Vice President, ERM Governance & Reporting

To drive and continuously enhance organisation-wide risk governance through effective implementation of the Enterprise Risk Management (ERM) framework, Corporate Risk Profile, risk monitoring, and reporting. The role acts as a trusted advisor to business and project teams, while driving continuous improvement in risk management practices to support informed decision-making. It supports the implementation of ERM frameworks and methodologies, Third-Party Risk Management (TPRM), Risk and Control Self-Assessment (RCSA), risk capability and culture, legal risk monitoring, SORMIC, regulatory requirements, and other enterprise risk initiatives, ensuring consistency, accountability, and timely execution across divisions.

1.   Enterprise Risk Management: Assessment, Monitoring, Reporting and Communication

• Lead the implementation and execution of the Corporate Risk Profile process, ensuring alignment with the established ERM framework, organisational objectives, and risk appetite.
• Manage the preparation and delivery of Corporate Risk Profile reports, ensuring timely, accurate, and insightful reporting to management and governing bodies.
• Oversee the monitoring of enterprise risk exposures and KRIs, including timely escalation of significant risk movements, breaches, and key risk insights.
• Assess risk exposures and mitigation effectiveness, while tracking mitigation actions and outstanding commitments to ensure timely follow-up and closure.
• Manage stakeholder engagement across divisions to ensure alignment, completeness, and quality of risk inputs and outputs.
• Provide independent challenge and quality assurance over risk assessments and Corporate Risk Profile outputs to ensure robustness, completeness, and consistency.
• Drive continuous improvement of Corporate Risk Profile processes, methodologies, and reporting to enhance consistency and quality across divisions.
• Coordinate organisation-wide risk assessment and reporting activities, ensuring timely submission and effective execution across divisions.
• Manage the end-to-end review and approval process for SORMIC, ensuring stakeholder feedback, regulatory requirements, and governance expectations are addressed prior to inclusion in the Annual Report.
• Provide risk advisory support on strategic initiatives and projects, embedding risk considerations into decision-making.

2.  Risk Framework, Policy, Procedures and Methodology

• Lead the implementation and continuous improvement of the organisation’s ERM framework, policies, procedures, methodologies, and guidelines to support effective and consistent risk management practices across divisions.
• Manage the periodic review and enhancement of risk-related governance documents, ensuring they remain relevant, practical, and aligned with organisational objectives and regulatory requirements.
• Oversee the consistent application of risk assessment methodologies, criteria, rating scales, and risk taxonomy across the organisation.
• Provide guidance and advisory support to business units on the interpretation and application of ERM frameworks, policies, procedures, methodologies, and guidelines.
• Review the effectiveness of existing risk management processes and methodologies, identifying gaps and recommending improvements to strengthen overall risk management practices.
• Coordinate enhancements to the organisation’s risk appetite framework, risk assessment criteria, KRIs, and related risk management methodologies.
• Ensure changes to ERM frameworks and methodologies are effectively communicated and implemented across divisions.
• Provide independent review and challenge on the application of risk methodologies to ensure consistency, completeness, and quality of risk assessments and outputs.
• Monitor developments in risk management practices, regulatory requirements, and industry standards, and recommend appropriate enhancements to existing frameworks and methodologies.

3.       RCR Management

• Lead and drive proactive engagement of Risk & Compliance Representatives (RCRs) to strengthen risk awareness, ownership, and accountability across divisions, fostering a consistent and embedded risk culture.
• Plan, organise, and deliver structured RCR capability development programmes, including education, workshops, training, and refresher sessions.
• Conduct targeted ad hoc engagements to address emerging risks and reinforce effective and consistent risk management practices across divisions.
• Define and reinforce RCR roles, responsibilities, and expectations.
• Gather feedback from RCRs and refine tools, templates, and processes
• Provide ongoing guidance and advisory support to RCRs on risk matters.
• Align RCR activities with RCSA, KRI, incident management, and reporting cycles.

4.       Risk Culture and Awareness

• Drive the implementation of organisation-wide risk capability and culture initiatives to strengthen risk awareness, ownership, and accountability across divisions.
• Develop and execute structured risk capability development programmes, including education, workshops, training, awareness campaigns, and engagement initiatives.
• Drive proactive engagement of Risk & Compliance Representatives (RCRs) and other relevant stakeholders to strengthen risk awareness, ownership, and accountability, and support effective implementation of risk management practices across the organisation.
• Assess risk capability and culture through surveys, assessments, feedback mechanisms, and other appropriate measures to identify gaps and opportunities for improvement.
• Develop and maintain risk management learning materials, communication content, tools, and guidance to support consistent understanding of risk management practices.
• Conduct targeted awareness and engagement initiatives to address key risk themes, organisational priorities, regulatory developments, and identified capability gaps.
• Monitor the effectiveness of risk capability and culture initiatives and recommend appropriate actions to strengthen overall risk management maturity.
• Collaborate with Human Resources, Compliance, business units, and relevant stakeholders to integrate risk considerations into organisational learning and employee engagement initiatives.
• Promote the sharing of risk insights, lessons learned, case studies, and good practices to strengthen organisational learning and awareness.
• Drive continuous improvement of risk capability and culture programmes, tools, and engagement approaches to enhance effectiveness and participation across divisions.

5.       Risk and Control Self-Assessment (RCSA)

• Support the end-to-end execution of the RCSA process to ensure consistency, accuracy, and quality of outputs across divisions.
• Support robust risk identification, assessment, and documentation, including challenge and quality assurance of RCSA outputs.
• Support the tracking and monitoring of mitigation actions to ensure timely follow-up and closure.
• Support continuous improvement of RCSA frameworks, methodologies, procedures, questionnaires, and risk registers.
• Support cross-divisional coordination and stakeholder engagement to ensure alignment, completeness, and quality of risk inputs and outputs.

6.       Third Party Risk Management

• Support the implementation and execution of the TPRM framework, ensuring alignment with organisational risk appetite, regulatory requirements, and internal governance standards.
• Support third-party risk assessments and due diligence to ensure key risks, control gaps, and mitigation measures are appropriately identified and assessed.
• Monitor third-party risk exposures and mitigation actions, ensuring timely follow-up, escalation, and closure of identified risks and control gaps.
• Support stakeholder engagement and reporting to ensure effective oversight, accountability, and ownership of third-party risks across the organisation.
• Support continuous enhancement of TPRM processes, methodologies, and tools to improve consistency, efficiency, and overall effectiveness.

Academic qualifications & professional certificates

• Bachelor’s degree in business, Finance, Accounting, Risk Management, Information Technology or related discipline.
• Minimum 8–12 years of relevant experience in risk management, compliance, audit or related functions, preferably within a financial services or regulated environment
• Strong understanding of Enterprise Risk Management (ERM), risk governance principles, frameworks and practices.
• Hands-on experience in core Enterprise Risk Management areas, including Corporate Risk Profile, RCSA support, KRI monitoring, risk appetite, risk reporting and SORMIC.
• Proven experience in engaging with business units and stakeholders to support risk identification, assessment and mitigation
• Experience in preparing risk reports for Management or committees
• Strong analytical, communication and stakeholder management skills