Before your shortcomings are laid bare before everyone else, it is best that you know them yourself. That way, you have a chance to address (and redress) them before everyone starts telling you what to do. That is basically the premise of Risk and Control Self-Assessments (RCSAs). Of course, having all your shortcomings publicly declared is a worst-case scenario that can happen even with the implementation of RCSAs in your organisation – but at least you would have had the opportunity to identify them beforehand, be able to outline the measures you have put in place to deal with them, and be able to demonstrate that yes, you do know how to manage things.
RCSAs are an integral part of the operational risk management framework and enable organisations to identify their challenges and potential trouble hotspots in a controlled, structured manner, without publicly exposing their vulnerabilities. But many organisations drag their feet when it comes to this because they feel it is hard on their resources, and a tedious process that will not endear management to the employees. However, it cannot be denied that while RCSAs may potentially be a laborious process, they are also capable of helping companies anticipate their needs, thereby allowing them to deploy their resources for maximum effectiveness.
But first, they do have to get the staff on board with the idea because developing truly effective RCSAs necessitates everyone emerging from their silos and cooperating with each other. It also means moving out of comfort zones and taking responsibility for things which were previously seen as “not my business.” This is really a two-pronged approach that in the long run, will benefit both employee and organisation but, yes, it can be tedious and, no, not everyone will appreciate the lengths that they will have to go to, to make it work. RCSAs, directly and indirectly ,encourage staff to assume more responsibility, i.e., to “take ownership” of their challenges; it also empowers them to find solutions.
What this does, is cultivate collaboration, more openness and understanding while developing a risk culture within the organisation. Staff will feel empowered to take ownership when they realise that anything adversely affecting the company will in turn have an adverse impact on them, and it is therefore in their best interests to do something about it while they can. The learning that comes with implementing RCSAs is a big plus for the organisation, as is the information derived from the training sessions necessitated by the RCSA implementation. Because feedback comes from all levels of the organisation, the firm develops a better idea of its own health. It “knows” how sick or well it is.
Firms would do well to hold RCSA workshops or training sessions on a regular basis, considering how fluid and dynamic the business environment can be. Constantly keeping abreast of developments is crucial to making well-informed decisions It is almost like continuous benchmarking, with the firm constantly comparing itself to others in the industry on the basis of how well it is prepared to face any crisis. At the end of the day, RCSAs can give everyone in the organisation a sense of solidarity, a sense of “we’re-all-in-this-together.” It is a great leveller as it involves staff across the organisation, and an effective means of formal (RCSAs are very structured and detailed) and informal control.
