Avp Controls Assurance, Global Risk and Compliance

-Job description

The Group’s Risk Management Framework (RMF) requires independent Second Line Assurance of the management of material risks and controls across HSBC’s non-financial and financial risk taxonomies. The RCAS function provides a significant proportion of this assurance.

Via its industry-leading centres of excellence, RCAS delivers innovative assurance solutions for and on behalf of HSBC’s Risk Stewards and peer assurance teams.

Controls Assurance (CA) reports into RCAS and is responsible for assuring the risk management of critical business processes and specified non-financial and financial risks across the Group, principally by testing mitigating controls. This is achieved by building out a centralised offshore capability that will deliver agile, insightful, and cost-efficient assurance. CA also provides a resource augmentation service to other assurance teams within the Bank, becoming a vehicle to effectively manage assurance costs and resources. Also, CA works together with the RCAS Automation and Analytics team to develop, test and deploy their Continuous Assurance objectives.

CA provides assurance across various Non-Financial and Financial Risks within all HSBC territories and divisions. These include, to differing extents, Operational and Resilience Risk (ORR), Model Risk, Wholesale Credit Risk (WCR), Retail Credit Risk (RCR), Insurance Risk, Financial Crime Risk and Regulatory Compliance Risk. Specifically, CA has a mandate to provide the following key assurance services:

- Process-led assurance - assuring the design, operation, recording and monitoring of key controls and expected risk management outcomes within agreed critical business services across the Group
- Risk-based cyclical assurance - assuring the above for specific risk taxonomies
- Entity Control assurance - assuring the design, operation, recording and monitoring of key controls designated by entity-level reporting frameworks across the Group (e.g., SOX, ELCs)
- Resource augmentation - Temporarily providing staff to non-RCAS assurance teams to support their assurance activities
- Work in alignment to the Integrated Assurance Framework (IAF)

CA is principally comprised of Control Testing Utilities (CTUs) executing this assurance work. These CTUs are principally based in Global Service Centres within India, China and Poland, and are staffed with assurance specialists with expertise across the range of risks being covered.

This role will report into the VP, TCSD, Controls Assurance, RCAS (GSC Country location name) and will be responsible for delivering assessments of key control activities of Technology, Cyber Security and Data (TCSD) risks within ORR, in accordance with CA procedures and the assessment plan.

The role holder will be required to support the VP, TCSD and Head of CA (GSC Country Location Name) in leading or working with a team to assess the effectiveness of controls relating to the TCSD risks and identifying and raising issues where control gaps lead to material unaddressed risks.

At a high level, the role holder will be responsible for the following:

- Evaluate a portfolio of controls for design effectiveness, operating effectiveness and/or risk management outcomes, raising issues as appropriate. Customise and localise standard test scripts and then evaluate assigned controls for design and operating effectiveness, raise issues as appropriate.
- Ensure that assigned control assessments are accurate, effective, abide by CA and RCAS methodology, procedures, and templates, and meet quality control requirements and are delivered on time, in accordance with the CA assessment plan.
- Supervise the delivery of assigned control assessments not limited to System Architecture, Operating Systems, Databases, Networks, Security Systems, Cloud Services, Asset Inventories, Change Management, Incident Management, Recovery Management, Software Development Lifecycle (SDLC), and other general controls; using experience and knowledge to intervene and redirect testing as required, resolving, or redirecting escalations as required.
- Manage control owners and other stakeholders, ensuring the success of each assigned reviews, minimising contention where possible and requesting support, where deemed necessary.
- Manage the documentation of distinct control types, covering key aspects, such as remit, main processes, and handovers to other teams.