Abstract
Implementing an enterprise risk management (ERM) framework requires a technique to help identify risks and assess the effectiveness of existing controls through the three lines of defense of risk governance. The risk and control self-assessment (R&CSA) is one of those techniques. This Executive Report explores the power of R&CSA and its application to deliver value.