Description

A focused course, tailored for you

Regulator-Ready Risk Artefacts for Bank Risk Specialists

Build the RCSA, operational risk narrative, and control evidence package that survives an OCC or Fed examiner's first question.

The RCSA looked complete until the examiner asked for the second document in the evidence chain. Risk Specialists at major commercial banks are accountable for artefacts that must satisfy both internal audit and external regulatory review, but most of the training on how to write them was designed for risk managers presenting to committees, not practitioners building the file the examiner actually reads.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

The gap shows up at exam time. The control statement is technically accurate but does not pre-answer the examiner's evidence question. The operational risk event narrative describes what happened but does not close the loop on what the control environment changed. The residual risk rating has a number but not the supporting rationale that survives a second round of questions. Each of these is a fixable writing and structuring skill, not a knowledge gap, but fixing it under time pressure during an exam is the wrong moment to learn it.

What you walk away with

Write RCSA control statements that pre-answer the OCC and Fed examiner's first evidence question.
Structure operational risk event narratives so they close without a second round of examiner follow-up.
Assemble a residual risk rating package with the supporting rationale that holds under scrutiny.
Build a control evidence chain that an internal audit team can step through without a walkthrough from you.
Reduce the time you spend reworking artefacts during exam prep by working to a consistent standard from the first draft.

The 12 modules

Module 1. What Examiners Actually Read First

OCC and Fed examiners follow a predictable sequence when they open an RCSA package: control statement, then evidence, then the residual risk rationale. This module maps that reading sequence and shows how most practitioner-built documents create friction at each step. You will annotate two sample RCSA excerpts to identify the specific phrases that prompt follow-up questions and the phrases that close them.

Module 2. The Anatomy of a Defensible Control Statement

A control statement that satisfies an examiner has four components: the specific population it covers, the frequency and method of execution, the accountable role, and the evidence the execution produces. This module breaks down each component and shows how collapsing two of them into a single clause is the most common source of examiner return visits. You will rewrite three underperforming control statements from anonymised bank RCSA packages.

Module 3. Mapping Your Control to Its Evidence Chain

The control statement and the evidence artefact must form a closed loop: a reader who does not know your process should be able to trace from the control statement to the document that proves execution. This module teaches the mapping technique: identifying the primary artefact, the secondary artefact that corroborates it, and the retention and access path that makes both retrievable during a live exam. Includes a template for a two-control evidence map you can apply to your own RCSA.

Module 4. Operational Risk Event Narratives That Close

The most common deficiency in operational risk event write-ups is the open loop: the narrative describes what happened and what was done but does not state what changed in the control environment and how that change will be observable. This module provides the three-part close structure (event, response, observable control change) and walks through four event types common in commercial banking: system outage, process failure, vendor error, and fraud detection event.

Module 5. Residual Risk Ratings That Hold Under a Second Question

Examiners do not accept a residual risk rating of Medium without asking what makes it Medium rather than High. This module teaches the supporting rationale structure: quantitative evidence where available, qualitative reasoning where not, and the explicit statement of which mitigating control is doing the work. You will score three anonymised risk scenarios using the rationale structure and compare your output to a reference answer.

Module 6. Building the RCSA Package an Internal Audit Team Can Walk Without You

Internal audit reviews your RCSA before the regulator does. If your audit team needs a walkthrough to understand the package, the package is not ready for the exam. This module covers the index structure, the cross-reference convention, and the three annotation types that make a self-navigating RCSA package. Includes a checklist your audit team can use to confirm the package is exam-ready before the exam date.

Module 7. Control Testing Workpapers: From Sample to Conclusion

A control testing workpaper must show the examiner how you selected the sample, what you tested, what you found, and why the finding supports or contradicts the control's stated effectiveness. This module covers the workpaper structure for attribute testing, walk-through testing, and re-performance testing. You will build a complete workpaper for a sample detective control using a provided dataset template.

Module 8. Regulatory Language That Does Not Create New Questions

Certain phrases in RCSA and operational risk documents reliably generate examiner follow-up: 'generally', 'as applicable', 'management judgement', 'periodic review'. This module catalogues the fifteen most common examiner-triggering phrases, explains why each creates ambiguity rather than closing it, and provides direct substitutes that make the same statement with the specificity an examiner needs. Applicable to OCC Heightened Standards environments and standard examination cycles.

Module 9. Issue Management: Writing Findings That Survive Legal and Compliance Review

When a control gap becomes a formal issue, the finding write-up must satisfy legal, compliance, the first-line risk owner, and the examiner simultaneously. This module covers the four-part issue structure (observation, root cause, impact, management action) and the specific language conventions that prevent the finding from being reopened by legal or escalated by the examiner. Includes the escalation-trigger phrases to avoid and the closing-condition phrasing that marks an issue as genuinely resolved.

Module 10. Exam Preparation: Building the Reading File Examiners Request

Most exam preparation time is spent searching for documents that should have been pre-packaged. This module covers the standard examiner information request categories for an OCC or Fed examination of a large commercial bank, the typical timeline from information request to examiner arrival, and the reading file structure that lets you respond to a 40-item information request in the first 48 hours. You will build a reading file index template for your own risk domain.

Module 11. When the Examiner Asks a Follow-Up Question in the Room

Oral follow-up during an examination is a skill separate from the artefact quality. This module covers the three examiner question types (clarifying, probing, and adverse), the response structure that is honest without opening new lines of inquiry, and the technique for saying 'I will get you that document' without creating an untracked commitment. Includes a practice scenario based on a common RCSA gap finding in commercial banking.

Module 12. Building a Faster RCSA Cycle from the Current One

The best outcome of this course is that your next RCSA cycle takes less time because you built the current one to a standard that does not require rework. This module covers the two process changes that have the largest impact on cycle time: the control statement review checkpoint and the evidence pre-validation step. You will leave with a personal action list of the three highest-leverage changes to make before your next scheduled RCSA update.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

RCSA under OCC or Fed review and control statements are generating examiner follow-up questions: start with modules 1-3.

Operational risk event write-ups are being returned for revision by internal audit or the examiner: modules 4 and 9.

Residual risk ratings are being challenged and the supporting rationale is not holding: module 5.

Exam prep is reactive and document retrieval is slow: modules 6 and 10.

What you get with this course

Twelve written modules covering RCSA production, operational risk event narratives, control testing, issue management, and exam preparation.
Downloadable templates: control statement builder, evidence chain map, residual risk rationale structure, control testing workpaper, reading file index.
Hand-built implementation playbook tailored to your role, delivered alongside course access.

What you will have in hand by Day 1, Week 1, Month 1

Access to all twelve modules within 24 hours of purchase.

Hand-built implementation playbook delivered alongside course access within 24 hours.

Before and after

Before

The RCSA is technically complete but generates a second round of examiner questions during every exam cycle. Control statements are accurate but not pre-emptively evidenced. Exam prep involves searching for documents that should have been packaged weeks earlier.

After

Control statements are written to a standard that closes the examiner's first evidence question before it is asked. Operational risk event narratives close with an observable control change. Exam prep is a packaging exercise, not a document hunt.

What happens if you do not address this

Repeated examiner follow-up on the same control gaps accumulates in the examination record. Over multiple cycles, recurring deficiencies shift from findings to matters requiring attention, which changes the regulatory relationship and the timeline for resolution. The underlying skill is fixable; the accumulated record is not.

Who it is for

Risk Specialists and Risk Analysts at commercial banks, regional banks, and large credit unions who own the day-to-day production of RCSA documentation, operational risk event reports, control testing workpapers, and regulatory exam packages. You are the practitioner accountable for the artefact, not the senior leader presenting it.

Who this is NOT for. Chief Risk Officers or risk committee members who review rather than produce artefacts. Consultants packaging frameworks for client delivery rather than building for internal regulatory review.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Each module is designed for one focused reading session of 20-30 minutes. The full course takes approximately five hours to complete, spread across a working week without disrupting your existing workload.

Why $199 is the right number

Internal training at large commercial banks covers the framework and the policy. It does not cover the specific writing and structuring skills that make an individual artefact regulator-ready. External risk certification programmes cover methodology at a conceptual level. This course covers the practitioner skill of building the specific documents you are accountable for.

FAQ

Does this course cover a specific bank size or regulatory charter?

The course is written for practitioners at large commercial banks operating under OCC Heightened Standards or standard Fed examination cycles. The artefact types and examiner interaction patterns are most applicable to institutions over $50 billion in assets, but the writing and structuring skills apply at any regulated institution.

How quickly will I see the difference in my RCSA output?

Most practitioners notice a change in control statement quality within the first module, because the component breakdown gives immediate diagnostic value. The full impact on examiner follow-up frequency will be observable over your next one or two exam cycles.

Is this applicable if my institution uses a specific GRC platform?

Yes. The course covers the content and structure of the artefacts, not the platform used to store them. The skills apply regardless of whether you are working in a GRC system, a spreadsheet-based RCSA, or a document management environment.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.