Facilitating the workshop: the questions that work

The problem with the direct question

"What are your main risks?" produces three kinds of answer, all useless: last year's list copied over, the generic risk that costs nothing to declare, and the risk whose treatment belongs to another department.

The four questions that work

1. "What nearly went wrong in the last six months?"

Near misses are the richest raw material. They are recent, concrete, and telling the story costs nobody anything since no loss occurred.

2. "What worries you when you go on holiday?"

This surfaces human dependencies and controls that only work because one person compensates for them.

3. "If you had to commit fraud, how would you go about it?"

Asked in a trusted setting, it reveals control weaknesses better than a procedure review. Frontline staff know the blind spots in their own arrangements perfectly well.

4. "Which control do you perform that you consider pointless?"

Controls perceived as pointless are the ones abandoned under workload. Identifying them lets you either remove them or explain their purpose.

Assessing a control honestly

Control scoring is where RCSA most often loses credibility. Four questions objectify it:

Four yes: effective control. Three yes: partially effective. Fewer: no control, whatever the procedure describing it says.

The expected output

An RCSA campaign produces three deliverables, not a table:

1. Risks whose residual exceeds appetite — they require a decision;
2. Controls to create, strengthen or remove, with an owner and a date;
3. Risks explicitly accepted, with the accepting body.

The third deliverable is the one almost always missing, and yet it is the one that protects the organisation: a risk accepted in writing is a management decision; a risk neither treated nor accepted is negligence.