Template Updated May 2026

RCSA Template for Fintech Risk & Control Assessments

Name: RCSA (Risk & Control Self-Assessment)
Brand: RiskTemplates
SKU: rcsa
Price: 69 USD
Availability: InStock

141 pre-populated fintech risks with control assessments, questionnaire framework, and testing calendar.

Price

$69

One-time. No subscription. Use forever.

Buy & download — $69 →

◆ Secure checkout ◆ Emailed access ◆ Fully editable ◆ 30-day money-back

Delivered immediately after checkout — your template and guide links are emailed to you with your receipt.

Built for risk and compliance teams at financial-services organizations

◆ Quick buying summary

What you get and when you can use it

Good fit if: You're building a risk program and need to show your control environment
Format: Editable Excel workbook plus a 34-page PDF implementation guide. Instant download after checkout.
Need the methodology first?: Read the RCSA Template Guide.
Time to value: Start reviewing, editing, and assigning owners the same day; customize to your organization before sharing outputs externally.
After purchase: After checkout, your templates and guides are available immediately and the download link is sent to your email with your Stripe receipt. No account required.

Download now — $69 → See preview

◆ What's included

◆ 141 pre-populated risk assessments
◆ Control effectiveness scoring
◆ Self-assessment questionnaire framework
◆ Control testing calendar
◆ Guide for teams with no existing controls
◆ Sample 30-day RCSA implementation plan

Use rights: customize for internal business use and use outputs with your auditors, customers, bank partners, and regulators. Do not resell or redistribute the template files.

◆ Preview

See what the template covers.

RCSA benefits explained — what each one actually means for your risk program

RCSA approach selection guide — 1LOD, 2LOD, and Joint models by function and risk type

How RCSA connects to your Risk Register and KRI Library — the risk program ecosystem

● Case file

When control failures make the news

These public cases illustrate why control design, evidence, testing, and challenge matter. They are useful scenarios for an RCSA discussion, not proof that this template would have detected or prevented a particular failure.

October 2024

TD Bank — $3.1B Historic AML Settlement

TD Bank pleaded guilty to conspiracy to commit money laundering — the largest US bank ever to do so. From 2014-2023, executives prioritized the bank's "flat cost paradigm" over an adequate AML program. Transaction monitoring intentionally excluded all domestic ACH and most check activity.

Why it mattersDocumented controls are not effective controls. TD's AML monitoring existed on paper but excluded 92% of transactions by design. The RCSA effectiveness scoring rubric — "does it work," not "do we have it" — and the testing calendar by risk tier are built to surface gaps like this.

August 2020

Capital One — $80M OCC Penalty for Failed Risk Assessment

OCC fined Capital One $80M for "failure to establish effective risk assessment processes" before its 2015 cloud migration. Capital One didn't implement effective network controls, DLP, or alerts. In 2019, a former AWS employee exploited a misconfigured firewall and posted ~30GB of card application data on GitHub.

Why it mattersA new operating environment is a control environment reset. The OCC's exact language — "failure to establish effective risk assessment processes" — is RCSA-speak. The template's chapter on running an assessment without existing controls documentation is built for exactly this scenario.

October 2020

Citigroup — $400M OCC Penalty for ERM Failures

OCC fined Citibank $400M for "long-standing failure" in enterprise risk management, compliance, data governance, and internal controls. Risk management policies failed to identify, measure, and control risks across the enterprise. Board and senior management oversight was inadequate.

Why it mattersInadequate board reporting on control effectiveness is itself a control failure. The OCC explicitly cited that "inadequate reporting hinder[ed] effective oversight." The RCSA Results Dashboard and Board Report tab translate assessment output into the heat map a board can act on.

If you're reading this trying to make sure your control environment doesn't end up as someone else's case study — that's exactly what RCSA is for. Here's what you'd recognize:

◆ Good fit if any of these sound familiar

When teams reach for this template.

Your bank partner just asked for your RCSA — and the only documentation you have is a Risk Register that doesn't answer "are your controls actually working?"

A Risk Register lists risks. An RCSA evaluates whether your controls are working against those risks. This kit gives you the 141 pre-populated risk-control mappings, the effectiveness scoring rubric, and the questionnaire framework — what your bank partner actually wants to see.

Your last exam came back with a finding citing "inadequate risk assessment processes" — and you don't know where to start.

"Risk assessment process" is examiner shorthand for "we don't see evidence you've evaluated your controls against your risks." The 30-day RCSA cycle in this kit is built around answering exactly that — including a chapter on running your first cycle when you have no existing controls inventory.

Your business line owners are supposed to self-assess controls every year — but the forms are full of jargon and completion is inconsistent.

The questionnaire includes context, examples of strong vs. weak controls, and a plain-English scoring rubric. Completion time depends on scope and the evidence available.

◆ Why now

Updated for the 2024–2026 enforcement focus on control effectiveness

Recent enforcement actions illustrate the difference between documenting a control and demonstrating that it operates effectively. This kit supports evidence-based self-assessment, challenge, effectiveness scoring, and risk-tiered testing schedules. It does not guarantee examiner or bank-partner acceptance; tailor the process to the organization and request.

◆ Where this fits

Where this fits in your risk program

◆ If you have a Risk Register but can't answer "are your controls effective?" — this completes the picture. The 141 pre-populated assessments map directly to the same risk taxonomy as our Risk Register, so the two work together seamlessly.
◆ If you're building from scratch — start with the 141 risks across 21 categories and tailor the inventory and questionnaire to your organization.
◆ If you're preparing for an exam or partner review — use the inventory, effectiveness ratings, testing calendar, and reporting tab to organize the evidence relevant to the request.
◆ If you're replacing a broken process — the 1LOD/2LOD/Joint approach selection lets you redesign who owns what, and the questionnaire framework replaces the 80-question jargon form your business owners refuse to fill out.

◆ What this isn't

Setting expectations.

× Not a replacement for a Chief Risk Officer or 2LOD review function — this is the toolkit they use, not a substitute for the role.
× Not a software platform — Excel + PDF templates, not a SaaS GRC tool.
× Not a Risk Register — a Risk Register lists risks; an RCSA evaluates whether controls work against them. They're complementary (and we offer the Risk Register as a free download).
× Not theoretical — pre-populated with 141 risks, scoring rubrics, and a 30-day implementation plan you can run on a real cycle this quarter.

◆ 30-day rollout plan

A sample 30-day rollout

Use this four-week sequence as a starting point and adjust it for scope, owner availability, evidence, and governance review.

Week 1

Setup, scoping, and approach selection

Choose your 1LOD/2LOD/Joint approach by function and risk type. Scope your business lines, identify owners per risk category, communicate the cycle timeline. Output: signed scoping document with risk categories in play and accountable owners.
Week 2

Self-assessments with business line owners

Each business owner completes their section of the questionnaire using the 141 pre-populated risks as the starting point. Each question has plain-English context and scoring rubric so risk background isn't required. Output: completed self-assessments with control effectiveness ratings by area.
Week 3

2LOD challenge and effectiveness scoring

Risk function challenges the self-assessments with evidence requests, finalizes control effectiveness ratings, identifies gaps, and prioritizes remediation. Output: residual risk view with prioritized remediation actions and assigned owners.
Week 4

Dashboard, board reporting, action item tracker

Populate the RCSA Results Dashboard, format the quarterly Board Report tab, and log action items with deadlines and owners. Output: a documented baseline for organization-specific review and future cycles.

◆ Full playbook in the PDF guide

The complete rollout including workshop agendas, sample messaging to business owners, and the board-meeting brief format is in the 34-page guide that comes with the template.

◆ Regulatory alignment

Aligned with the 2024–2026 control-effectiveness enforcement landscape

Every section cites its regulatory or framework source so examiners and bank partners get traceable answers when they ask "where did this requirement come from?":

◆ COSO Internal Controls — Integrated Framework
◆ COSO Enterprise Risk Management — Integrating with Strategy and Performance
◆ OCC heightened standards (12 CFR 30 Appendix D)
◆ FFIEC IT Examination Handbook (Management and Operations booklets)
◆ OCC Bulletin 2023-17 (interagency third-party risk management)
◆ Basel Committee Principles for Sound Management of Operational Risk
◆ ISO 31000 Risk Management
◆ NYDFS Part 500 (control effectiveness assessment for cybersecurity)

Built for risk and compliance teams at fintechs, community banks, BaaS sponsors, and credit unions. Acceptance depends on the organization-specific evidence, review, and applicable requirements.

Last updated: May 2, 2026

◆ Template guide

RCSA Template Guide

A practical guide to building an RCSA template: risk statements, controls, testing evidence, ratings, owners, issues, and reporting outputs.

Read guide →

◆ FAQ

Frequently asked questions.

How are the 141 risk assessments organized?

They're grouped by the same 21 risk categories used in our Risk Register — credit, compliance, cyber, vendor, model risk, etc. Each assessment includes a risk description, control mapping, effectiveness rating, and residual risk score. If you're already using the Risk Register, the risk IDs map directly.

Do I need existing controls documentation to use this?

No — the guide includes a dedicated chapter on running your first RCSA when you have no existing controls inventory. It walks you through documenting controls as you discover them during the assessment process, so the RCSA itself becomes your first controls inventory.

What's the difference between this and a Risk Register?

A Risk Register lists your risks. An RCSA evaluates whether your controls are actually working against those risks. Think of the Risk Register as "what could go wrong" and the RCSA as "are we doing enough about it." They're complementary — most mature programs have both.

Can business line owners fill this out without a risk background?

Yes — the questionnaire framework is designed for non-risk people. Each question includes context explaining why it matters, examples of good vs. weak controls, and a plain-English scoring rubric. You send it to a business line owner, they fill it out, you review the results.

How long does the first RCSA cycle take?

The guide includes a sample 30-day implementation plan: week 1 for setup and scoping, weeks 2–3 for assessments, and week 4 for analysis and reporting. Actual timing depends on scope, owner availability, evidence, and review depth.

How does this connect to KRIs and the ERMF?

The RCSA results feed directly into your KRI thresholds (if a control is rated weak, the related KRI threshold should be tighter) and your ERMF reporting (the RCSA provides the control environment view your board needs). All three products use the same risk taxonomy for seamless integration.

Can I share completed outputs externally?

Yes. You can use completed outputs with auditors, customers, bank partners, regulators, and internal stakeholders. Customize the template for internal business use — just don't resell or redistribute the source template files.

How do I receive the files?

Checkout is handled through Stripe. After purchase, you receive the template and guide download link immediately on the confirmation page and by email, along with your Stripe receipt. No account is required.

What if it's not a fit?

Email within 30 days for a full refund, no questions asked. The guarantee is meant to remove purchase risk while you evaluate whether the template fits your use case.

● First-time buyer offer

Get 20% off your first template.

Drop your email and we'll send the code.

◆ Not ready to buy?

Start with the free Risk Register.

141 pre-populated fintech risks across 21 categories. ISO 31000 structure.

Download free Risk Register →

◆ Related templates

Pairs well with.

Template

$79

Enterprise Risk Management Framework (ERMF)

Complete ERM documentation: risk appetite, 3 Lines of Defense, committee charter, and board reporting.

Learn more → Buy now →

Template

$49

KRI Library (132 Key Risk Indicators)

132 KRIs with thresholds, data sources, and escalation triggers pre-built for financial services.