Leads the Enterprise Risk Management and Business Resilience teams. The role is accountable for putting integrated risk framework into operation across the enterprise, running it, and improving it over time. This role will take the framework, taxonomy, scoring methodology, impact matrix, and resilience model to all four pillars and every enterprise function, running the assessment and resilience cycles, and building the discipline that keeps them working. The role sits in the Second Line of Defense, and it advises First Line business leaders while holding the independent oversight a governance function requires. It also coordinates the Aligned Assurance Model on behalf of the function, bringing assurance activity into one plan.
Lead and grow the Enterprise Risk Management and Business Resilience teams, covering enterprise risk, business continuity, and crisis management
Set direction and standards of work
Build depth so the function does not depend on any one person
Own career development for the team and create the exposure that makes development real
Advocate for the team across the enterprise, so their work is visible to leadership and to business partners
Put the integrated risk framework into operation across the enterprise, covering enterprise risk assessment, issue management and resilience, and land it in all four pillars and every enterprise function
Run the assessment lifecycle on its established cadence: the full enterprise cycle, the alternate-year refresh, quarterly maintenance, and targeted assessments triggered by events
Improve the program continuously
Strengthen what works, close gaps as they surface, and fold small improvements into routine work instead of holding them for a separate initiative
Protect the integrity of the framework in use. One taxonomy, one scoring scale, one register, one issue standard, applied the same way in every entity and function
Build the enterprise risk appetite and tolerance framework with business and finance leadership, then put appetite monitoring into practice against it
Provide independent oversight of First Line risk activity, with the challenge and the support that makes business leaders accountable for their own risk profiles
Advise pillar and function leaders on decisions where risk matters: strategic shifts, transactions, product launches, operational change
Give the First Line the tools, guidance, and training to carry its own risk and control responsibilities
Rebuild stakeholder confidence in the function. Plain language, inside the cycles the business already runs, and a closed loop on every input received
Run business continuity and crisis management on the value chain resilience model, built around value streams, critical processes, and dependencies instead of individual assets
Own incident classification and escalation, so events are recognized against a defined threshold rather than by someone's judgment in the moment
Direct the exercise and testing program
Make sure findings drive systemic control improvement instead of closing as isolated actions
Keep the enterprise dependency register and the loss scenario library current as exposure changes
Coordinate the Aligned Assurance Model for the function, bringing assurance activity into one synchronized plan and a shared view of the control environment
Partner with Internal Audit on testing schedules and shared assessment data, so Second Line monitoring informs Third Line planning
Work across information security, compliance, privacy, quality, and health and safety to align calendars, issue handling, and reporting
Cut assessment and audit fatigue by simplifying how information is collected from the business and reported to governance committees
Lead strategic risk management
Identify the risks that threaten enterprise strategic objectives, and surface the planning assumptions carrying risk the register has not captured
Coordinate between Enterprise Risk Management and Corporate Strategy, so risk input arrives while…