Regional and Hbme Head of Data Risk

**Job Purpose**:
Global Operational and Resilience Risk (ORR) is a sub function of Group Risk. Its purpose is to make sure HSBC understands, and is in control of its non-financial risk position. In addition, the function provides resilience risk stewardship to the Regional Business and Functions and the entities we operate in. This is achieved through:

- Completing analytical assessments and opining on the control environment of the First Line of Defence (1LOD) within Businesses and Regions
- Constructive challenge to the businesses and functions on their control environment and assessment of risk
- Oversight of emerging risks, strategic business initiatives and local change activity and new/materially changed products
- Analysis of risk exposure across all bank operations and territories to inform capital management and stress testing requirements
- Completing thematic reviews and aggregated reporting of the Non-Financial Risk profile of the bank
- Responsibility for the implementation of a Risk Management Framework (RMF) that sets out governance, policies and practices to proactively identify, assess, measure and report on, mitigate and control operational risk exposures associated with HSBC’s businesses and operations at all levels of the organisation.

**The role holder will have regional responsibility for**:

- Providing advice, guidance and challenge to senior businesses, functions and entity management in region
- Supporting development and oversight of effective implementation of the Group’s data risk framework across the Group
- Providing guidance and support with policy writing, owning and monitoring compliance with a comprehensive set of clear and concise policies that outline the key principles and minimum requirements applicable to the management of data risk
- Engaging with risk owners, control owners and risk stewards to ensure data risks are managed in accordance to policy
- Overseeing compliance, for example, through the Risk and Control Assessment process, Top Risk Assessments and Incident Management process
- Promoting and developing data risk awareness and risk management culture in order to ensure that the material risks are both evident and effectively managed
- Identifying any concerning trends and challenging the business to address these
- Supporting with defining the risk and control library, including minimum control standards, with input from Risk Owners, Business Service and Control Owners, specifying key risks and key controls
- Recommending RCA scoping for data risk controls and challenge where this is not appropriately applied in the RCA
- Driving appropriate governance for data risk across key stakeholders and senior control owners
- Reporting on risk and control profile, including impacts of external environment changes, emerging risks and changes to the business strategy.

**Principal Accountabilities**:
**Impact on the Business**
- Providing guidance and risk insight around data risk regionally and the associated remediation as required
- Ensuring critical issues both in key controls and material change programmes are managed for data risk, are understood by and escalated to appropriate governance forums for appropriate and timely resolution
- Educating stakeholders to understand the impact of emerging risks that require changes to controls, resources and business operations to ensure they remain within appetite
- Ensuring that data risk initiatives are not adversely affected as a result of poor planning, testing and approach during the delivery of significant change
- Supporting a culture within the organisation for effective management of data risk

**Customers / Stakeholders**
- Supporting the establishment of a centre of excellence in data risk and ensure the integration of risk insight from the relevant second line specialist risk functions
- Developing key relationships with business and functional areas ensuring a clear understanding of the material risk and control issues within the respective areas
- Providing guidance so business/function management fully considers and effectively manages, data risk in accordance with established policies and procedures
- Assisting internal, external, and regulatory audits
- Managing relationship with the regulator(s) and Regional Operation and Resilience Risk Heads.

**Leadership and Teamwork**
- Communicating a clear vision for data risk in region that is aligned to global, data risk strategy and objectives
- Working collaboratively across countries and region and liaises with the central team on an on-going basis

**Operational Effectiveness and Control**
- Acting as trusted advisor to ensure that operational processes are operating and that a robust internal control environment is in place throughout the region, commensurate with the volume/scale of operations
- Monitoring and reviewing and process dispensation requests raised by businesses that pertain to the management of data risk
- Providing leadership over regiona