{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","download":{"releaseId":"sha256:4a08a203b0f96f2087dae903e17246c4717f06bcf1767da2153cf0f3c9dcb894","slug":"grc-rcsa-program","url":"/assets/agent_workflow-grc-rcsa-program-1697621c.7c0aca7146eb91aa.json"},"kind":"record","record":{"attributes":{"department":"operations","domain":"grc","lineOfDefense":"operate"},"canonicalUrl":"https://workflow-library.com/all/?w=grc-rcsa-program","description":"Risk & Control Self-Assessment (RCSA) Program as a modular, decision-aware workflow. Each wave runs on its own Audit item — created per wave (audit_type: operational; period_start/period_end = the wave window; report_date = the risk-committee date) — with the workflow instance attached to that item and the wave's questionnaires, attested returns, and calibration record kept inside the run. Each wave rebuilds the assessment universe from the existing Process, Risk, and Control items and their owners (enriching them, never recreating them), issues rating questionnaires to named control and process owners, collects attested self-assessments with structured exception capture, chases completeness, subjects the results to second-line challenge and calibration, aggregates a residual-risk view across units, updates the risk register's residual ratings, and routes self-identified issues to remediation and exceptions to time-bound acceptance before the results reach the risk committee. In scope: first-line self-assessment of in-scope business units and shared functions against their own risks and controls. Out of scope: independent testing/audit of those controls, and the remediation and formal risk-acceptance of what the wave surfaces, which are handed off downstream to the Finding Remediation & Action-Plan Monitoring (deficiencies), Policy Exception & Risk Acceptance (risk-acceptances/waivers), and Quarterly Board & Audit-Committee GRC Reporting (the wave report) workflows.","details":{"canonicalUrl":"https://workflow-library.com/all/?w=grc-rcsa-program","capabilities":[],"controls":["UC-RISK-07","UC-RISK-08","UC-RISK-10","UC-RISK-13","UC-RISK-14","UC-GOV-21"],"domains":["grc"],"lineOfDefense":"operate","mappingStatus":"mapped","releaseId":"sha256:4a08a203b0f96f2087dae903e17246c4717f06bcf1767da2153cf0f3c9dcb894","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[]},"sourceTemplateId":"workflow-library:grc-rcsa-program","standards":["coso-ic","coso-erm","iso-31000"],"teams":["operations","risk-management"]},"id":"wf:G32","mapUrl":"https://controlsmap.com/?v=1&node=wf%3AG32","slug":"grc-rcsa-program","sourceIds":["cobit-2019","coso-erm","coso-ic","iso-31000","nist-800-53","nist-csf-2","soc2"],"sourceUrl":null,"title":"Risk & Control Self-Assessment (RCSA) Program","type":"workflow"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:004befc963c68e251a464c686bc70c25105d8e1aec69d028f6ee34467a333bb4","properties":{},"sourceDetailPath":"/data/v1/records/wf-g32-7729a23e.json","sourceId":"wf:G32","targetDetailPath":"/data/v1/records/uc-uc-risk-14-a5d6281b.json","targetId":"uc:UC-RISK-14","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3168ea42630c60b9d0ac739951d46d166479602d7c0782798906677e43f9f5c4","properties":{},"sourceDetailPath":"/data/v1/records/wf-g32-7729a23e.json","sourceId":"wf:G32","targetDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","targetId":"uc:UC-GOV-21","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5aba627fbf8c3cd4f0ac94ba9260456f5e58d35d113f53fffe0116b100c2ab33","properties":{},"sourceDetailPath":"/data/v1/records/wf-g32-7729a23e.json","sourceId":"wf:G32","targetDetailPath":"/data/v1/records/uc-uc-risk-07-b86de728.json","targetId":"uc:UC-RISK-07","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5cd31926215cfb8d7d082f59a82ba912861835474348e899c743850f3ac95c00","properties":{},"sourceDetailPath":"/data/v1/records/wf-g32-7729a23e.json","sourceId":"wf:G32","targetDetailPath":"/data/v1/records/uc-uc-risk-10-6d44f690.json","targetId":"uc:UC-RISK-10","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:abac3d7b137540aca64508c0f0051558156203a990d066bf744db48960e5fe88","properties":{},"sourceDetailPath":"/data/v1/records/wf-g32-7729a23e.json","sourceId":"wf:G32","targetDetailPath":"/data/v1/records/uc-uc-risk-08-5f27bebc.json","targetId":"uc:UC-RISK-08","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b86311a530394ad814469234723661fd437c5ddd2cae6653f86e785788d076be","properties":{},"sourceDetailPath":"/data/v1/records/wf-g32-7729a23e.json","sourceId":"wf:G32","targetDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","targetId":"uc:UC-RISK-13","type":"operates"}],"schemaVersion":1}