Author

Diederik Wirtz

Published

31 July 2026

Estimated Read time

4Mins

Diederik Wirtz, Director of Business Development at Aryza, explains why your RCSA data contains far more intelligence than any quarterly heatmap conveys

Every organisation running a Risk and Control Self-Assessment programme is sitting on a goldmine of intelligence. Most treat it like a compliance filing cabinet. Updated periodically, reviewed by committee, archived until the next cycle. Heatmaps get produced, RAG statuses get refreshed, and everyone moves on.

Meanwhile, the COO is trying to understand operational fragility, the CFO is modelling downside scenarios, and the CEO is preparing for a board challenge on risk appetite. All receive dashboards that tell them what happened, but almost nothing about what is likely to happen next.

This is the gap between compliance-grade GRC and enterprise-grade GRC. The difference is whether your risk and control data produces outputs executives can use to make decisions or simply confirms that an assessment process took place. The signals are already in your RCSA data, the question is whether your tools are designed to extract them.

The Problem with Snapshots

Traditional RCSA programmes produce point-in-time snapshots. A risk is assessed, a control evaluated, a residual score assigned. But snapshots tell you almost nothing about trajectory, volatility, or the compounding effects of interconnected control weaknesses.

Consider a risk assessed as “medium” with controls rated “effective” for four consecutive cycles while three of its five mitigating controls have seen their effectiveness scores decline marginally each time. No single assessment raises an alarm. But the trend line tells a different story: gradual erosion that will eventually result in a control environment that can no longer hold.

This is the slow drift, the first and most fundamental signal organisations miss. It doesn’t show up on a heatmap. But it is visible the moment you analyse RCSA data longitudinally. The executive insight is simple: “This process area has looked stable for two years, but the controls underpinning it are weakening at a rate that will become material within 12 months.” That is enterprise-grade intelligence. A static heatmap is not.

Correlation Patterns Hiding in Plain Sight

Most RCSA frameworks assess risks individually within assigned business areas. A control weakness in procurement is evaluated separately from a similar weakness in vendor management. Each looks manageable in isolation.

But when you map data across domains, clusters emerge. Control effectiveness scores for anything related to manual data handling might have declined across four different business units simultaneously, a pattern revealing a systemic issue invisible to siloed programmes. These cross-domain correlations are precisely what a COO needs when deciding where to invest in process improvement, or a CRO needs when presenting enterprise-wide exposure to the board.

The Overconfidence Indicator

When a business unit consistently rates it controls as highly effective while simultaneously reporting rising operational incidents or audit findings in the same risk category, that disconnect is one of the clearest indicators of assessment bias and it is remarkably common.

The data to identify this gap already exists. RCSA scores sit in the GRC platform. Incident data sits in the loss event database. Audit findings sit in the internal audit tracker. The challenge has always been bringing these datasets together. When you do, the mismatches become immediately apparent and points directly to the areas of your control environment most likely to fail under stress. For an executive, this is not a technical finding. It is a credibility issue.

RCSA: From Assessment to Simulation

The real step change comes when you move from descriptive analysis to predictive modelling. Monte Carlo simulation transforms RCSA utility by running thousands of scenarios against your actual assessment data, applying random variation within defined probability distributions to produce a range of probable outcomes rather than a single point estimate.

The practical applications are directly executive-relevant. In merger and integration planning, simulation allows executives to see the impact of colliding control environments before they materialise. For capital allocation, it reveals which control improvements deliver the greatest reduction in probable exposure, enabling resource decisions based on quantified impact rather than qualitative judgment. For regulatory stress testing, it provides evidence that controls have been tested against plausible scenarios, grounded in operational data.

Signals Most Organisations Miss

Several patterns consistently emerge when RCSA data is examined with greater rigour:

  • Concentration risk in control ownership — a small number of individuals responsible for a disproportionate share of highest-rated controls, creating single points of failure invisible to traditional reporting.
  • Assessment fatigue — scoring clustering around previous assessments as cycles progress, indicating the programme may be generating the appearance of oversight rather than reliable information.
  • Phantom controls — controls receiving regular effectiveness ratings that have never been independently tested or are linked to processes that have fundamentally changed since the control was designed.
  • Velocity mismatches — risk categories (cyber, regulatory change) evolving faster than the assessment cycle, monitoring them, signalling where continuous monitoring should replace periodic review.

Your RCSA data contains far more intelligence than any quarterly heatmap conveys. Monte Carlo simulation, longitudinal trend analysis, and cross-domain correlation mapping turn RCSA from a compliance exercise into genuine executive decision-support. The signals are already in your data. Analysis is what locates them.

Learn more at aryza.com

  • Cybersecurity
  • Cybersecurity in FinTech

Author

Dale Benton

Published

7 May 2020

Estimated Read time

5Mins

Read in brochure format

Leveraging Radius Networks location technology for curbside pickup, in-store order delivery, and payments.

Technology has and always will be used to solve problems. At the very basic level, technology is developed and used to make things simpler. Just look at our day to day lives and the way that technology has, for the most part, made our experiences simpler and this has changed the way we as consumers engage with retailers and restaurateurs. We now expect and outright demand that the businesses we enter and purchase food and items from offer the same level of seamlessness that we experience in our own homes. The interesting thing however, is that this isn’t necessarily a new challenge for restaurants and retail stores; these businesses have been looking to enable the most seamless and effective customer service since the very beginning. The only real thing that’s changed is the tools that they have at their disposal. 

“At the end of the day, I think this goes for business philosophy in general, you really need to understand the problems that your customers have, and then solve them,” explains Marc Wallace, CEO and Cofounder of Radius Networks, a location technology service provider. “In our case, customers are businesses, such as restaurants, grocery stores, retailers or casinos; so we are targeting very specific problems. In most cases, those problems are taking wasted time out of the equation.”

Picture the traditional, and maybe even stereotypical, restaurant environment, where a food order is ready to go to the table and the service staff has to locate and identify the corresponding table to that order. In some instances, more than most, they may even walk throughout the entire restaurant before arriving at the right table with the right customer. Through wireless-enabled location technology, Radius Networks has transformed the customer experience by allowing businesses to track customers, improve profit margins and ultimately increase customer retention. 

Customers have, and will always, vote with their feet, and in order to retain those customers, businesses need to be able to remove the pain points. As Wallace noted, wasted time is one of the single biggest pain points in customer service. Radius Networks offers location-based curbside pickup, in-store and table service solutions, as well as mobile payment technology to remove not only the one pain point, but multiple pain points. “We’re addressing other key problems, such as payments. When you dine-in at a restaurant and are in a hurry to leave, trying to get your server’s attention to pay for your bill can be frustrating for the customer. It leaves a bad taste in their mouth at the end of their dining experience,” says Wallace. 

“We’ve developed solutions for making payments remotely without contacting the server. The server is notified when the bill is paid, and they can focus their attention on real problems that other customers have instead of shuttling credit cards back and forth.”

At the time of writing, the world has been gripped by the COVID-19 pandemic, a truly unprecedented event that has completely devastated lives and economies all over the world. It has also completely ripped up the rulebook when it comes to food and retail, with lockdown restrictions forcing businesses to either close down entirely, or pivot to delivery services. Radius Networks’ FlyBuy curbside pickup solution was actually launched over 12 months ago, but it has fast become a key technology offering that is solving an unforeseen problem. By automating the curbside delivery service for customers, FlyBuy provides a turnkey, end-to-end solution that uses the customer’s location for a faster, easier order pickup experience. “There was already a pre-existing return on investment (ROI) with FlyBuy because we were reducing the wait times for customers when ordering for pickup, which results in more frequent visits” says Wallace. “Throughout this pandemic, curbside delivery has become the only channel that people can do, so the importance of it has risen dramatically. It was once within a business’s top ten things it needed to consider, and has now risen to the very top of their to-do list.” 

Radius Networks is currently offering a free version of both its FlyBuy curbside and buy-online-pick-up-in-store (BOPIS) software for restaurants, retailers, and non-profits during the COVID-19 crisis.

By its very definition, location tracking technology appears to be very intrusive. It is tracking locations and using that data to inform decision making, after all, and naturally that can cause a little fear and a hesitation. Wallace acknowledges these concerns and understands them wholeheartedly. “We had a decision to make early on in the company whether we were going to harvest data and use it for marketing purposes or whether we were going to be a privacy-centric company and focus on providing a solution,” he says. “We chose to be a privacy-centric company, mostly because all of us as individuals wanted that for ourselves.”

“When it comes to us as a location company, are very transparent with our customers and our businesses, so that they can be transparent with their consumer customers about what we’re doing with their location data, what we’re using it for, and how long we’re keeping it.”

This transparency is built into the very DNA of the company. FlyBuy will only ever use the location data to alert restaurant/retail staff that a customer is on the way and onsite to pick up their order, and only after the customer has opted-in to sharing that information. After a period of time has passed, they will then delete that data entirely. Its policy dictates that it does not, and will never, share that data with any third party, giving customers peace of mind that their data is safe and used only as agreed when they opt-in. Wallace believes that, while the reluctance and fear is understandable, consumers have access to services’ policies and can ‘do some homework’ in order to allay them. “I think, given the amount of options we are given today, customers can no longer just assume every location company is tracking or doing something devious with their information. They need to be aware when they approve location usage and when they don’t,” he says. “If they can be sure that sharing their location brings value to them, whether it be to have a car service come to their exact location, or their groceries meet them at their car immediately upon arriving in the pickup zone, they will happily share their location. Once they have established a level of trust in the people that are requesting location permissions, and see the benefits it brings to their lives, there is no problem.”

Radius Networks was founded in 2011, and for the best part of a decade, it has grown from strength to strength as a business, working with the likes of McDonald’s, Five Guys, and Coca-Cola, as well as being recognized in the INC 500, the Deloitte Fast 500, and the CIO Magazine’s Most Promising Digital Experience Solution Provider. But none of these successes would have been made possible, without a solid and sound foundation within the business. “I’ve been told by people ‘wow you guys got really lucky.’ Luck had absolutely nothing to do with it. Our mission is to solve problems for businesses, and right now businesses need our help more than ever. There were a lot of really difficult times over the years where we worked hard and earned the right to stay in the game, and we are once-again earning it right now,” says Wallace. 

“Take FlyBuy as an example. I’ve been asked as to whether I thought this piece of technology that we developed over the last few years would ever be as important as it is right now. Yes. Yes I did, and so did everyone else on our team, and that’s key to our success as a company. Every single person at Radius Networks is engaged and believes in what we do.”

In these times of crisis, the spotlight has shifted significantly onto those business fundamentals and Wallace is extremely proud of the business he has built and the people within it. “The business principles that we’ve been practicing over the last few years have paid off. We are a strong company with sound fundamentals and sound financials. We haven’t over extended ourselves, either from an investment perspective or from an expenses perspective and that’s paying off for us now,” he says. 

“It is tough in the current environment to point to positives, because you almost feel ashamed to do so. I think we’ve done a lot as a company to help others; we’ve given our product away for free to hundreds of small businesses, thousands of locations, with no obligation, and it’s a testament to the work we have done to get to this point. A lot of companies are doing a lot of good work to help each other right now and they can do so because they are built on solid foundations.” 

Those foundations start from the very top. Wallace is a key advocate in communication. Much like Radius Networks communicates in an open and transparent way with its customers, the same rules apply from within. He admits that the pandemic has, ironically, made that communication better in some aspects, but it has always been a key part of what makes Radius Networks tick. “We’re talking to our customers all the time. My team is the best team in the world. They’re working in overdrive right now, communicating at such a high level, and listening to customer needs, because their needs have changed dramatically,” he says. 

“As the CEO, I try to have frequent hands-on-deck tag-ups with everybody to give them an update and try to be as transparent as possible about the status of the business and what’s happening. I do this so they can feel comfortable that they have a job today, and they’ll have a job tomorrow. We work together to come up with our team goals, and stay aligned and upfront about everything that may come up along the way.” 

Listening to the customer is key. That much is no secret. But when it comes to technology, listening to customers is absolutely essential when ensuring that what you’re offering is what the customers need and what they want. Wallace’s role as the CEO is not to sit at the top of the business and leave it to everyone else. He is very much active and engaged at every level to ensure that everything Radius Networks is doing is driven by the customer. Wallace is proud of the culture within his business and often finds himself sitting on a call with a major customer and beaming at how well his team listens and understands the customer’s needs and how Radius can successfully address them. “I’m so proud that we, as a team, have a culture that takes so much pride in their work,” he says. “Our people have always been solid employees, pre pandemic, but they have become absolute rockstars today.”

The world as we know it has changed forever and we cannot begin to predict what this new world will look like post pandemic. One thing is for certain, communication, and the way in which businesses engage with their customers, will never be the same again. Radius Networks has enjoyed success after success over the past ten years, and as we all experience great uncertainty, the goal for Wallace is to continue providing valuable location technology for many years to come. The key to succeeding, regardless of such uncertainty, remains the same for Wallace and his team. “Persistence,” he says. “It’s about persisting through the bad times, just like the good times, and trusting your business fundamentals and experience. Being transparent with employees and having a good team around you is key.”