Risk Advisory Business Partner-Operational Risk
Risk Identification and Assessment
Collaborate with the business to identify and assess its material risks from business as usual activity, emerging risks, strategic and change initiatives, etc., ensuring they are understood as part of commercial and decision making activity. Support the business as it undertakes risk assessment activity (e.g. Risk and Control Self-Assessment, Top Down Risk Assessment, Scenario Analysis, Root Cause Analysis, etc.,) and leverage expertise to challenge the business’s logic/assumptions to ensure the assessments are thorough and complete.
Risk Appetite
Work proactively with the business to define the Group’s risk appetite (including risk appetite thresholds and key risk indicator (KRI) metrics/thresholds), ensuring it is appropriate in relation to the business’s activity and risk profile. Review the business risk profile against risk appetite and work with the business to identify appropriate actions to address risks that fall outside appetite.
Strategic Risk & Change Management
Partner with the business to identify, assess, and manage risks that could potentially hinder the achievement of its long-term strategic objectives. Help the business identify and assess risks regarding strategic initiatives (e.g. M&A, new product development, new business ventures, etc.,) and the potential impact on the business’s risk profile. This includes the financial, operational, regulatory and cultural risks that could impact the success of the initiative, ensuring the business has all necessary information to make informed decisions and ensure a smooth execution. Review new business requests (as part of the Change Management Process) to ensure there is a complete and accurate understanding of the initiative and its risk profile, and that appropriate actions are taken by the business and support functions to mitigate/manage any risks arising from new business activity.
Risk Mitigation and Management
Work with the business to ensure its end-to-end risk profile is managed actively and appropriately and in a commercial manner. Partner with the business to evaluate the adequacy of its control and policy framework in mitigating the risks that are inherent to its risk profile and leverage expertise to challenge the business’s logic/assumptions to ensure controls are adequate and effective. Support and challenge the business in identifying deficiencies in its control and policy framework. Provide an appropriate level of constructive challenge to: ensure the business’s plans to address control deficiencies will address shortcomings properly and in a timely manner, and/or ensure a risk-based analysis has been conducted to assess how a risk acceptance could affect the business's risk profile. As needed, collaborate with/conduct assurance activity being undertaken including controls testing, and undertake targeted risk reviews on hot topics/areas of interest across the Group.
Risk Monitoring and Reporting
Support the business in monitoring its end-to-end risk profile. This includes ensuring appropriate MI, analysis and commentary are produced regarding (but not exclusive to): the performance of risk appetite metrics and related KRIs against established thresholds; significant internal and external risk events that could impact the business, as well as the Group’s response to reduce the likelihood of an occurrence/recurrence of these events; significant issues and the status of the Group’s response to remediate these issues; risks identified and the proposed mitigating actions; risk-related data (e.g., events, issues, metrics, etc,.) to help identify meaningful trends; the Risk team’s assurance activity. Take part in regular engagement and/or management meetings to provide an independent second line view of the business’s risk profile. Provide monthly updates on risk-relate MI, analysis, emerging threats, etc for Risk Leadership Team meetings. Draft commentary for risk committees as required.
Events, Issues, Risk Acceptances and Policy Breaches
Support the business: in the immediate actions to mitigate or contain significant events and ensure those events are escalated to the appropriate level of management, and to ensure that risk matters arising on a day-to-day basis are managed in accordance with risk framework requirements. Provide quality assurance over Events, Issues and Policy Breaches. Support the business in undertaking deep dives into significant internal and external events, ensuring mitigants/controls are adequate and effective. If control deficiencies are identified ensure appropriate remediation plans are developed and executed.
Business Continuity Planning and Crisis Management
Provide independent oversight over business continuity plans to ensure the business can continue operating during and after a disruption. Support business in developing remediation plans if gaps/deficiencies are identified during Business Continuity tests. Ensure plans are executed in a timely manner and business continuity plans are updated accordingly. Partner with the business to help coordinate with crisis management teams to ensure effective response and recovery actions are taken to assist the business respond to crisis situations, in line with the Group’s crisis management framework.
Training and Awareness
Promote a risk-aware culture across the business and coordinate and conduct training sessions to enhance risk awareness and competency across the business and organization. Raise awareness about risk management practices leveraging Risk’s business engagement strategy.
Regional Requirements
Provide regional support to ensure that the region’s risk management-related activity and governance requirements are properly managed.