Description

A focused course, tailored for you

The Bank Business Risk and Controls Advisor Playbook

Walk a process owner from a thin self-assessment to a documented control test that a regulator, second line, and internal audit all accept.

Your RCSA refresh comes back naming the same risks as last quarter, rating everything medium, and pointing to controls that have never been tested end to end. The process owner thinks they finished. You have to explain why the binder is not ready for the second line, let alone the examiner.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

A Business Risk and Controls Advisor at a top-tier US bank sits between three audiences who all want different things from the same control inventory. The process owner wants the refresh closed. The second line wants risk acceptances narrowed and inherent-versus-residual logic documented. Internal audit wants a test plan with a defensible sample size and an evidence binder that does not collapse on review. A regulator visit can pull on any thread at any time. The job is not the control itself, the job is the chain of artefacts that makes a control credible to all four readers at once, and most process owners do not know what those artefacts look like until you build the first one with them.

What you walk away with

Convert a thin self-assessment refresh into a documented control test that the second line accepts without iteration.
Write control descriptions that read identically to a process owner, a risk partner, an internal auditor, and an OCC examiner.
Justify sample sizes for control testing using a method that survives an internal audit challenge.
Structure an evidence binder that an examiner can navigate in under fifteen minutes.
Coach a process owner through a quarterly attestation cycle so the refresh closes on time and on quality.

The 12 modules

Module 1. Reading the RCSA Refresh a Process Owner Just Sent You

Start with the artefact on your desk this week. The five risks, the medium ratings, the three named controls, the missing test evidence. You learn the diagnostic that surfaces what is actually thin, what is fine, and what is going to draw a finding. Output is a one-page critique you hand back to the process owner that names what to fix and in what order, instead of the all-caps comments that make the next round worse.

Module 2. Writing a Control Description Four Audiences Read the Same Way

A control description that reads correctly to a process owner often reads as an objective statement to internal audit and as a procedure to a regulator. You learn the structural rule that fixes this. Who performs the control, what triggers it, what evidence the performance produces, and what failure looks like, in that order. You leave with a template and seven worked examples across retail, commercial, treasury, and operational processes.

Module 3. Inherent Risk, Residual Risk, and the Logic That Connects Them

Second line partners and internal audit both want to see that the inherent-to-residual reduction is justified by the controls in place, not asserted. You learn the documentation pattern that makes this defensible without writing a three-page narrative. A short rationale block tied directly to the control description, the test result, and the residual rating. Worked examples on a wire-transfer process, a model-output review, and a third-party termination.

Module 4. Building a Test Plan That Internal Audit Will Not Rework

The difference between a test plan that passes audit review and one that triggers a do-over is rarely the testing itself. It is the documentation of population, sample selection method, sample size rationale, attribute definitions, and exception handling. You learn each component as a fill-in form, with worked examples on automated, manual, and hybrid controls.

Module 5. Sample Size Justification That Survives Challenge

Risk partners will accept five. Internal audit will challenge five. The OCC examiner will ask why not twenty-five. You learn the four methods most banks accept in practice, when each one applies, and how to write the rationale in two sentences that survive cross-examination. Worked examples on high-frequency automated controls, low-frequency manual controls, and judgmental controls.

Module 6. Evidence Binder Architecture for a Fifteen-Minute Examiner Read

Examiners do not read binders end to end, they navigate them. You learn the file structure, the naming convention, the index page, and the cross-reference convention that lets an examiner answer their own questions without asking you. Includes the bridge table that links a control identifier to its test results, evidence files, exception log, and management response.

Module 7. Coaching a Process Owner Through Attestation Without Becoming the Owner

The trap a Business Risk and Controls Advisor falls into is doing the work for the process owner so the deadline lands. That destroys the control environment because the process owner never builds the muscle. You learn a coaching cadence, the questions to ask in each conversation, and the email templates that move the work back to the owner while keeping the timeline on track.

Module 8. Risk Acceptances That Will Not Come Back to Bite You

A risk acceptance with no expiration, no compensating control, and no review trigger is a finding waiting to happen. You learn the structural elements of an acceptance memo that holds up under regulatory review, the language patterns that make second line approval faster, and the review-trigger conditions that prevent acceptances from quietly aging into uncontrolled risk.

Module 9. Mapping Bank Controls to OCC Heightened Standards and SOX Key Controls

Your process owner does not care that a control maps to OCC heightened standards or to a SOX key control inventory. You do. The mapping is what lets you defend the control library when the next regulatory question lands. You learn the mapping framework, the spreadsheet conventions, and the maintenance cadence that keeps the cross-references current as the control library evolves.

Module 10. Issue Management, Action Plans, and the Path to Closure

An issue logged without a clear action plan, accountable owner, target date, and closure criteria is an issue that ages. You learn the action-plan template that internal audit accepts on first read, the cadence that keeps issues moving without weekly status meetings, and the closure-evidence package that survives a re-look in the next examination cycle.

Module 11. Working With the Second Line Without Becoming Their Documentation Service

The advisor role lives next to second line risk. The boundary matters. You learn the working agreement that keeps second line as challenger rather than co-author, the documents that should always come from the first line, and the artefacts where second line input is genuinely useful versus where it slows the work down.

Module 12. The Quarterly Attestation Run, Start to Finish

The final module is the full cycle. Kickoff, refresh, testing, evidence collection, second line review, internal audit interface, and sign-off. You walk through the calendar, the artefacts, the meetings, and the decision points across thirteen weeks. The implementation playbook in your buyer materials is tuned to your specific portfolio of processes once you provide a short profile.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Module 1 is for the Monday morning when the RCSA refresh came back thin and you need to send a useful critique by end of day.

Modules 3 to 5 are for the cycle when internal audit has challenged a sample size or a residual-rating rationale.

Modules 6 and 9 are for the quarter ahead of an OCC visit when the binder and the mapping spreadsheet need to be examiner-ready.

Module 8 is for the conversation with a process owner who wants to accept a risk that should not be accepted.

What you get with this course

Twelve text-based modules in the Art of Service learning environment, each with downloadable templates and worked examples.
Control description template with seven worked examples across retail, commercial, treasury, and operational processes.
Test plan and sample size rationale templates tuned to bank control populations.
Evidence binder architecture, file naming convention, and cross-reference bridge table.
Risk acceptance memo template with review-trigger language patterns.
OCC heightened standards to SOX key control mapping framework spreadsheet.
Hand-built implementation playbook tuned to your specific portfolio of processes.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours your account in the learning environment is provisioned.

The hand-built implementation playbook tuned to your portfolio is delivered alongside course access.

All twelve modules are available immediately, self-paced.

Most advisors work through a module in 60 to 90 minutes.

Before and after

Before

Your RCSA refresh sits in a state where the process owner thinks it is done, the second line has comments, internal audit is preparing a challenge on the test plan, and the next examination is approaching. Most of your week is rework and chasing.

After

The refresh closes on first or second pass. The test plan survives audit review without iteration. The evidence binder is navigable in fifteen minutes. The process owner is coached, not carried. Your week shifts from rework to genuine advisory.

What happens if you do not address this

Findings travel up. A test plan that internal audit reworks shows up in the audit committee report. A binder that an examiner cannot navigate becomes a Matter Requiring Attention. A risk acceptance that aged into an uncontrolled risk becomes a regulatory criticism. The advisor role is where these issues are supposed to be prevented, not surfaced.

Who it is for

You are a Business Risk and Controls Advisor inside a US bank or non-bank financial. You advise multiple process owners across retail, commercial, treasury, or operations. You spend your week translating control language between first line owners, second line risk partners, and internal audit, with regulators in the background. You have read the OCC heightened standards, you know what a SOX key control needs to look like, and you have written a Risk Control Self Assessment that came back from internal audit with comments.

Who this is NOT for. Not for first-time analysts who have never written an RCSA. Not for chief risk officers looking for an enterprise framework rollout. Not for vendors selling GRC platforms. This is for the advisor who already runs the workflow and needs the artefact-by-artefact craft sharpened.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. 12 to 18 hours total across the twelve modules. Most advisors work through one or two modules per week and apply the artefacts to a live RCSA or test plan as they go.

Why $199 is the right number

Generic GRC certification programs teach the vocabulary but not the artefacts. Internal training at a large bank teaches the bank's specific templates but not the underlying craft. This course is built for the advisor who already has the vocabulary and the templates, and wants the artefact-by-artefact craft that makes a binder examiner-ready on first review.

FAQ

Does this assume a specific regulator or only US banks?

The worked examples lean US bank because the OCC heightened standards and SOX key control inventory are the most documented public reference points. The structural patterns transfer to non-bank financials, Canadian banks under OSFI, and UK firms under the FCA SMCR regime.

Is this just an RCSA course?

RCSA is the entry point because that is where most advisors spend the most rework hours. Modules 4 through 6 are control testing and evidence. Modules 9 and 12 are the broader cycle. The course is the full advisor workflow, not a single artefact.

What is in the implementation playbook?

You provide a short profile of the processes you advise and the cycle you are in. The playbook is then built to your portfolio, with the templates pre-filled to your typical control types, your testing cadence, and your second line and internal audit interface points.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.