One reason why RCSA is unproductive is that the frame of reference is so unclear…should we start with organizational units, businesses, processes, risks, controls? What standards and benchmarks and tolerances should we be evaluating against? And not least, should we allow the literary and grammatical shortcomings of a vast horde of people drive away any rational meaning and information that we an elicit from the process. Drop-down windows, anyone? With simple responses of Yes, No, and N/A across key risks and controls. Attachments of Test methods and results? And a simple elegant way to roll-up the views at each sub-level up to some meaningful whole? The fog in the mirror shall yet clear.