The opening
A first-term independent-director position that presently anchors the Risk Management Committee has entered a filed succession window for May 2027. The Board is considering candidates able to oversee a technology enterprise whose risk is distributed across client commitments, data, cloud infrastructure, AI-enabled delivery, people and international operations.
The risk agenda is a set of choices, not a register
The new Chair will reshape the committee around concentrations and failure paths that can change enterprise value. Client concentration must be read alongside contract terms and delivery substitutability. Cloud concentration must be read alongside identity architecture and recovery. Talent concentration must include key technical knowledge and leadership succession. AI opportunity must include data rights, output reliability, client consent and accountability when human review is weak.
Quarterly heat maps are not the intended product. The committee should help the Board decide which risks to accept for strategic advantage, which controls must be non-negotiable, which dependencies require an exit path and which early indicators should cause management to pause.
The Chair's operating charter
- Establish an enterprise-risk taxonomy that uses common consequence language across strategy, cyber security, privacy, delivery, finance, workforce, legal and reputation.
- Identify the small number of critical services whose prolonged failure would breach client obligations or threaten the franchise. Require end-to-end resilience tests that include vendors, decision rights, communications, restoration and backlog recovery.
- Examine cyber risk through attack paths and business impact. Privileged access, software dependencies, secrets, cloud configuration, remote administration and incident containment deserve evidence beyond compliance attestations.
- Govern AI adoption with an inventory of material use cases, ownership, approved data, human-control points, validation, monitoring and retirement. Client-delivery uses should be aligned with contract, intellectual-property and confidentiality duties.
- Bring commercial commitments into risk review. Non-standard liability, service credits, outcome guarantees, transition assumptions and persistent loss-making engagements should be visible before they become audit matters.
- Oversee the risk side of acquisitions and partnerships, including inherited security debt, data transfer, client consents, talent dependence and the time required to bring controls to group standard.
- Test whether insurance, contractual recovery and crisis plans match the scale and correlation of plausible losses.
NRC and CSR responsibilities attached to the seat
As an NRC member, the director will contribute to succession for the chief executive, technology, security and delivery leadership; review whether incentives recognise resilience and client trust; and assess whether the Board itself retains enough contemporary technology judgement. On CSR, the member will ask for measurable outcomes, sound partner diligence, beneficiary protection and disciplined handling of technology or personal data used in programmes.
The experience sought
Candidates may have led enterprise technology, cyber security, global delivery, technology-services operations, risk or a major digital business. The decisive evidence will be accountability for real incidents, complex client obligations or technology transformation at scale—and the ability to translate technical uncertainty into a board decision. Applicants must demonstrate independence from material clients, competitors, advisers and vendors. DIN and applicable Independent Directors' Databank compliance are required.
The mandate entails scheduled Board and committee meetings, two risk deep-dives, participation in an annual crisis simulation and prompt availability for a material service, cyber or client event.
Application note
Applications should present committee-relevant evidence rather than a general biography: two or three decisions personally governed, the information used, the challenge made, and the resulting change in risk, capital, control, succession or stakeholder outcome. Shortlisted candidates will undergo independence, conflict, capacity, DIN and databank verification before any confidential market approach.