**RCSA**: Business units identify and assess risks in their processes; inherent vs. residual risk; control documentation - **Loss data collection**: Internal events database + ORX external data for low-frequency, high-severity risks - **Scenario analysis**: For tail risks not in historical data — ex