2016-FRR Web TestEngine demo

An RCSA is only complete after all possible mitigating actions have been identified and analyzed as a result of the assessment process.

Internal loss data help to identify the risks and control weaknesses that need to be addressed in the RCSA; external events are not helpful in informing the discussions around potential risks.

The RCSA scoring methodology should include only financial impacts and not include reputational, legal, regulatory, client and life safety impacts.

To ensure that the RCSA is well designed, it is important to interview participants, stakeholders and support functions prior to the launching the RCSA.