Interim Chief Audit Executive — Integration

Three risk types, one way up

In most banks, three separate teams govern conduct, operational and financial risk, each measuring in its own units and reporting on its own calendar. Conduct risk lives in complaints, sales practices and customer outcomes; operational risk in incidents, losses and control failures; financial risk in limits, capital and liquidity. Each has its own escalation route, and the routes seldom meet. The danger is in the seams. A product change that harms customers may first appear as an operational incident, then as a provisioning question, and never be seen whole by anyone senior enough to act. The Interim Chief Audit Executive's mandate is to close those seams by bringing the three into one escalation model, and to give the Group Chief Executive Officer and the Risk Committee a single, assured view of what is climbing and why.

Doing this from the audit seat is unusual and deliberate. Audit is the one function that already looks across all three risk types, and the one that can test whether an escalation actually happened rather than whether a policy says it should. With interim executive authority, you will establish how risk decisions are allocated, including what local leaders continue to decide, and fix the evidence standard for governing capital use, capacity and controls. Commitments that should go forward will go forward on your decision, and any that pass cost or risk along with nobody owning it will stop. You will reject investment cases that ignore adoption, dependencies or the downside, approve the escalation model itself and the leadership around it, and run a board cadence covering progress, exceptions and open decisions.

This group wants someone who has done this through growth. Through a scale-up you kept what the board was told tied to what operations could prove, and your baselines held when a chief executive and the people doing the work questioned them. Revenue of $365 million or more, 600 or more people and three countries describe the smallest organisation on your record. The group will weigh what you did in succession, scale-up and buy-side M&A. It wants risk judgement at level 4, and at level 3 assurance testing, regulatory engagement and the setting of risk appetite. You protect controls that earn their keep, put a price on every exception and hand the function back with deeper leadership than it had. Open questions do not become your excuse for standing still. Stopping a risk commitment does not wait on every country leader's consent, and all 24 months are yours to answer for.

From mapped routes to an assured model

By the end of the opening ninety days, the escalation routes for each risk type should be mapped end to end, and you and the Group Chief Executive Officer should have settled a draft single model. Around month nine, internal audit should have tested the model against real events, and every gap found between the three risk types should have someone accountable for closing it. By month 24, one integrated model should be operating and independently assured, with audit reporting shaped around what the Risk Committee actually needs to see.

Meeting the people who will rely on the model

Week one is a confidential conversation by video with the Group Chief Executive Officer. By week three the Risk Committee Chair will want to sit down with you and work through how a single escalation model should feed the committee. Week 5 is an in-person meeting with executive leaders from each function, whose teams will operate the model day to day, and week 7 an appearance before the board's directors. Our view of each stage is sent to you in writing and takes no more than four working days.