Head of Operational Risk Management

Key responsibilities

• Design, implement, and maintain the foundational pillars of the Operational Risk Management (ORM) framework, including policies, governance structures, and methodologies.
• Lead the implementation and ongoing execution of the RCSA methodology across all departments (e.g., HR, operations, finance, business, technology) to proactively identify, evaluate, and manage inherent risks and control effectiveness.
• Design, maintain, and regularly update comprehensive Operational Risk Registers and loss event databases, ensuring accurate classification and timely reporting of incidents.
• Develop and monitor relevant Key Risk Indicators (KRIs) and thresholds specific to operational risk, providing early warning signals for potential control failures.
• Develop and implement a formal, clear, and organization-wide Incident Reporting Process for operational risk and near-miss events, ensuring all staff can easily report issues in a consistent manner.
• Ensure timely and accurate reporting of all major operational and cyber security incidents to SAMA, adhering strictly to mandated thresholds, content requirements, and reporting timelines.
• Oversee and enforce the mandatory use of Root Cause Analysis for all material incidents to ensure that control weaknesses are identified and permanently remediated.
• Oversee and provide strategic direction to the Fraud Risk Manager, ensuring the development and execution of an effective, end-to-end fraud prevention, detection, and response program, including managing the internal whistleblowing and fraud investigation processes.
• Collaborate closely with the Technology and Cybersecurity teams to manage and mitigate Technology Risk and Cyber Security Risk, including risks related to system failures, data integrity, platform changes, and third-party vendor reliance.
• Conduct mandatory operational risk training for all employees and management to foster a strong risk-aware culture, emphasizing the importance of effective control performance and accountability.
• Prepare detailed, high-quality ORM reports for the CRO, Executive Management, and the Board Risk Committee, highlighting material exposures, control deficiencies, and progress on remediation plans.