Assessments & Assurance - VP

• Own and manage the relationship between the ERO and Third-Party Risk Management (TPRM), aligning operational resilience due diligence with the wider third-party risk lifecycle.

• Own and manage the relationship between the ERO and Third-Party Risk Management (TPRM), aligning operational resilience due diligence with the wider third-party risk lifecycle.
• Work through Business Continuity Directors (BCDs) to manage relationships with Business Relationship Managers (BRMs) and Engagement Managers (EMs) for all DDQ, finding and risk activity.
• Engage directly with suppliers to set clear expectations for evidence, timelines and participation in assurance activity.

• Define, draft and maintain operational resilience Due Diligence Questionnaires, together with assessment procedures, scoring guidance, evidence standards and assessor job aids.

• Define, draft and maintain operational resilience Due Diligence Questionnaires, together with assessment procedures, scoring guidance, evidence standards and assessor job aids.
• Make sure DDQs cover supplier governance, business continuity, technology and cyber recovery, data resilience and immutability, incident management, testing, subcontractor and fourth-party dependencies, and contingency and exit capability.
• Refresh DDQ content each year to reflect policy changes, regulatory expectations, lessons learned and emerging threats.

• Plan and carry out annual third-party assessments, plus new-engagement and event-driven reviews, prioritised by criticality, service impact, concentration, substitutability and prior performance.

• Plan and carry out annual third-party assessments, plus new-engagement and event-driven reviews, prioritised by criticality, service impact, concentration, substitutability and prior performance.
• Lead evidence reviews and supplier interviews, challenging incomplete or inconsistent responses and obtaining enough support to reach defensible conclusions.
• Keep assessment records complete, traceable and ready for regulators in approved systems, and keep workflows moving on time.

• Draft clear, evidence-based findings and identify the associated risks, including potential impact on Critical and Important Business Services and impact tolerances.

• Draft clear, evidence-based findings and identify the associated risks, including potential impact on Critical and Important Business Services and impact tolerances.
• Draft proportionate remediation plans and mitigations with named owners, priority ratings and target dates, agreed with suppliers, BRMs and EMs.
• Draft risk acceptances where remediation is not feasible or proportionate, clearly setting out residual risk, compensating controls and review dates.
• Pass findings, risks, remediation plans and acceptances to the VP – Contracting, Validation & Reporting for independent validation before approval or escalation.

• Support on-site visits and inspections of third parties, including preparation, evidence sampling, observation and documentation of outcomes.

• Support on-site visits and inspections of third parties, including preparation, evidence sampling, observation and documentation of outcomes.
• Support assessment workshops with suppliers and internal stakeholders to explore resilience capability, dependencies and recovery arrangements in depth.
• Support joint third-party testing by contributing assessment insight to scenario design, taking part in execution and recording observations as findings where appropriate.

• Monitor assessment quality, throughput, ageing, coverage and recurring themes, and escalate delivery constraints or material supplier concerns to the Managing Director.

• Monitor assessment quality, throughput, ageing, coverage and recurring themes, and escalate delivery constraints or material supplier concerns to the Managing Director.
• Lead, coach and quality-control the analysts carrying out assessments, using calibration sessions, training and lessons learned to build consistency.
• Promote responsible use of tooling, analytics, automation and AI to improve DDQ workflow, evidence capture, consistency and insight.

• Substantial experience in third-party risk management, operational resilience, business continuity, supplier assurance, technology or cyber risk within financial services or another highly regulated sector.

• Substantial experience in third-party risk management, operational resilience, business continuity, supplier assurance, technology or cyber risk within financial services or another highly regulated sector.
• Demonstrated experience designing or carrying out due diligence and ongoing monitoring programmes, including DDQ design, evidence review, drafting findings and assessing risk.
• Strong understanding of critical services, recovery objectives, impact tolerances, concentration risk, substitutability and fourth-party dependencies.
• Excellent analytical judgement and the ability to turn complex evidence into concise, defensible conclusions and practical remediation actions.
• Strong facilitation, supplier engagement and stakeholder-influencing skills, with a disciplined approach to documentation and quality.
• Bachelor's degree or equivalent professional experience required; relevant professional certification in third-party risk, operational resilience, business continuity, technology risk, cyber or audit preferred.

• Builds a culture of evidence-based challenge, consistency, transparency and accountability.
• Balances timely delivery with rigorous assessment, and escalates material uncertainty rather than accepting weak evidence.
• Builds trusted, collaborative relationships with TPRM, BCDs, BRMs, EMs and suppliers.
• Develops team capability and represents assessment outcomes credibly to senior stakeholders, auditors and regulators.