Description

A focused course, tailored for you

The LOB Risk Analyst RCSA-to-Issue Playbook

Turn a line-of-business RCSA into clean issues, tested controls, and a defensible quarterly risk review the second line will sign.

The RCSA refresh, the control testing log, and the issue tracker each live in different templates, so every quarter the LOB risk view is rebuilt from scratch instead of rolled forward.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

Line-of-business risk analysts in a US bank sit between the business owner who runs the process and the second line that owns the framework. The accountability is concrete: keep the LOB's risk register current, keep the control inventory mapped to the right risks, run or coordinate the control tests, write up findings as issues with owners and due dates, and feed a clean LOB risk view into the quarterly risk committee. The job goes wrong in predictable places. RCSA workshops drift because the inherent-rating language is not anchored to the bank's risk taxonomy. Control test attributes are inconsistent across owners, so the same failure gets written up three different ways. Issues sit in the tracker because the action plan was never specific enough to close. And when the regulator asks for a line-of-sight view from process to risk to control to test result to issue to remediation, the analyst spends a week assembling it from four spreadsheets. This course teaches the cycle as one connected workflow, with the templates that hold the connection together.

What you walk away with

Run an RCSA refresh that produces inherent and residual ratings anchored to the bank's taxonomy, not to the workshop room.
Build a control inventory where every control is mapped to the risk it mitigates and to the test that evidences it.
Write issues that the second line accepts on the first pass, with action plans concrete enough to actually close.
Package a quarterly LOB risk view that reads cleanly to the LOB head, the risk committee, and the regulator on request.
Walk a line-of-sight from process to risk to control to test result to issue to remediation in under fifteen minutes when asked.

The 12 modules

Module 1. Anchoring the LOB to the bank-wide risk taxonomy

Most LOB risk registers drift because the wording of each risk does not map cleanly to the bank's enterprise taxonomy. This module walks through the actual exercise of taking every risk in your LOB register and rewording it to align with the bank-wide taxonomy categories and subcategories, so when ERM aggregates upward nothing has to be retranslated. Output: a remapped register with a one-to-one trace from each LOB risk to its taxonomy node.

Module 2. Scoping the RCSA refresh without rebuilding it

Quarterly or annual RCSA refreshes go wrong when the analyst opens last cycle's file and treats every line as up for debate. This module covers a scoping pass that classifies each risk and control as roll-forward, refresh, or rebuild before the workshop is scheduled, so the business owner's time is spent only on what genuinely changed. Includes the change-trigger checklist (new process, new vendor, new system, audit finding, regulatory change, loss event).

Module 3. Running the RCSA workshop so ratings hold up later

Workshop ratings unravel when the business owner says four out of five for likelihood without anchoring to the bank's likelihood scale wording. This module gives the facilitation script that forces every rating to be stated against the rubric definition, the loss-event lookup that grounds impact ratings in real internal or external loss data, and the documentation template that makes the rationale auditable months later when the rating is challenged.

Module 4. Building the control inventory: design vs operating, key vs supporting

Most LOB control inventories list every control flat. This module covers classifying each control as preventive or detective, manual or automated, key or supporting, and design vs operating effectiveness scope. The classification drives the test approach. The deliverable is a tagged inventory where the test plan and the testing frequency fall out of the classification rather than being negotiated each cycle.

Module 5. Control testing: sample selection, attribute design, and exception write-up

Control test results get rejected by the second line when the sample is unjustified, the attributes are vague, or the exception write-up does not name what was missing. This module covers risk-based sampling for transaction populations, attribute design that converts a control description into testable yes-or-no questions, and the exception write-up template that distinguishes design failure from operating failure from documentation failure.

Module 6. From test failure to issue: when to escalate, when not to

Not every failed test becomes an issue. This module covers the materiality call: aggregating multiple low-severity failures, deciding when a single design failure is a standalone issue, and the criteria your bank's issue management framework actually uses. Walks through three realistic examples (a documentation gap, a segregation-of-duties failure, a vendor monitoring lapse) and shows the call each one drives.

Module 7. Writing the issue: condition, criteria, cause, effect, action plan

Second-line rejection of LOB-written issues almost always traces to one of the five sections being weak. This module covers writing each section to the standard the second line expects: condition specific to the population tested, criteria citing the control or policy, cause traced to a root not a symptom, effect quantified or scoped, and action plan with concrete steps, named owner, and a date the LOB will defend. Includes the template you can paste into your bank's GRC tool.

Module 8. Issue closure: evidence that holds up to the second-line challenge

Issues sit open because the closure evidence is thin. This module covers the closure pack: the artefacts that prove the action plan was executed, the validation testing that confirms the control now operates, and the closure memo that the second line signs without sending it back. Includes the closure pack checklist for each common issue type.

Module 9. The LOB risk view: rolling RCSA, KRIs, issues, and losses into one page

Quarterly risk committee packs fail when the LOB risk view is four disconnected slides. This module covers the one-page LOB risk view that puts current residual rating, KRI status, open issues by severity, and recent loss events on a single panel, with the change-since-last-quarter delta the committee actually wants to see. Includes the Excel template and the slide template.

Module 10. Aggregating the LOB view upward to ERM

ERM needs the LOB view in a shape that aggregates with every other LOB. This module covers the mapping from your LOB taxonomy back to the enterprise risk profile, the rules ERM uses for upward aggregation (worst-case, weighted, exposure-weighted), and the contextual narrative that ERM expects alongside the numbers. Walks through one fully worked example.

Module 11. Regulatory line-of-sight: process to risk to control to test to issue to remediation

When an OCC or Federal Reserve examiner asks a line-of-business risk question, the analyst has to walk the full chain in minutes. This module covers building and maintaining the trace artefact that holds every link in one place, the half-day exercise of refreshing it before any exam, and the desk-side response script for the three most common examiner questions on operational risk.

Module 12. The quarterly cycle as one connected workflow

The first eleven modules cover the pieces. This module assembles them into a quarterly calendar: weeks one through three for RCSA refresh and control testing, week four for issue write-up and closure validation, weeks five and six for LOB risk view and ERM aggregation, week seven for risk committee delivery, weeks eight onward for action plan tracking. Includes the working calendar template, the deliverable checklist for each week, and the handoff list for every dependency.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Open RCSA refresh that has stalled because the inherent ratings are not anchored to the bank taxonomy: modules 1, 2, 3.

Control test results that the second line keeps sending back: modules 4, 5, 7.

Issues in the tracker that will not close because the action plan was vague: modules 6, 7, 8.

Quarterly risk committee pack that the LOB head finds hard to defend: modules 9, 10, 11, 12.

What you get with this course

Twelve written modules in the Art of Service learning environment.
RCSA refresh scoping checklist and workshop facilitation script.
Control inventory classification template tagged by design, operating, key, and supporting.
Sample-selection worksheet and attribute design template for control testing.
Issue write-up template with the five sections and a worked example.
Issue closure pack checklist by issue type.
One-page LOB risk view template in Excel and slide form.
ERM upward aggregation mapping worksheet.
Regulatory line-of-sight trace artefact and examiner response script.
Quarterly cycle calendar template with deliverable checklist per week.
Hand-built implementation playbook scoped to the LOB you cover, delivered alongside course access.

What you will have in hand by Day 1, Week 1, Month 1

Hour 0: purchase confirmed, account provisioned in the Art of Service learning environment.

Within 24 hours: the hand-built implementation playbook for your LOB is delivered alongside course access.

Week 1: modules 1 to 4 cover taxonomy alignment, RCSA scoping, workshop facilitation, and control inventory classification.

Week 2: modules 5 to 8 cover control testing, issue materiality calls, issue write-up, and issue closure.

Week 3: modules 9 to 12 cover the LOB risk view, ERM upward aggregation, regulatory line-of-sight, and the connected quarterly workflow.

Week 4 onward: working the playbook through one full quarterly cycle with the templates as the operating cadence.

Before and after

Before

RCSA refresh stalled on control-owner confirmations, control test write-ups sent back by the second line for attribute clarity, issues open because action plans were too vague to validate, quarterly risk committee pack assembled from four spreadsheets the night before.

After

RCSA refresh moves through scoping, workshop, and ratings on a fixed calendar. Control tests produce exception write-ups the second line accepts on the first pass. Issues close because the action plan was concrete enough to validate. The quarterly LOB risk view is one page, rolled forward from last quarter with a clear delta, and the line-of-sight trace from process to remediation is ready before the examiner asks.

What happens if you do not address this

Without a connected cycle, every quarter is a rebuild. The RCSA refresh slips, control test results pile up in a backlog, issues age past their action-plan dates, and the LOB risk view shows up at the risk committee looking different every quarter. The bigger risk is regulatory: when the OCC or Federal Reserve asks for a line-of-business operational risk walk-through and the chain from process to risk to control to test result to issue is fragmented across spreadsheets, the LOB takes the finding that ERM was already trying to warn about.

Who it is for

Line-of-business risk analysts and associate vice presidents in US banks, sitting in the first line of defence, owning the LOB risk register, RCSA refresh, control testing coordination, issue write-ups, and quarterly risk committee packaging. Typically two to seven years in risk, covering one or two business lines, reporting into a first-line risk officer who in turn reports to the LOB head and dotted-lines to enterprise risk.

Who this is NOT for. Enterprise risk framework owners who write the bank-wide taxonomy. Internal audit who tests the second line's oversight. Model risk specialists. Compliance testing teams whose scope is regulatory rule mapping rather than operational risk. Branch operations staff with no risk-register accountability.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. About four to six hours of reading across the twelve modules, plus the working time it takes to actually run a quarterly cycle with the templates in your hands. The course is paced to fit alongside the cycle you are already running, not to add a parallel one.

Why $199 is the right number

Free LinkedIn posts and webinars cover RCSA and issue management at the framework level but stop short of the workshop facilitation script, the attribute design template, the issue write-up template, and the upward aggregation worksheet. A bank-internal training session typically covers your specific GRC tool but not the analytic discipline behind the artefacts. This course gives you the artefacts and the discipline together, scoped to one LOB risk analyst's quarterly workflow.

FAQ

Is this tied to a specific GRC tool?

No. The templates are tool-agnostic and copy into Archer, OpenPages, MetricStream, ServiceNow IRM, or a clean spreadsheet equally well. The implementation playbook can be scoped to the tool you actually use if you tell us at purchase.

My LOB does retail and small business. Will the examples fit?

Yes. The examples in the modules span retail, small business, commercial, and asset management contexts. The implementation playbook is scoped to the LOB you cover.

What if I am at AVP level but the RCSA is owned by my manager?

The course is written for the analyst doing the actual work of scoping, facilitating, writing up, and packaging. The roles and approvals can sit with your manager. The artefacts you produce against this playbook still hold.

How is this different from the second-line operational risk training?

Second-line training teaches you to oversee a framework. This course teaches you to run the LOB-side cycle the second line is overseeing. Different chair, different artefacts.

What happens after I buy?

Account provisioned in the Art of Service learning environment within hours. Within 24 hours the hand-built implementation playbook scoped to your LOB is delivered alongside it. Refund within 30 days if it is not a fit.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.