Description

A focused course, tailored for you

The Brokerage Risk Manager's RCSA-to-Issue-Log Playbook

Tie every RCSA control rating to a live issue, a loss event, and a tested control so the next risk committee packet defends itself.

The RCSA refresh and the issue log live in different systems, the loss-event database is a third system, and the risk committee asks questions that cut across all three. The packet you write today narrates the gaps. The packet your committee actually wants points at evidence.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

Risk managers at US retail brokerages sit between three populations who never quite agree. The first-line business owners want residual ratings that reflect what they actually do, not the worst-case inherent rating. Internal audit wants the control mapping current and the test results fresh. The risk committee wants a one-page read on top risks with a clear so-what. The standard approach is to chase each population separately through quarter-end, rewrite three different documents, and field follow-up questions for the two weeks after. The approach this course teaches is to wire the source data once so the same evidence answers all three populations, and the packet becomes a query rather than a manuscript.

What you walk away with

Refresh an RCSA workbook where every control rating links to a live issue ID, a loss-event tag, and the most recent control test result.
Map a new FINRA Regulatory Notice or SEC Risk Alert to existing controls in under a working day rather than a working week.
Defend residual ratings to a business line owner using evidence from the issue log and loss-event database rather than negotiation.
Write a one-page risk committee summary that points at evidence rows in the workbook and survives challenge from the committee chair.
Stand up the quarterly cycle so the next refresh starts from a wired baseline rather than from rebuilding the joins.

The 12 modules

Module 1. The brokerage risk taxonomy and where its joints actually break

Walks through the operational, compliance, conduct, market, and credit risk taxonomy as it shows up at a US retail broker-dealer. Names the four joints where the taxonomy disagrees with how the business actually books work, and the consequence each joint has for RCSA rating quality. Gives the reader a one-page diagnostic to run against their own taxonomy before the next refresh.

Module 2. Wiring the RCSA workbook to the issue log

Shows the data model that joins an RCSA control rating to an issue ID, including the lookup keys that survive control owner moves and business-line reorganisations. Walks the workbook template, the join logic, and the validation rules. Includes the workbook template file and a one-page read-me for handoff to a data analyst if you do not maintain the join yourself.

Module 3. Wiring the workbook to the loss-event database

Covers the loss-event tagging convention that lets you query "how many events in the last eight quarters hit this control" without manual reconciliation. Names the three tagging mistakes that destroy the join (free-text categories, owner-supplied severity, year-bucketed dates) and the replacements that work. Includes the tagging schema and a sample reclassification script.

Module 4. Mapping a new FINRA Regulatory Notice to existing controls

A repeatable workflow for the morning a new Regulatory Notice posts. Walks the read-through, the obligation extraction, the candidate-control shortlist from the existing library, the gap call, and the email to the obligation owner. Includes the obligation-extraction template, a worked example using a recent Notice topic, and a control-coverage rubric.

Module 5. Mapping SEC Risk Alerts and exam priorities into the same workflow

Extends module 4 to SEC Risk Alerts, the annual exam priorities letter, and the Division of Examinations sweep topics. Names the structural difference between a FINRA Notice and an SEC Risk Alert and how that difference changes the obligation language you write into the workbook. Includes a worked example for a current sweep topic and the rubric for prioritising which alerts get a full control walk.

Module 6. Residual rating conversations with first-line owners

The script and the evidence pack for the residual rating meeting that goes well. Covers the three pushback patterns business owners use (the control is compensating, the inherent rating is overstated, the loss event was a one-off), the evidence response each pattern needs, and the documented escalation path when the conversation does not converge. Includes the meeting pack template and a two-page scenario walkthrough.

Module 7. The control testing cadence that keeps the workbook fresh

How to choose a testing cadence per control type so the workbook never carries a test result older than the committee cycle. Walks key control vs supporting control distinctions, sampling approaches for high-volume controls, and the handoff to internal audit when their test result can stand in for yours. Includes the cadence matrix and a sample test workpaper template.

Module 8. Issue log hygiene and the aging story

The issue log is the single most-cited evidence row in a defensible packet, and the most likely to be stale. Covers the aging rules, the closure evidence standard, the linkage rules to control retests, and the escalation triggers for issues that miss two consecutive target dates. Includes the aging report template and the closure-evidence checklist.

Module 9. The third-party risk node

Where vendor risk plugs into the brokerage taxonomy without taking it over. Covers the inherent rating logic for a critical vendor, the control-mapping convention that distinguishes your control from the vendor's control, and the obligation flow when a SOC 2 finding hits a vendor whose service touches your books. Includes the third-party row template for the workbook.

Module 10. The conduct and supervision overlay

Conduct risk and supervision controls follow a different rating logic than operational controls and need a separate read in the committee packet. Walks the conduct event taxonomy, the supervisory control mapping convention, and the one rating-scale adjustment that prevents conduct events from being averaged into a low operational residual. Includes the conduct row template and a sample supervisor attestation.

Module 11. Writing the one-page risk committee summary that defends itself

The one page is not a narrative. It is a pointer document. Walks the four-zone layout that every defensible summary uses, the rule for what gets a number and what gets a colour, the call-out convention for emerging risk, and the appendix linking convention so committee follow-up questions land at the workbook row rather than at you. Includes the summary template and three worked examples at different risk profiles.

Module 12. Standing up the quarterly cycle so next quarter starts ahead

The handoff from this quarter's packet to next quarter's refresh. Covers the carry-forward list, the joins that need to be re-validated before each cycle, the calendar for FINRA and SEC publication windows, and the role assignments that prevent the same person rebuilding the joins every quarter. Includes the quarterly cycle calendar template and a handoff checklist.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Module 4 maps to the morning a new FINRA Regulatory Notice posts and the obligation-tracking spreadsheet needs an update by end of week.

Module 6 maps to the RCSA refresh meeting where the business line owner argues the residual rating is overstated.

Module 8 maps to the issue log review where one third of open items are past their target close date.

Module 11 maps to the night before the quarterly risk committee when the one-page summary still reads as narrative rather than evidence.

What you get with this course

12 written modules in the Art of Service learning environment.
RCSA workbook template with the issue-log and loss-event joins pre-wired.
Obligation-extraction template for FINRA Regulatory Notices and SEC Risk Alerts.
Residual rating meeting pack template and pushback-response evidence rubric.
Issue log aging report template and closure-evidence checklist.
One-page risk committee summary template with three worked examples.
Quarterly cycle calendar template and handoff checklist.
A hand-built implementation playbook tailored to your line of business and current RCSA template.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours: course access provisioned in the Art of Service learning environment.

Within 24 hours: hand-built implementation playbook delivered alongside course access, tailored to your line of business and current RCSA template.

Self-paced thereafter. Most learners complete the 12 modules across two to three quarterly cycles, applying one module per cycle to a live refresh.

Before and after

Before

RCSA refresh, issue log review, and risk committee packet are three separate exercises every quarter. Control mappings go stale between cycles. Residual rating conversations turn into negotiation. The committee summary is rewritten from scratch each quarter and the follow-up questions land on you for two weeks afterward.

After

RCSA refresh, issue log, and loss-event database are wired through a single workbook. Control mappings stay current because the joins are validated each cycle. Residual rating conversations are evidence walks rather than negotiation. The committee summary points at workbook rows and follow-up questions land at the evidence.

What happens if you do not address this

The exam cycle does not slow down. Each quarter the gap between the workbook and the evidence underneath it widens, the committee questions get harder to answer in real time, and the next sweep notice or internal audit finding lands on a population of mappings that are no longer defensible. The cost is not just rework. It is the standing of the risk function in front of the committee.

Who it is for

Risk Management Managers and Senior Risk Analysts at US broker-dealers, RIAs, and wealth platforms. You own a slice of the operational or compliance risk taxonomy, you sit through RCSA refreshes with the business lines, you attend or write into the quarterly risk committee, and you read FINRA Regulatory Notices and SEC Risk Alerts the day they post.

Who this is NOT for. Pure first-line business managers without a risk function ownership. Audit-only roles with no RCSA accountability. Vendor risk specialists whose work is entirely third-party (the course touches third-party as one node in the wiring, not the centre of gravity).

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Roughly 8 to 12 hours of reading across the 12 modules. Template setup and the first wired refresh take a further 10 to 20 hours, applied during your normal quarterly cycle rather than as separate project work.

Why $199 is the right number

GARP and PRMIA cover risk theory at a market and credit level and do not walk the brokerage RCSA workflow. ORX members get loss-event benchmarking but not the wiring job. Vendor GRC suites (Archer, ServiceNow IRM, OneTrust) offer the data model but require months of configuration before the joins are usable. This course is the wiring job itself, packaged so a single risk manager can stand it up against an existing template without a GRC implementation.

FAQ

Do I need a GRC tool to apply this?

No. The course walks the wiring as a workbook-and-data-extract approach that works with Excel plus your existing issue log and loss-event extracts. The templates port to Archer, ServiceNow IRM, or OneTrust if you later move to one of those platforms, but the workflow does not require them.

Is this US-specific?

The regulatory mapping modules (4 and 5) are built around FINRA Regulatory Notices and SEC Risk Alerts. The RCSA wiring, issue log hygiene, residual rating, and committee summary modules apply to any common-law brokerage regime. The implementation playbook is hand-built to your jurisdiction.

How does the implementation playbook differ from the course?

The course teaches the wiring as a general workflow. The implementation playbook applies it to your specific line of business, your current RCSA template, the issue log system you actually use, and the committee cadence you actually run. It is hand-built per buyer.

Is there a refund window?

Yes. 30-day refund on the course portion.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.