Interim Regional Risk Director — Risk Renewal

Findings are not a plan

Control findings reach a bank from many directions: internal audit, second-line reviews, supervisory letters, external audit points, issues the business raised itself. Each arrives with its own rating, its own owner and its own due date, and on paper each looks manageable. Together they can form a backlog nobody is able to sequence, because no one has decided which findings share a root cause, which depend on others and which are cosmetic. The Interim Regional Risk Director turns that list into an agenda: an order of work that fixes causes rather than symptoms, and that the Group Chief Executive Officer and the board can follow.

The authority to sequence

This is an executive appointment, and the authority is real. You will set how risk decisions are allocated across the region, including the limits country risk heads may still approve on their own, and choose the evidence the region relies on for how capital is used, how much capacity is committed and where controls sit. You will decide which existing commitments go ahead, which wait and which close. You will stop any plan that passes cost or risk to another team with no one accountable, and decline investment where the case is silent on adoption, on what it depends on or on the downside. You will approve who leads the work and how matters reach senior leaders, and settle disputes with the business before money and people are committed. Sequencing remediation is in the end a resourcing decision, and you will make it.

A backlog that stays closed

Within the first ninety days, open findings should be consolidated into one view, prioritised by root cause and severity, and each assigned to a leader who will answer for it, with the region's risk decision rights agreed. By month nine, the sequenced agenda should be under way, with the highest-priority findings closed and the closure evidenced to the board rather than simply reported. By month 24, remediation should be complete, or formally accepted where acceptance is the right call, and the region's risk appetite and escalation should be part of how local leaders work, so that the backlog does not quietly rebuild.

The remediation leader the group needs

Your risk leadership has covered businesses with revenue of $750 million or more, 1,400 or more people and two countries. Your banking knowledge comes from calls you made yourself, among them a commitment that lacked support and that you halted before its consequences landed. The group will examine what you did in culture reset, platform pivots and integration, because remediation most often stalls when a migration or a merger is pulling engineers and managers elsewhere, and because lasting closure usually needs people to behave differently, not just a new control. Risk judgement is sought at level 4; at level 3 the group wants assurance testing, regulatory engagement and a working command of risk appetite. Assurance testing matters particularly: a finding is closed when the fix has been tested, not when the action is marked complete.

You can tell a regional exception that serves customers from one that survives only because nobody has challenged it. You can describe a well-supported programme you closed, what the evidence showed and which people and budget it freed. You can set out for a chief executive the gaps that remain and still act on them, and a risk commitment that should stop will stop without your first collecting the agreement of every country leader.

From a findings log to the boardroom

Week one opens with an introductory call by video, in confidence, with the Group Chief Executive Officer about the remediation brief and your approach to a fragmented findings log. In the third week the Board Chair asks you to lay out a sequenced agenda and its trade-offs as you would for directors. Week five puts you, in person, in front of executive leaders from every function; they are the ones who will have to release people and budget to your plan. In week 7 the process concludes with the board's directors. After every stage we will tell you in writing where you stand, within two working days.