Operational Risk Manager

To minimise the company’s exposure to risk through a series of effective risk management, audit and awareness processes and interventions.

Operational Risk

• Maintain the company’s Risk Register, identifying potential new issues and regularly reviewing and re-assigning risk levels as appropriate.
• Design and implement a series of controls to minimise the impact of risks identified on the risk register.
• Conduct operational risk audits to assess current processes and practices from a risk management perspective and identify areas where improvement is required.
• Provide regular updates / reports to the EMC to appraise them of any changes to the risk register and highlight areas for action.

Internal Audit

• Review and ensure maintenance of the ISO27001 accreditation, to ensure relevance and compliance today and in line with future requirements.
• Oversee the regular review of company policies across all areas and ensure they are compliant with the prevailing legislation at all times.
• Prepare for the external ISO27001 audit process to ensure the accreditation is maintained.
• Build and deliver a schedule of internal sudits on areas identified as high priority and advise the EMC of outcomes and actions required to eliminate/mitigate risks
• Identify specific risks associated with Data Protection legislation (including GDPR) and work with functional leaders to ensure risks are minimised and contingency plans are in place.
• Develop and manage the penetration testing schedule to ensure potential threats are identified and eliminated to reduce risk to clients and reputation.

Business Continuity / Disaster Recovery

• Lead the development and continuous review of our Business Continuity and disaster recovery plans to ensure business disruption is minimised.
• Ensure that adequate plans are in place to handle Incident Management and that colleagues are trained as appropriate for the role they will play.

Security and Compliance Culture

• Contribute to the creation of a security and compliance culture through training interventions and communications initiatives that promote awareness of risks and their consequences.