Quarterly RCSA cycles
Run the same scored questionnaire across business units so residual risk is comparable rather than a matter of local scoring habits.
— Risk & Compliance
RCSA questionnaire → risk register
Runs a scored risk and control self-assessment questionnaire and calculates residual risk identically every time, producing a register comparable across teams and quarters.
- Risk & Compliance
- Deterministic scoring
- Traceable reasoning
- Runs anywhere
1 week → ~10 minutes
For one complete, review-ready pass
No coding required
- Input
- Your risk taxonomy and control descriptions
- Output
- A risk register table: inherent score, key controls, residual score, action, owner
- Runs in
- Skillsize · ChatGPT · Claude · Copilot
- Export
- SKILL.md · MCP
- Time saved
- ~1 week per run
— USE CASES
What people use RCSA questionnaire → risk register for
First-line risk registers
Give process owners a structured self-assessment that outputs a register with owners and actions, not a free-text form.
Audit committee reporting
Produce a register where every inherent and residual score can be traced back to the answers that produced it.
What it works from
- Your risk taxonomy and control descriptions
- Likelihood, impact and control-effectiveness scales
- The process or entity in scope
What you get back
- A risk register table: inherent score, key controls, residual score, action, owner
- Deterministic weighted scoring applied identically every run
- A scored answer trail behind each risk
— HOW IT BEHAVES
How RCSA questionnaire → risk register produces its result
The mechanics behind this specific template — what it reads, what it calculates, and where a human stays in the loop.
Deterministic scoring
Scores come from a fixed scoring form rather than model judgement, which is what makes results comparable across submissions.
Composed as work product
Findings are written up as a document that reads like professional output rather than raw model text.
Delivered as a working table
Results land as a clean table you can sort, filter or drop straight into the deliverable.
Why this is expensive by hand
Risk and control self-assessments usually live in a spreadsheet that every assessor scores slightly differently. In practice it shows up as quarterly RCSA cycles: run the same scored questionnaire across business units so residual risk is comparable rather than a matter of local scoring habits. The value sits in the rigour, not the typing — yet the rigour is exactly what gets traded away when there is only 1 week of capacity for it.
How this Skill produces it
As a Skill, the work is already sequenced. You bring the evidence, and the run produces a risk register table: inherent score, key controls, residual score, action, owner plus deterministic weighted scoring applied identically every run. The judgement is built in — how items are broken up, what standard they are held to, and where the run stops for a human review. The practical effect: 1 week of manual work becomes a ~10 minutes run, held to an identical standard on the tenth engagement as on the first.
Who it's for
- Independent consultants codifying their own methodology
- Strategy and transformation teams standardising delivery
- Internal advisory functions under pressure to produce faster
- Operators who need defensible output, not a one-off chat answer
Run it in Skillsize — or export it anywhere
RCSA questionnaire → risk register exports as a structured SKILL.md file and is MCP-ready, so the same method runs in ChatGPT, Claude, Copilot or your own AI products. Adapt it to your methodology, and the intelligence stays yours — not locked to one vendor.
ChatGPTClaudeCopilotAI Products (MCP)
More Risk & Compliance Skills
Browse the full library →Risk & Compliance
Regulation scan
Researches regulatory change in a defined area, classifies the findings, and states the implications for your specific business context.
Risk & Compliance
Control gap assessment (SOC 2 / ISO 27001)
Extracts documented controls and framework requirements, then grades every requirement covered, partial or absent for SOC 2 or ISO 27001 readiness.
Risk & Compliance
Audit evidence mapping
Maps an uploaded evidence set against a list of assertions or PBC items to produce a coverage matrix, flagging unsupported assertions and orphaned documents.