Operational Risk & Assurance Manager

Key Responsibilities

Risk Register & Reporting

• Own the ACFC operational risk register, covering known and accepted risks, with owners, due dates and escalation triggers
• Define and track Key Risk Indicators (KRIs) for each vertical and for ACFC as a whole
• Prepare and present the monthly ACFC risk pack in person at the leadership forum, covering top risks, trends and overdue actions
• Escalate material risks that are not being addressed to the Head of Operations

Vertical Accountability Reviews

• Run a monthly review session with each vertical, where leads walk through ageing items, SLA and KPI misses, overdue remediation and missed SOW deliverables
• Pull data directly from tools and trackers so that figures are reviewed as they are, not as reported
• Agree actions with owners and dates, and track every issue through to closure
• Keep reviews firm on facts and constructive on the way forward, with the aim of helping teams deliver

Risk & Control Self-Assessment

• Run a quarterly risk and control self-assessment (RCSA) with each vertical
• Validate declared risks and controls against evidence and maintain the ACFC control register

Incidents, People Risk & Continuity

• Maintain the ACFC operational incident record and track incidents to closure, for example client data sent to the wrong recipient
• Map people risk as an operational exposure: key-person dependencies, succession gaps, team fatigue and timely access removal for leavers
• Own ACFC's operational continuity plans and run annual testing, including KL and Sri Lanka failover, aligned to the Group BCM framework

Compliance & Assurance

• Lead maturity assessment of ACFC verticals against CREST and SOC-CMM, and track improvement over time
• Drive completion and upkeep of critical SOPs across all verticals
• Track SOW and contractual compliance, and certification status and renewals
• Maintain audit readiness, including evidence, findings and closure

Person Specifications

Qualifications & Experience

• 6–10 years in operational risk, internal audit, or a bank business risk and control unit
• Big 4 risk advisory or banking background preferred
• Hands-on experience with risk registers, RCSA, KRIs and issue management
• BCP / BCM experience strongly preferred
• Exposure to cybersecurity, IT or managed services helpful, but not essential
• Degree in Risk Management, Finance, Business, Information Systems or a related discipline
• Certifications — Preferred: CISA, CRISC, CIA, an operational risk qualification, or CBCI. Good to have: ISO 27001 Lead Auditor, ISO 22301

Knowledge & Skills

• Comfortable challenging senior people with data, and doing so fairly and consistently
• Strong analytical skills; able to work from raw data and spot when an answer does not add up
• Clear written and verbal communication, including presenting risk to leadership
• Works independently from day one with minimal supervision
• Familiarity with cybersecurity frameworks such as NIST CSF, ISO 27001, CREST and SOC-CMM
• Knowledge of Malaysian and regional regulatory expectations, such as BNM RMiT, NACSA and PDPA
• Experience with GRC or issue-tracking tools and dashboard reporting