EVP – Risk and Resilience — Patient-Access Organisation

The mandate

A patient-access organisation is adding a new executive risk role after assurance work found that referral urgency, patient identity, payer authorisation and follow-up are controlled well within individual teams but poorly across hand-offs. The board has chosen planned hiring rather than waiting for a material incident. The EVP – Risk and Resilience will move ownership into daily operations and prove that critical access continues during disruption.

Approximately 1,150 employees and material partners work across referral intake, contact centres, scheduling, authorisation, navigation, digital platforms, clinical escalation and shared services in Switzerland and connected markets. The EVP owns enterprise risk, operational resilience, first-line control design, crisis preparedness and board assurance, reporting to the Group Chief Executive or nominated sponsor. Clinical and compliance functions retain independent professional and second-line authority.

The risk taxonomy must reflect patient journeys rather than organisational charts. A referral can be correctly entered by one team yet still fail because urgency is not recognised downstream, identity is duplicated or the receiving service never acknowledges it. The EVP will map controls to potential patient consequence and assign one accountable first-line owner for each end-to-end exposure.

Urgency recognition is a priority. Referral documents arrive in multiple languages and formats, sometimes with incomplete clinical context. The organisation needs clear screening boundaries, trained escalation and rapid access to an authorised clinician when staff are uncertain. Productivity pressure must not discourage escalation, and the risk team will monitor both missed urgency and indiscriminate over-escalation.

Identity controls require more than demographic matching. Similar names, changing addresses, family contact details and cross-border records create duplicate and wrong-record risk. The EVP will set verification standards, exception authority and reconciliation. Any automated match or merge needs thresholds, monitoring and an auditable route to reverse a decision safely.

Authorisation delays can become clinical risks when patients believe care is progressing. The control framework will make ownership, ageing and communication visible. Teams must distinguish financial approval from clinical acceptance and offer an escalation route when delay may affect outcome. Unpaid service exposure should be managed without implying that a payer decision is a clinical judgement.

Follow-up obligations often cross systems. A booked appointment may be cancelled, a provider may reject a referral or the patient may not respond. The EVP will define what constitutes safe closure for each pathway, including attempts, alternative routing and clinical review. Closing an administrative task cannot remove the underlying care obligation without authorised disposition.

Operational resilience will be tested through credible loss scenarios. Telephony outage, cyber containment, workforce absence, building loss and unavailable provider capacity each change the safe service that can be offered. Plans must specify minimum viable pathways, manual records, prioritisation, communication and recovery reconciliation. Exercises will include frontline staff and external partners, not just executives around a table.

Third parties are integral to access. Cloud platforms, telecoms, translation services, payer portals and provider networks can interrupt or expose patient journeys. The EVP will classify vendors by patient consequence, confirm alternatives and ensure contracts support incident communication, data recovery and testing. A supplier certification will not substitute for a service-specific resilience assessment.

Issue management currently rewards closure dates. The new approach will verify whether the control operates under normal workload and whether any workaround created secondary risk. Extensions need an owner and compensating action. Repeated issues across teams will be aggregated by root cause rather than treated as unrelated local exceptions.

Risk information must be useful to operations. Frontline leaders need leading indicators such as unreviewed urgent referrals, identity exceptions, authorisations approaching clinical thresholds and unacknowledged transfers. The board requires a different view: exposure, control confidence, trend, dependency and decision. The EVP will reduce reporting volume while increasing evidence quality.

Speaking up is part of resilience. Staff who find a patient apparently lost between queues need authority to intervene without fear of damaging their performance statistics. The EVP will work with people leaders on just accountability, protect confidential reporting and ensure concerns return to process design. Deliberate bypass and good-faith recovery action must not be treated as equivalent.

The role will maintain independence without becoming a remote policing function. Risk specialists will challenge and sample, but operating leaders must design, execute and attest controls. The EVP will coach first-line owners, test their evidence and escalate persistent weakness. Board assurance should show where confidence comes from, not simply report that a policy exists.

What you will own

• Enterprise risk framework based on patient-access journeys.
• First-line control ownership and evidence standards.
• Urgency, identity, authorisation and closure risks.
• Operational resilience, crisis response and recovery.
• Critical third-party and technology dependency assurance.
• Issue verification, aggregation and board reporting.
• Speaking-up, risk capability and control culture.
• Risk leadership, succession and independent challenge.

The first 12 months

In the first 60 days, trace priority referrals across every hand-off, identify risks without a single owner and review continuity plans against current dependencies. Put interim safeguards around any uncontrolled urgent or identity pathway.

By month six, establish first-line attestations supported by samples, complete two live operational exercises and introduce patient-consequence vendor tiering. Replace closure-volume measures with verified control effectiveness.

At twelve months, reduce overdue high-risk referrals by 65%, cut unresolved identity exceptions by 50% and achieve 95% verified remediation within agreed risk dates. All critical pathways should complete realistic resilience exercises with recovery reconciliation, and every critical supplier must have a tested continuity route or board-accepted exposure.

What the sponsor will inspect

• Patient-journey risks owned across organisational boundaries.
• Urgency uncertainty reaching qualified clinical review.
• Identity exceptions controlled and reversibly resolved.
• Administrative closure matching safe pathway disposition.
• Resilience tested with real teams and external dependencies.
• Assurance based on operating evidence rather than policy presence.

The person

You bring 22–28 years in enterprise risk, clinical governance, operational resilience or regulated service control, including executive accountability in healthcare, insurance, payments or another high-consequence access environment. Your experience includes transferring controls into the first line and testing a service through material disruption.

Candidates should demonstrate end-to-end identity or case-flow risk, third-party resilience, crisis leadership and board assurance. Swiss and wider European regulatory exposure is valuable, as is multilingual operating experience. This is a permanent onsite role in Zurich because risk must be embedded where patient-access work is directed.

Compensation and terms

Base compensation is CHF 340,000–470,000 plus annual incentive and long-term participation tied to control effectiveness, verified remediation, resilience, third-party assurance and risk leadership. The permanent appointment is onsite in Zurich and reports to the Group Chief Executive or designated executive-committee sponsor. Planned hiring allows the new executive to shape controls before further scale.

Confidentiality

The organisation, patients, providers, payers, referral data, incidents, vendors and resilience findings remain confidential. Detailed information is disclosed after suitability, conflicts and signed confidentiality. Candidates must not approach likely access organisations, technology providers or healthcare partners to identify the enterprise.