How to run a risk and control self-assessment that covers AI
Run an AI-aware RCSA by starting from a function-level risk register, adding each unit's AI use cases from the AI inventory, rating inherent risk, mapping and testing the controls that actually operate, rating residual risk against appetite, and agreeing dated actions for gaps. The Doorstep register supplies the starting risks and controls; the free RCSA workbook has the rating columns.
An RCSA that ignores AI now misses where many processes have changed. The method stays the same; the scope widens.
Six steps
Scope the unit
Confirm the unit, its processes and its AI and model use cases from the inventory.
Start from the register
Select applicable risks from the matching function in the Doorstep register.
Rate inherent risk
Score likelihood and impact before controls.
Map and assess controls
Match register controls to the controls you operate; rate design and operating effectiveness.
Rate residual risk
Compare against risk appetite.
Agree actions
Assign owners and dates for every gap and track to closure.
What rating scale should we use?
| Rating | Likelihood | Impact |
|---|---|---|
| 5 | Expected to occur within a year | Severe loss, regulatory action or customer harm |
| 4 | Likely | Major |
| 3 | Possible | Moderate |
| 2 | Unlikely | Minor |
| 1 | Rare | Negligible |
Primary sources (reviewed 17 Oct 2026)
This page explains supervisory guidance in plain language. It is not legal advice; confirm how each text applies to your institution and jurisdiction.
Frequently asked questions
How often should an RCSA be done?
At least annually for each unit, and again after significant changes such as a new product, system or AI use case.
Put these controls to work this month
Start on the cloud risk management software within 24 hours, or ask for training or advice tailored to your institution.