A control rating should have to meet last year's incidents before sign-off

When a control is rated effective in the same year an incident passed through it, the rating is the first thing to question. A risk and control self-assessment is ready for sign-off only once it has been read next to the previous year's incidents and losses, and every area rated well controlled that produced one carries either a changed rating or a written reason why the rating stands.

Two records of the same year

A risk and control self-assessment, often shortened to RCSA, is the round in which each team rates its own risks and the controls meant to contain them. It records belief: how likely things are to go wrong, and how well the controls would stop them. The incident and loss register records what actually went wrong, where, and at what cost.

Both describe the same organisation over the same period, yet they are usually produced by different people on different calendars. As a field observation rather than a research finding, a self-assessment is frequently prepared by updating the previous one, so a rating can survive for several rounds without anyone setting it beside what happened.

The Basel Committee on Banking Supervision (BCBS) draws the link explicitly. In paragraph 35 of its principles for operational risk, the Committee treats the analysis of internal events as an input to the self-assessment, and in particular to judging whether controls are effective (BCBS, 2021). It adds that comparing the frequency and severity of internal losses with the self-assessments can show a bank whether its self-assessment process works (BCBS, 2021).

For Swiss banks, page 6 of the FINMA circular on operational risks and resilience requires risk and control assessments to take into account the effectiveness of existing controls, lists internal losses among the internal factors to consider when identifying operational risks, and names the systematic collection and analysis of internal loss data among the tools to apply (FINMA, 2022). The ingredients exist; the test below is the moment they meet.

Implementation has lagged here before. When the Basel Committee reviewed 60 systemically important banks, operational risk identification and assessment was among the four principles least thoroughly implemented (BCBS, 2014).

The test in practice

Take each incident and loss of the past year and find the area, process or risk it belongs to. Read what the self-assessment said about that area and about the control that should have stopped the event. Where the assessment said well controlled, the rating moves, or its owner writes down why it should not.

The strongest objection

One incident proves little. No control stops everything, and an organisation that accepts residual risk within its appetite should expect some events where controls work exactly as designed.

In a sharper version, if every incident pulls a rating down, teams learn that reporting incidents damages their assessment, and the incident register quietly thins out. A rule meant to make the self-assessment honest would then make the loss data less complete.

Both points deserve to be conceded in part: a mechanical downgrade rule would do exactly that damage.

The answer

That is why the test asks for a changed rating or a written reason, not a downgrade. A reason stating that the loss fell within the residual risk the organisation accepted, and that the control performed as designed, is a complete answer, provided it is written down where someone else can challenge it. The test does not penalise incidents; it asks the assessment to account for them. A team that reports and explains an incident keeps its rating on the strength of the explanation, so it has a reason to report.

What the test removes is the third option, in which the incident and the rating never meet. Incomplete reporting remains a separate risk that needs a check the assessing team does not control. FINMA bases the identification and assessment of operational risks on review results, including internal and external audit findings, as well as on the risk and control assessments themselves (FINMA, 2022). Those findings are a second record to read the ratings against.

A test for your own organisation

Before the next sign-off, count the incidents and losses of the past year that came from areas rated well controlled. Then count how many of those now carry either a changed rating or a written reason. If the second number is smaller than the first, the self-assessment has not yet met the year it describes.

When an incident in a well rated area turns out to have rested on a single control, the next question is how many controls one risk should have; the knowledge base answer on risk-to-control cardinality takes it up.

References

BCBS (2014) Review of the Principles for the Sound Management of Operational Risk. Basel: Bank for International Settlements. Available at: https://www.bis.org/publ/bcbs292.htm (Accessed: 30 October 2026).

BCBS (2021) Revisions to the principles for the sound management of operational risk. Basel: Bank for International Settlements. Available at: https://www.bis.org/bcbs/publ/d515.pdf (Accessed: 30 October 2026).

FINMA (2022) Circular 2023/1 Operational risks and resilience: banks. Bern: Swiss Financial Market Supervisory Authority. Available at: https://www.finma.ch/en/~/media/finma/dokumente/dokumentencenter/myfinma/rundschreiben/finma-rs-2023-01-20221207.pdf (Accessed: 30 October 2026).