Head, Non-Financial Risk J o b D e s c r i p t i o n
JOB INFORMATION
Job Description Name: Manager II, Non-Financial Risk
Position Title: Head, Non-Financial Risk Jersey
Country / BU Applicability: Jersey
Job Code: 60051266
Job Family: Risk & Corporate Affairs
Sub-function: Non-Financial Risk Management
JOB PURPOSE
To provide pro-active management and operational support enabling the implementation of the Non-Financial Risk (NFR) management strategy across the Business and Commercia Banking Clients (BCB), Personal and Private Banking (PPB), and Asset Management (AM) business units considering the relevant 17 risk types, and risk management processes to identify and mitigate NFRs.
JOB FUNCTIONS
Essential Functions
Act as an interface for NFR in driving fraud risk management and liaising with NFR teams on information risk threats and controls in business strategy for all business units across all segments and channels.
Act as the trusted risk management business partner by equipping business with the tools to mitigate financial, reputational, and regulatory impact of NFR incidents.
Build and maintain credible relationships with internal and external stakeholders, including management, internal and external audit, non-executives, regulator as well as peers in local and international banks where applicable.
Challenge and oversee the RCC process by ensuring effective risk focus and dialogue, reports and escalations that are based on factual data relating to framework and actions that drive clear accountability and ownership.
Collaborate with direct and indirect reports to achieve desired business results through continuous improvement and mentoring activities.
Complete the Risk and Control Self-Assessment (RCSA) for applicable business areas by considering all 16 risk types and capture onto the NFR management system.
Conduct analysis of business impact and contribute to the formal process of driving risk acceptance for residual risk for items where the residual risk is too high, prepare recommendations to decline the requested change, and escalate to senior management for consideration.
Conduct effective risk scenario planning by gathering and analysing information in preparation for and during scenario iteration.
Contribute to succession planning initiatives by identifying strategically critical roles, flight-risk employees, and skill shortages in collaboration with Human Capital and participate in follow-up actions or interventions to ensure resource sustainability.
Contribute to the development and instilment of a risk and control culture, within the functional areas, through participating in knowledge sharing initiatives and awareness campaigns on the importance of risk management.
Deliver value-adding risk assessments and advice to strategic/other change projects and new products to ensure changes to the business risk profile are properly quantified and mitigated/managed within agreed risk appetite.
Determine high risk and/or high impact projects/programs/initiatives /cloud deployments within the line of business by using the applicable risk assessment tool.
Drive a high-performance culture through leading by example in applying the performance management process rigorously to direct reports.
Drive the execution of the NFR strategy and framework, which are aligned with business specific requirements, by considering the risk appetite and by implementing group policies, processes and guidelines via the NFR teams across the various segments and products, where applicable.
Essential Functions
Drive the relevance of the NFR framework by critically evaluating the effectiveness thereof and recommending amendments in line with emerging risks and threats.
Embed the NFR framework throughout the business areas by regularly engaging with all levels of leadership and management to help them understand the benefits of looking at their worlds through a risk management lens incorporating the 16 risk types.
Facilitate awareness and oversight of the LAM policy and address significant information risk and management.
Facilitate the documenting of root cause analysis of any major/significant information risk related incidents, in alignment with the integrated operational risk to initiate prevention.
Facilitate the scenario discussion between business partners, risk owners and operational risk by challenging assumptions of business partners to ensure that the business unit/s risk profile is truly reflected in its scenarios and obtain sign-off from the individual risk owners, business unit heads and relevant committees.
Give guidance and provide insight to process, product and policy owners on improvements required prior to the implementation of control measures by seeking input from Group Financial Crime Control and the Group Information Risk Office as subject matter experts.
Implement and support the transition and adoption of the Advanced Measurement Approach (AMA) principles in business through training and support initiatives to ensure full ownership and understanding of capital calculation, scenario analysis and expected loss calculations.
Implement data-led Non-Financial Risk (NFR) decisions and interventions in the lines of business.
Implement proactive actions around the management of prevailing, emerging and top Non-Financial Risk (NFR) exposures with urgency.
Manage NFRs by identifying inadequacy of, or failure in internal processes, people and/or systems or from external events across complex operating structures with significant overlaps of the 16 risk types under the umbrella of Operational Risk.
Manage talent effectively by continuously analysing and identifying leadership and technical development needs and upskill through facilitating appropriate training and development initiatives.
Management of own cost centre budget, if owner of a cost centre, within scope.
Measure and entrench the desired Non-Financial Risk (NFR) culture across the 3 lines of defence through proper metrics and incentives.
Monitor the actual losses vs. the risk appetite and include the necessary interventions to minimize financial impact.
Optimise the Risk Market Place (RMP) functionality to unleash the full value-adding capability of Risk as a Service (RaaS) to the Group.
Own the implementation of the NFR framework to enable the proactive identification, assessment, measurement, management, monitoring and reporting of model risk.
Participate and provide input into all material planned changes - strategy changes, product changes, segment changes, system changes and process changes - and provide a proactive view of the potential risks that the changes may bring into the organisation.
Participate in recruitment and selection initiates in collaboration with Human Capital and direct reports for business efficiency and effectiveness.
Participate in the review workforce and headcount plans for the team by including requests for headcount changes and approving and declining headcount requests within overall mandate.
Participate, review, and monitor key people metrics - attrition, vacancy rates, reasons for leaving, absence rates, grievances, leave, disciplinaries etc. and define strategies/interventions to improve the working environment if the indicators show adverse trends.
Partner with business leadership through active participation in Business Risk Control Committees (BRCCs) and other strategic forums to translate NFR into business specific resilience capabilities.
Provide guidance and oversight on the implementation of the defined Information risk strategy by advising on the information risk policy, identifying information risks in projects and business initiatives and by reporting on the information risk posture at relevant committees.
Provide guidance and support to business stakeholders by training on and embedding risk policies so that they can perform information risk related activities or functions and implement policy requirements effectively.
Provide guidance to business in regards with Information risk by identifying key information assets, risk events, causes and assist with the risk treatment to ensure that all significant information risk and control weaknesses are mitigated and if material reported.
Provide oversight and guidance to the business stakeholders during the third-party life cycle by challenging the mitigation in place if not aligned to the risk appetite, assessing the adequacy of control measures in managing the level of risks associated with third party engagements and by monitoring the overall third-party process to make sure it complies with the Third-Party Risk Management (TPRM) Framework.
Report critical, material third-party engagements, challenges, or trends to the TPRM team as well as relevant risk governance forums such as Risk Control Committees (RCC) and determine the level of assurance required related to the third-party engagement by consulting with risk type owners, where required.
Represent NFR and articulate risks effectively at relevant business unit committees by critically reviewing 1) all business cases for product and process changes, 2) control measures that have been designed for these changes.
Stay abreast of all regulatory and compliance changes through sufficient engagements and collaborations with key stakeholders (IT Security, Data Governance, Logical Access Management (LAM), Payment Card Industry (PCI) Compliance and Data Privacy.
Essential Functions
Understand and implement the application of Payment Card Industry Data and Security Standards (PCI DSS) by following principles and associated criteria to determine the status of business units to prevent, mitigate or escalate risks where required.
QUALIFICATIONS
Education
Type of Qualification Field of Study Required/ Preferred
And/Or
First Degree Business Commerce Required
First Degree Risk Management Required
Post Graduate Degree Business Commerce Preferred
Post Graduate Degree Risk Management Preferred
Work Experience
Experience Experience Details Required/ Preferred
3-4 years
Practical knowledge and experience under Information Risk which would include an
understanding of the Standard Bank South Africa (SBSA) Information Risk Framework and Data Privacy Standard or Industry exposure to similar standards
such as the Information Security Forum (ISF) Standard of Good Practice and Protection of Personal Information Act (POPIA).
Required
5-7 years
Practical knowledge of risk, control frameworks, assurance & applications in financial services industry. Fully conversant in risk appetite, risk response & process
improvement concepts. Understand both non-financial risk and financial reporting risk characteristics.
Required
Total number of years' experience 7 years
Behavioural Competencies - Essential
Behavioural Competency Description
Articulating Information Is articulate in giving presentations; is eloquent and explains things well; projects social confidence when articulating information
Challenging Ideas Prepared to disagree and question assumptions; challenges ideas and established views; comfortable arguing own perspective
Convincing People Is comfortable having to persuade others; shapes opinions by being outspoken; seeks to negotiate with others
Directing People Is comfortable leading people; coordinates and directs groups; seeks to control things
Embracing Change Copes with change and variety; tolerates uncertainty and ambiguity; adapts to new challenges
Examining Information Analyses and processes information; asks probing questions; strives to find solutions to problems
Exploring Possibilities Is conceptual when developing ideas; applies theories to problem solving; prefers to learn by thinking and identifying underlying principles
Generating Ideas Is creative in producing ideas; assumes an original approach when generating ideas; adopts radical solutions
Making Decisions Is determined and decides on actions; willingly assumes responsibility; is definitive and stands by own decisions
Providing Insights Is focused on continuously improving things; provides insights by identifying key issues; makes intuitive judgements
Behavioural Competencies - Essential
Behavioural Competency Description
Resolving Conflict Is comfortable calming upset people; handles angry individuals well; is focused on resolving conflict and arguments
Upholding Standards Behaves ethically and justly; is discreet and maintains confidentiality; meets commitments by acting with integrity
TECHNICAL COMPETENCIES
Competency Group Governance - Risk - Compliance
Competency Level Competency Description
Analysing Insurable Risk 2. Proficient The ability to facilitate risk assessment to gain an understanding of risk impacts, thus developing the profile of insurable risks.
Economic Capital Management 3. Seasoned Understands the capital implications of the stated risk appetite, individual risk exposures, portfolio risk exposures, and determines capital requirements on a risk adjusted basis.
Evaluating Risk Management Effectiveness
3. Seasoned The ability to determine if risk management and control measures are achieving the desired results and mitigating risks at the expected level.
Risk Identification 4. Advanced The examination of the essential elements of risk such as; assets, threats, vulnerabilities, safeguards, consequences and the likelihood of the threats materialising.
Risk Measurement 4. Advanced The ability to define and analyse risk identification information in a quantitative and/ or qualitative way.
Risk Reporting 4. Advanced The ability to prepare quantitative and qualitative analysis on the risk landscape in the business including interpretation and analysis for use by business users.
Risk Response Strategy 4. Advanced The ability to facilitate the creation and adoption of an appropriate risk response strategy and to assign ownership for the risk response.
Risk/ Reward Thinking 4. Advanced The ability to provide due consideration to risks, rewards and the cost of control measures in evaluating business opportunities, process and system changes.
TECHNICAL COMPETENCIES
Competency Level Competency Description
TECHNICAL COMPETENCIES
Competency Level Competency Description
TECHNICAL COMPETENCIES
TECHNICAL COMPETENCIES
TECHNICAL COMPETENCIES
SCOPE
People Management:
# Direct Resources Managed # Indirect Resources Managed
This position manages/supervises people 1-3 1-10
Managerial Archetype
Financial Responsibility
Controllable Expenses (e.g., payroll and other budgeted items
R500 000 - R2,5 million
Budget Responsibility
Amount Notes
R500 000 - R2,5 million Primary Budget Responsibility
Contact with Others
Contacts Description May need to engage with consultants such as auditors when external reviews are undertaken. Provide direction and guidance to the functional areas regarding the ongoing management of NFR and operational risks for example Internal Audit and Compliance.