I have been in other GSIB banks like BAC etc. Literally, I am yet to see a big bank where risks are not directly identified on the process flow (any risk stripe) at the process step where the risk manifests, accompanied by a risk and control inventory which is sometimes an XLS accompanying the process flow, sometimes a formatted Word doc accompany the process flow and so on. The process flow or map with risks identified directly on it is the gold standard of RCSA. But not at Bull$hitty..oh no. That's for peasants. At Bull$hitty, MCA means creating a XLS that has no connection to the process map. Just dump the controls in there and that's it. Inherent risk rating? What's that...residual risk? Uh? Control effectiveness? Gee...quarter after quarter. Bull$hitty employs hundreds to run this charade every quarter. Even Bent Fargo was better despite having run a casino heist on their customers.
One exam...just one. The whole MCA charade will be taken apart by the regulators with another hefty fine and more criticism.