Description

A focused course, tailored for you

The LOB Risk Expert RCSA and Control Testing Playbook

Run line-of-business risk and control self-assessments that survive Internal Audit and the regulator, not just the quarterly attestation deck.

Your LOB RCSA refresh comes back with the same residual high ratings, the same control owner pushback on testing scripts, and the same Internal Audit comments on workpaper completeness. The rework eats the quarter.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

Line-of-business risk experts inside large US banks sit between the LOB head who wants a clean attestation, the second line who owns the framework, and the third line who picks every workbook apart. The RCSA refresh, the control testing programme, and the quarterly attestation memo are nominally separate artefacts, but the regulator and Internal Audit read them as one story. When the inherent risk score, the control design narrative, the testing evidence, and the residual rating do not line up, every line of defence raises the same question and the LOB has to redo the work. The course teaches the practitioner how to author those four pieces so they reinforce each other the first time, so testing samples are defensible, so KRI thresholds are tied to actual loss data, and so the quarterly memo for the LOB head reads as a clean signoff rather than a list of open items.

What you walk away with

Author an RCSA workbook for your LOB where inherent risk, control design, testing evidence, and residual rating tell one consistent story.
Build control testing scripts and sampling plans that pass Internal Audit workpaper review the first time.
Set KRI thresholds tied to actual loss event data and breach escalation paths the LOB head will sign.
Write a quarterly attestation memo for the LOB head that reads as a clean signoff, not a list of open items.
Defend residual rating reductions against second-line challenge with evidence the regulator already accepted.

The 12 modules

Module 1. Inherent risk scoring that survives second-line challenge

The scoring rubric for LOB inherent risk that holds up when the enterprise operational risk team challenges it. Combines loss event history, exposure, complexity, and external loss data into a defensible score. Worked example using a retail lending sub-process. Common pitfalls when scaling the rubric across multiple sub-processes in one LOB, and how to keep scores comparable across refresh cycles without resetting the baseline.

Module 2. Control design narratives mapped to the three lines model

How to write the control design narrative so the first-line owner, the second-line challenger, and Internal Audit all read it the same way. Pattern for naming the control objective, the activity, the frequency, the owner, the evidence artefact, and the dependency on upstream controls. Covers the OCC heightened standards three lines expectations and how the narrative anchors testing scope. Worked narrative for a transaction monitoring control.

Module 3. Testing scripts and sampling for the LOB control library

Build testing scripts the second line approves and Internal Audit accepts. Sample size selection by control frequency and population, statistical versus judgemental sampling decisions, evidence specification, exception handling, and root cause coding. Worked test script for a credit risk control with high transaction volume. The specific workpaper completeness items Internal Audit checks first when reviewing first-line testing.

Module 4. Residual rating math that ties to testing results

Move residual ratings rather than report the same residual high every cycle. The math that ties testing exception rates, control effectiveness conclusions, and remediation status into a residual score the second line will accept. Includes the conditions under which a residual reduction is defensible and the documentation that has to accompany it. Pattern for staging residual moves across two or three refresh cycles when the control matures.

Module 5. KRI design tied to actual loss event data

Build KRIs that the LOB head reads, not just dashboards that fill a slide. Threshold setting using historical loss events, escalation triggers, ownership and accountability, and the link between a KRI breach and an RCSA refresh trigger. Worked example for a payments operations LOB. The KRI patterns that have proven they predict losses versus the patterns that look impressive but never breach.

Module 6. RCSA workbook structure and refresh cadence

The workbook layout that makes refresh cycles repeatable and reduces control owner rework. Risk register columns, control library columns, testing log, KRI tab, action plan tab, and the cross-reference logic between them. Refresh cadence trade-offs for high, medium, and low inherent risk processes. The mistake of refreshing every line every quarter and how to scope partial refreshes that the second line still accepts.

Module 7. Issue and action plan management for the LOB

Run the LOB issue inventory so open items close on time and the population the regulator sees is credible. Issue classification, owner assignment, target dates, status reporting, ageing, and the conditions under which an issue can be closed with a residual risk acceptance. Worked example for a third-party risk issue spanning two LOB sub-processes. The reporting view the LOB head needs monthly versus the view the second line needs quarterly.

Module 8. Loss event capture and root cause coding

Capture loss events so they feed the RCSA refresh rather than sitting in a separate database. Threshold for capture, taxonomy alignment with Basel event categories, root cause coding standard, and the link from a captured event to a control library update. Worked event for a fraud loss that touches both retail and commercial LOBs. The common gap of capturing events but never feeding them back into the inherent risk score.

Module 9. OCC heightened standards alignment for LOB risk programmes

Translate the OCC heightened standards expectations for the three lines into specific LOB-level artefacts the examiner will look for. Risk appetite alignment, independent challenge documentation, escalation expectations, and the standing reports the second line needs. The exam questions that have actually been asked about LOB-level RCSA programmes, and the artefacts that close them quickly.

Module 10. Workpaper packaging for Internal Audit and external exam

Package the LOB risk programme workpapers so Internal Audit completes its review without follow-up requests, and so an external exam team can self-serve. Folder structure, naming conventions, evidence retention rules, and the index that points the reviewer at the testing log, the RCSA workbook, the issue inventory, and the loss event database. The specific completeness gaps that produce the most repeat questions.

Module 11. Quarterly attestation memo for the LOB head

The two-page attestation memo the LOB head signs each quarter. Structure: residual rating summary, material changes since last refresh, open issues with action owner and date, KRI breaches and response, loss event highlights, and the explicit signoff statement. Worked memo for a commercial banking LOB. How to write it so the LOB head reads it once, signs, and the second line can replay it to the regulator without translation.

Module 12. Defending residual reductions in second-line challenge sessions

The challenge session is where residual reductions live or die. The preparation pack the first line brings, the way the conversation runs, the evidence the second line needs to see, and the language that closes a residual reduction with the framework owner. Worked walkthrough of a challenge session where a residual moved from high to moderate. The patterns that get pushback and the patterns the second line accepts without rework.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Module 1, 2 and 4 fix the residual-stuck-at-high problem.

Module 3 and 10 cut Internal Audit rework on testing workpapers.

Module 5, 7 and 8 turn KRIs, issues, and losses into one feedback loop into the RCSA.

Module 9, 11 and 12 give the LOB head and the regulator a clean attestation story.

What you get with this course

12 written modules in the Art of Service learning environment, each with worked examples grounded in retail, commercial, payments, and credit LOBs.
Downloadable RCSA workbook template aligned to the three lines model.
Control testing script template and sampling decision worksheet.
KRI threshold worksheet with loss event linkage.
Quarterly attestation memo template for the LOB head.
Hand-built implementation playbook tailored to the buyer's LOB, delivered alongside course access.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours: account provisioned in the Art of Service learning environment, all 12 modules accessible, downloadable templates available, hand-built implementation playbook delivered alongside course access.

Week 1: complete modules 1 to 4, redraft the inherent risk rubric and one control design narrative.

Week 2: complete modules 5 to 8, rebuild one KRI threshold and one loss event feedback path.

Week 3: complete modules 9 to 12, redraft the workpaper package and the quarterly attestation memo.

Week 4: walk one residual reduction through second-line challenge using the prepared evidence pack.

Before and after

Before

The quarterly RCSA refresh runs over by three weeks, residuals stay high cycle after cycle, control owners push back on testing scripts, Internal Audit issues repeat workpaper comments, and the attestation memo lists open items the LOB head has to defend in his own meetings.

After

The refresh closes on schedule, residuals move on the strength of testing evidence, control owners sign the script the first time, Internal Audit accepts the workpaper package, and the LOB head signs a two-page attestation memo that the second line can replay to the regulator without translation.

What happens if you do not address this

Without lining up inherent risk, control design, testing, and residual rating into one coherent story, the LOB risk programme stays in perpetual rework, the second line keeps issuing challenge memos, Internal Audit findings repeat, and the OCC examiner records the LOB programme as immature even when the underlying controls are sound.

Who it is for

An in-house line-of-business risk expert or VP-level risk officer inside a US bank, accountable for the LOB's operational risk programme, RCSA cycle, control testing schedule, KRI dashboard, and quarterly attestation memo to the LOB head and second line. Typically reports into LOB risk leadership with dotted lines into enterprise operational risk. Has been through at least one OCC or Fed exam touching the LOB. Knows the framework, wants better implementation discipline.

Who this is NOT for. Enterprise-level operational risk framework owners who design the RCSA methodology rather than execute it. Internal Audit staff doing independent control testing. Compliance officers running BSA/AML or fair-lending programmes. Strategy or finance roles without direct ownership of an LOB risk register.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. About 6 to 8 hours across the 12 modules, plus the time to apply the templates to one LOB RCSA refresh cycle. Designed to slot inside an existing quarter rather than displace the working calendar.

Why $199 is the right number

Free LinkedIn posts cover RCSA at the framework level but stop at the boundary where the LOB practitioner actually has to author the workbook. Big-bank internal training tends to be enterprise-level methodology, not LOB-level implementation craft. Generic GRC vendor content sells the tool, not the practitioner's authoring skill. This course is the practitioner-level implementation craft a US bank LOB risk expert needs to author defensible RCSA, testing, and attestation artefacts, with the hand-built implementation playbook calibrated to the buyer's LOB.

FAQ

Is this a methodology course or an implementation course?

Implementation. The methodology layer is assumed. Every module produces an artefact a US bank LOB risk practitioner has to author and defend.

Does it cover BSA/AML or fair-lending specifically?

No. The course is about operational risk and control programmes at LOB level. BSA/AML and fair-lending have their own compliance frameworks and are out of scope.

Will the templates work inside the bank's existing GRC tool?

Yes. The templates are designed as logic and structure first, then mapped to the fields any major GRC tool supports. The hand-built implementation playbook covers tool-specific mapping for the buyer's environment.

How is the playbook tailored?

After purchase, the playbook is hand-built for the buyer's specific LOB type, the dominant inherent risk profile, the GRC tooling in use, and the regulator footprint, then delivered alongside the course.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.