Enterprise, Third-Party & Resilience Risk Manager

Value to HT: HT never promises a client more than its partners are bound to deliver, can prove it recovers in the hours it has promised, and gives management one trusted risk picture on every deadline.

What the business gets

• Contracts signed with liability, service credits, data terms and exit rights that match what partners owe HT, so margin on the ₦5.9bn licensing line is not given away in the small print

• A partner, OEM and supplier base that is selected, monitored and scored through the year, with exit plans for the critical ones

• Availability and recovery commitments (99.9% to 99.99%, 2 to 4 hours) backed by tests, so SLA credits and renewal risk fall, and a trained crisis team

• EMC and the Group get the risk register, indicators, losses and actions on every deadline, produced from Sentra, and the CRO's time back for judgement

• A risk champion in every practice, trained and running a self-assessment cycle: the Practice Blueprint's security and risk pillar made real

Key accountabilities

1. Review client, partner and OEM contracts above an agreed threshold before signature: liability caps, indemnities, SLA credits, recovery commitments, data terms, audit rights and exit; keep client commitments and partner obligations back to back; own the contract standard with Legal.

2. Run the third-party lifecycle for critical suppliers and partners: due diligence, tiering, scorecards, annual financial-health review, revenue-share reconciliation, exit plans; client due diligence and sanctions checks for new external and cross-border clients.

3. Own the business continuity management system (ISO 22301): refresh the impact analysis, set recovery targets per critical service, run the annual exercise programme including recovery tests for client platforms, the SOC and NOC and joint tests with bank clients; validate recovery before new SLAs are signed.

4. Stand up crisis management: named crisis team with legal and communications leads, one crisis protocol with the CISO and Marketing, ransomware playbook.

5. Maintain Sentra (register, controls, indicators, actions, loss events); produce the monthly EMC dashboard, the monthly exception report and the quarterly Group submissions on deadline for the CRO; monitor risk appetite, client concentration and revenue at risk.

6. Track audit, regulatory and certification findings to closure.

7. Run the risk champion network and the annual risk and control self-assessment in every practice.

Experience and qualifications

• 7+ years in enterprise, operational or vendor risk in a bank, insurer, telco or technology services firm

• Strong contract literacy; experience with IT outsourcing, cloud and managed-service contracts

• ISO 22301 Lead Implementer or Auditor, or CBCI/MBCI; GRC platform experience

• IRM certificate, CRISC or CTPRP an advantage Risks it leads on

Framework categories: Legal, Credit, Market, Liquidity, Strategic, Operational

• Third-party management lifecycle: evaluation and selection, contract and service initiation, ongoing monitoring, termination

• Channel partner performance; counterparty, credit and concentration analytics

• Enterprise resiliency: business impact analysis, continuity and disaster recovery planning

• Crisis management: response planning, tabletop and war-game exercises, crisis communication, third-party responsibilities

• Programme reporting, risk analytics, metrics and risk culture

Measures of success

• Contracts above threshold reviewed before signature: 100%

• Critical suppliers with current due diligence and exit plan: 100%

• Critical services with a successful recovery test in 12 months: 100%

• Submissions on time: 100%; overdue indicators under 10%

Works with: MD/CEO, Legal, Finance, Partnerships, COO, CTIO, practice leads and risk champions, Group Risk

Grows later with: Business Continuity Analyst (exercise programme, crisis management) as managed-service SLAs grow; Enterprise Risk & GRC Analyst (Sentra, reporting, champion network) when Group reporting volume justifies it.

Powere