Operational Risk & Assurance Manager

Key Responsibilities

Risk Register & Reporting

• Own the ACFC operational risk register covering known and accepted risks with owners due dates and escalation triggers
• Define and track Key Risk Indicators (KRIs) for each vertical and for ACFC as a whole
• Prepare and present the monthly ACFC risk pack in person at the leadership forum covering top risks trends and overdue actions
• Escalate material risks that are not being addressed to the Head of Operations

Vertical Accountability Reviews

• Run a monthly review session with each vertical where leads walk through ageing items SLA and KPI misses overdue remediation and missed SOW deliverables
• Pull data directly from tools and trackers so that figures are reviewed as they are not as reported
• Agree actions with owners and dates and track every issue through to closure
• Keep reviews firm on facts and constructive on the way forward with the aim of helping teams deliver

Risk & Control Self-Assessment

• Run a quarterly risk and control self-assessment (RCSA) with each vertical
• Validate declared risks and controls against evidence and maintain the ACFC control register

Incidents People Risk & Continuity

• Maintain the ACFC operational incident record and track incidents to closure for example client data sent to the wrong recipient
• Map people risk as an operational exposure: key-person dependencies succession gaps team fatigue and timely access removal for leavers
• Own ACFCs operational continuity plans and run annual testing including KL and Sri Lanka failover aligned to the Group BCM framework

Compliance & Assurance

• Lead maturity assessment of ACFC verticals against CREST and SOC-CMM and track improvement over time
• Drive completion and upkeep of critical SOPs across all verticals
• Track SOW and contractual compliance and certification status and renewals
• Maintain audit readiness including evidence findings and closure

Person Specifications

Qualifications & Experience

• 610 years in operational risk internal audit or a bank business risk and control unit
• Big 4 risk advisory or banking background preferred
• Hands-on experience with risk registers RCSA KRIs and issue management
• BCP / BCM experience strongly preferred
• Exposure to cybersecurity IT or managed services helpful but not essential
• Degree in Risk Management Finance Business Information Systems or a related discipline
• Certifications Preferred: CISA CRISC CIA an operational risk qualification or CBCI. Good to have: ISO 27001 Lead Auditor ISO 22301

Knowledge & Skills

• Comfortable challenging senior people with data and doing so fairly and consistently
• Strong analytical skills; able to work from raw data and spot when an answer does not add up
• Clear written and verbal communication including presenting risk to leadership
• Works independently from day one with minimal supervision
• Familiarity with cybersecurity frameworks such as NIST CSF ISO 27001 CREST and SOC-CMM
• Knowledge of Malaysian and regional regulatory expectations such as BNM RMiT NACSA and PDPA
• Experience with GRC or issue-tracking tools and dashboard reporting