Description

A focused course, tailored for you

The LOB Risk Lead's First-Line RCSA and Issue-Closure Playbook

Run a first-line risk function at a large US bank where the RCSA is the source of truth and issue closure stops being the bottleneck.

The LOB Risk Lead role at a large US bank is judged on three artefacts: the RCSA that second-line and audit accept, the issue log that closes on time with evidence audit accepts without rework, and the LOB risk committee pack that tells the head of the business what to decide. When any of those drift, every other accountability of the role drifts with it.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

First-line LOB risk leads at large US banks live in a specific squeeze. The second-line risk function wants the RCSA mapped to its enterprise taxonomy, the issues coded to its issue framework, and the residual ratings reconciled to its risk appetite. Internal audit wants control descriptions that match the test plan, evidence that proves design and operating effectiveness, and a clear line from issue to root cause to remediation. The OCC and the Federal Reserve want the first-line to own its own risk, not delegate it to the second-line. The head of the LOB wants a risk committee pack that supports the next product decision, not a recap of last quarter's findings. The role becomes a translation layer between four audiences who each want the same data in a different shape. The RCSA refresh stretches from a six-week exercise to a four-month exercise. Issue closure piles up. The KRI thresholds were set by the prior risk lead and nobody has reconciled them to actual loss experience. Third-party risk attestations sit in a separate workflow that the LOB has no operational ownership of. The risk committee deck gets rewritten by the LOB head's chief of staff the night before the meeting because the version the risk function shipped did not answer the business question. This course rebuilds the operating model so the first-line LOB risk function produces one set of artefacts the second-line, audit, the regulators and the LOB head all read off.

What you walk away with

Produce an RCSA refresh the second-line signs off the first pass, with control descriptions and residual ratings that reconcile to the issue log.
Close issues on the date the issue log says, with evidence packs audit accepts without rework.
Run KRI thresholds tied to actual loss data and recent near-miss events, not values inherited from a prior risk lead.
Walk into the LOB risk committee with a pack that gives the head of the business one or two decisions to make, not a recap.
Own the third-party risk attestations for the vendors your LOB depends on inside the LOB risk operating model, not in a separate workflow.

The 12 modules

Module 1. The first-line LOB risk operating model

Map the four audiences your function serves: the second-line risk partner, internal audit, the LOB head, and the federal examiner who reads your RCSA and your issue log. Define the artefacts each audience expects and the cadence each one reads them on. The operating model is the single set of artefacts that satisfies all four audiences, not four parallel reporting streams. Worked example of a redrawn LOB risk function with role mapping, artefact ownership and cadence.

Module 2. RCSA refresh the second-line accepts the first pass

Walk through an RCSA refresh from kick-off to second-line sign-off in six weeks, not four months. The risk taxonomy mapping step, the control walkthrough sessions with process owners, the preventive vs detective classification rules, the residual rating calibration against the issue log, and the second-line challenge response document. Includes the second-line challenge-tracking template and the residual-rating calibration worksheet that ties RCSA ratings to open issues and recent loss events.

Module 3. Issue log discipline and on-time closure

Why issues drift past their target closure date and how to stop the drift. The issue intake template that captures root cause at intake rather than at closure. The remediation plan format internal audit accepts. The closure evidence pack audit will sign without rework: control design evidence, operating effectiveness evidence, and a sustainability test. Two worked closure packs, one for a high-severity issue and one for a thematic issue spanning multiple controls.

Module 4. KRI thresholds tied to actual loss data

Most LOB KRI thresholds were set by the prior risk lead and never reconciled to actual loss experience. The course walks the recalibration: pull the past several years of loss events for the LOB, identify the leading indicators that preceded each event, set thresholds at the level where action would have changed the outcome. Worked recalibration of three KRIs across credit-loss, operational-loss and compliance-event categories. Output is a defensible KRI methodology document the second-line accepts.

Module 5. Third-party risk inside the LOB operating model

Vendors your LOB depends on are often managed in a separate enterprise third-party risk workflow that the LOB has no operational ownership of. The course shows how to fold third-party risk attestations into the LOB risk operating model so vendor risk events show up in the LOB issue log, vendor controls show up in the LOB RCSA, and the LOB risk committee sees a single integrated picture. Includes the LOB-owned vendor risk attestation template.

Module 6. Model risk attestation for the first line

Models embedded in the LOB (pricing models, loss-forecasting models, fraud models, marketing models that influence credit decisions) carry first-line attestation requirements. The course walks the first-line model inventory, the model-use attestation, the change-impact assessment when a model is recalibrated, and the integration of model performance monitoring into the LOB KRI dashboard. Worked attestation for a pricing model and a fraud model.

Module 7. The LOB risk committee deck that drives decisions

The LOB head reads the risk committee pack to decide what to do next, not to recap what happened last quarter. The course rebuilds the pack from the question backwards: the one or two business decisions on the table, the risk evidence that bears on each decision, the residual exposure picture, the KRI dial movement, the issue and event roll-up framed against the decisions. Two worked LOB risk committee decks for a growth decision and a remediation decision.

Module 8. Working with the second-line risk partner

The second-line risk function will challenge the LOB RCSA, the LOB issue closures, the LOB KRI thresholds and the LOB risk committee pack. The course covers the cadence, the artefacts, the working agreement that turns the second-line from an adversary into a co-author of the LOB risk story. Includes a working-agreement template, the joint-review meeting agenda, and the rules for when first-line and second-line disagree on a residual rating.

Module 9. Internal audit and the issue lifecycle

Internal audit walks the LOB roughly annually. The course covers how to run the function so the audit walks are confirmatory rather than discovery: the control documentation audit expects, the evidence room layout, the issue-and-remediation tracking that lets audit close prior-year issues quickly, and the management response format that lands on first attempt. Includes the audit-evidence-room checklist and the management-response template.

Module 10. OCC, Federal Reserve and CFPB examinations of the LOB

The federal examiners visit the LOB on rotating cycles. The course covers the artefacts they read first (RCSA, issue log, KRI dashboard, board and LOB risk committee minutes), the matters-requiring-attention pattern, the response to MRA and MRIA letters, and the running file the LOB risk function keeps so the next exam opens with the artefacts already organised. Includes the exam-preparation file structure and the MRA response template.

Module 11. Events and near-miss capture

Loss events and near-misses are the truth source for the entire risk picture. The course walks the event intake process that captures near-misses rather than only realised losses, the root-cause taxonomy that lets events feed KRI recalibration, the link from event to RCSA control to issue to remediation, and the LOB head's view of the event picture as a leading indicator. Worked event walkthrough from intake to closure to RCSA update to KRI threshold change.

Module 12. Run the LOB risk function on a 90-day cadence

The closing module rebuilds the entire LOB risk function on a 90-day operating cadence: RCSA touchpoints, issue review meetings, KRI dashboard refresh, third-party attestation refresh, model attestation cycle, LOB risk committee, second-line working sessions, internal audit liaison, exam-preparation file update. Includes the 90-day calendar template the function runs to, the role-by-role load assessment, and the change plan to move from where the function is today to the 90-day rhythm.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

RCSA refresh that keeps bouncing back from second-line with the same red comments: modules 1, 2, 8.

Issue log carrying issues past their target closure date with audit rework on every closure: modules 3, 9.

KRI dashboard the LOB head ignores because the thresholds were inherited and do not reconcile to recent loss experience: modules 4, 11.

LOB risk committee pack that the head of the business rewrites the night before the meeting: modules 7, 12.

What you get with this course

Twelve written modules in the Art of Service learning environment, each with downloadable templates and worked examples drawn from large US bank first-line LOB risk functions.
The RCSA refresh kit: risk taxonomy mapping worksheet, preventive-vs-detective classification rules, residual rating calibration worksheet, second-line challenge tracking log.
The issue closure evidence pack template, with separate sections for control-design evidence, operating-effectiveness evidence and the sustainability test.
The KRI recalibration worksheet that ties thresholds to historical loss data and leading-indicator events.
Two worked LOB risk committee decks, one for a growth decision and one for a remediation decision.
The federal examination preparation file structure and the MRA response template.
A hand-built implementation plan for your specific line of business, written after purchase against the LOB context you supply at intake.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.

Module 1 and module 2 read together cover the first week of work on the operating model and the RCSA refresh.

Modules 3 to 5 build out the issue log, KRI methodology and third-party integration over the next two to three weeks.

Modules 6 to 9 cover model risk, the LOB risk committee, second-line working agreement and audit liaison.

Modules 10 to 12 close the loop on examination preparation, event capture and the 90-day operating cadence.

Before and after

Before

The RCSA refresh runs four months because the second-line keeps reopening control descriptions and residual ratings. The issue log carries half the open issues past their target closure date. The KRI thresholds were set by the prior risk lead and nobody knows the methodology. The LOB risk committee pack gets rewritten by the LOB head's chief of staff. Third-party risk lives in a separate workflow the LOB cannot see into.

After

The RCSA refresh runs six weeks with second-line sign-off on the first pass. Issues close on the date the log says, with evidence packs audit accepts. KRI thresholds are tied to actual loss data with a documented methodology the second-line accepts. The LOB risk committee pack opens with the one or two decisions on the table and the LOB head reads it ahead of the meeting. Third-party risk attestations are part of the LOB operating model and show up in the same risk picture the committee sees.

What happens if you do not address this

If the RCSA, the issue log, the KRI dashboard and the risk committee pack continue to read as four separate artefacts in four different shapes, the function stays in translation mode. The federal examiners will eventually issue a matter-requiring-attention on first-line risk ownership. The LOB head will route around the risk function for product decisions. The role becomes reactive and the people in it leave.

Who it is for

You lead first-line risk for a specific line of business at a large US commercial or retail bank. You own the RCSA refresh, the issue log, the KRI dashboard, the third-party risk attestations for vendors your LOB depends on, the LOB risk committee deck, and the relationship with the second-line risk partner assigned to your LOB. You report into the LOB Chief Risk Officer or directly into the head of the business. You sit between the second-line enterprise risk function, internal audit, the regulators who examine your LOB, and the head of the business who wants to grow it. You have between three and twelve direct reports, a mix of risk officers, control testers and a risk reporting analyst.

Who this is NOT for. Not for second-line enterprise risk leads or chief risk officers at the holding-company level. Not for internal audit or for compliance officers whose primary remit is regulatory examination management rather than first-line operational risk. Not for consultants advising banks from the outside. The course assumes you are accountable for the first-line risk artefacts of a specific business line and you can run an operating-model change inside your function.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Around twenty to thirty hours of reading and template work across the twelve modules. Most learners run the operating-model change inside their function over a single quarter while working through the modules in parallel.

Why $199 is the right number

Most first-line risk leads either run with whatever operating model they inherited from the prior lead, bring in a consulting firm at a six-figure engagement to rebuild the function, or hire a head of risk transformation into the LOB. The course is the operating model written down with the templates the role actually uses, at a price the role can authorise without a procurement cycle.

FAQ

Is this specific to a particular line of business?

The operating model is general across lending, retail, commercial banking, payments, capital markets and wealth lines. The implementation playbook is tailored to your specific LOB after purchase, based on the context you supply at intake.

How does it handle the second-line enterprise risk taxonomy at my bank?

Module 2 walks the risk taxonomy mapping step explicitly. The course gives you the calibration approach. You apply it to your bank's enterprise taxonomy, which the implementation playbook will reference.

I report to the LOB CRO, not directly to the business head. Does the risk committee deck module still apply?

Yes. The LOB risk committee pack is read by the LOB head whether the function reports through a LOB CRO or directly. The module covers both reporting structures.

How current is the regulatory content?

The course is written against current federal examination practice for large US banks at OCC, Federal Reserve and CFPB. The implementation playbook references the most recent examination cycle for your LOB if that context is supplied at intake.

What is the refund window?

Thirty-day money-back guarantee. If the course and the playbook do not give you a path to the operating model you need, you are refunded in full, no questions.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.