Assessment (RCSA) Program as a modular, decision-aware workflow. Each wave runs on its own Audit item — created per wave (audit_type: operational; period_start/period_end = the wave window; report_date = the risk-committee date) — with the workflow instance attached to that item and the wave's questionnaires, attested returns, and calibration record kept inside the run. Each wave rebuilds the assessment universe from the existing Process, Risk, and Control items and their owners (enriching them, never recreating them), issues rating questionnaires to named control and process owners, collects attested self-assessments with structured exception capture, chases completeness, subjects the results to second-line challenge and calibration, aggregates a residual-risk view across units, updates the risk register's residual ratings, and routes self-identified issues to remediation and exceptions to time-bound acceptance before the results reach the risk committee. In scope: first-line self-assessment of in-scope business units and shared functions against their own risks and controls. Out of scope: independent testing/audit of those controls, and the remediation and formal risk-acceptance of what the wave surfaces, which are handed off downstream to the Finding Remediation & Action-Plan Monitoring (deficiencies), Policy Exception & Risk Acceptance (risk-acceptances/waivers), and Quarterly Board & Audit-Committee GRC Reporting (the wave report) workflows.

Record JSON · Open in map · Data retrieval guide

Catalog revision: 24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028. A connection does not establish full coverage.

Attributes

domain
grc
department
operations
lineOfDefense
operate

Details

teams
  • operations
  • risk-management
domains
  • grc
standards
  • coso-ic
  • coso-erm
  • iso-31000
sourceTemplateId
workflow-library:grc-rcsa-program
releaseId
sha256:4a08a203b0f96f2087dae903e17246c4717f06bcf1767da2153cf0f3c9dcb894
canonicalUrl
https://workflow-library.com/all/?w=grc-rcsa-program
capabilities
    mappingStatus
    mapped
    lineOfDefense
    operate
    controls
    • UC-RISK-07
    • UC-RISK-08
    • UC-RISK-10
    • UC-RISK-13
    • UC-RISK-14
    • UC-GOV-21
    roleIntegrity
    activityCount
    0
    ermPhases
      lineRoles
        serviceModes
          warnings

            Source

            No record-specific source URL is provided.

            Download workflow template · Release: sha256:4a08a203b0f96f2087dae903e17246c4717f06bcf1767da2153cf0f3c9dcb894

            Connections