Head of Audit, Risk & Compliance

Job Description | Head of Risk, Audit & Compliance

1. Position Details

Position



Head of Risk, Audit and Compliance

Department



Risk, Audit and Compliance

Job Level



Head of Department (HOD)

Reporting To



Board of Directors or Managing Director, as determined by the Company's governance structure

Direct Reports



Risk, Internal Audit and Compliance personnel, as determined by the approved organisational structure

Geographical Scope



Company-wide - Head Office and all branches

Employment Type



Full-time

2. Role Overview

The Company is seeking a strategic, analytical, and execution-oriented Head of Risk, Audit & Compliance to strengthen enterprise-wide risk management, internal audit, regulatory compliance, and governance across the organisation.

The role holder will provide leadership in identifying and managing material business risks, independently assessing the effectiveness of internal controls, monitoring compliance with applicable legal and regulatory requirements, and providing assurance to Management and the Board on the Company's governance and control environment.

The position will cover all business functions, departments, systems, and branches, including operational, financial, strategic, regulatory, technology, fraud, reputational, and other enterprise risks. It is not limited to credit risk, credit assessment, loan approvals, or credit compliance.

A key priority will be to establish a proactive and disciplined control environment in which risks are identified early, accountability is clearly assigned, audit findings are addressed within agreed timelines, and compliance obligations are consistently met.

The successful candidate will work closely with the Managing Director, HODs, branch management, and other stakeholders to strengthen business controls while maintaining the independence required to provide objective assurance. The role holder will also engage the Board or its designated committee on material risks, significant audit findings, regulatory breaches, and unresolved control weaknesses.

This is a high-impact HOD role requiring strong professional judgement, integrity, analytical capability, and the ability to translate risk, audit, and compliance findings into practical actions that protect the Company's assets, reputation, regulatory standing, and long-term sustainability.

3. Key Roles & Responsibilities

A. Enterprise Risk Management

• Develop, implement, and maintain the Company's enterprise risk management framework, policies, procedures, and risk assessment methodologies.

• Identify, assess, and monitor strategic, operational, financial, regulatory, legal, fraud, reputational, technology, cybersecurity, data privacy, business continuity, and third-party risks across Head Office and all branches.

• Maintain a comprehensive enterprise risk register, ensuring material risks have defined owners, assessments, mitigation plans, monitoring mechanisms, and escalation thresholds.

• Establish risk appetite measures, key risk indicators, risk-rating criteria, and escalation protocols for approval through the appropriate governance channels.

• Conduct periodic enterprise-wide risk assessments and risk and control self-assessments to identify material exposures, control gaps, and emerging risks.

• Monitor changes in the business environment, products, processes, systems, regulatory requirements, and operating model that may introduce new or increased risks.

• Advise Management on the risk implications of significant business decisions, strategic initiatives, new products, material contracts, and operational changes.

• Monitor risk mitigation plans and hold business owners accountable to agreed actions and deadlines.

• Coordinate business continuity and disaster recovery risk assessments with the relevant functional owners.

• Develop risk dashboards and management reports highlighting material exposures, emerging trends, overdue mitigations, and matters requiring escalation.

• Promote risk ownership across the organisation, ensuring that HODs and branch managers remain accountable for risks arising within their respective areas.

• Provide practical recommendations that strengthen controls without creating unnecessary operational bottlenecks or compromising customer service.

B. Internal Audit and Independent Assurance

• Develop and maintain a risk-based internal audit plan covering the Company's material business functions, processes, systems, and branches.

• Submit the annual internal audit plan and material changes to the appropriate Board or designated committee for approval, in line with the Company's governance arrangements.

• Conduct or oversee independent audits, operational reviews, and control assessments to evaluate the effectiveness of governance, risk management, and internal controls.

• Execute scheduled and surprise audits of branches, Head Office departments, business processes, financial transactions, records, and systems, based on approved audit priorities.

• Review the adequacy of controls over procurement, expenditure, payroll, assets, reconciliations, approvals, records management, system access, and other material business processes.

• Assess adherence to approved policies, delegated authorities, operational procedures, contractual obligations, and applicable legal and regulatory requirements.

• Evaluate the reliability, completeness, and integrity of financial and operational records, management reports, and supporting documentation.

• Assess the effectiveness of controls designed to prevent or detect fraud, unauthorised transactions, conflicts of interest, misuse of Company resources, and other irregularities.

• Prepare objective, evidence-based audit reports setting out findings, risk implications, root causes, recommendations, responsible action owners, and agreed timelines.

• Classify findings according to approved risk-rating criteria and promptly escalate critical findings to the appropriate Management or Board forum.

• Maintain an audit findings tracker and independently verify that corrective actions have been implemented and are operating effectively.

• Monitor recurring findings, overdue actions, and unresolved material weaknesses, escalating persistent non-compliance to the appropriate governance level.

• Maintain adequate audit working papers, evidence, and documentation in accordance with applicable professional standards and Company requirements.

• Protect the independence and objectivity of Internal Audit, ensuring that the function does not audit its own work or assume operational responsibility for the controls it assesses.

C. Regulatory Compliance and Corporate Governance

• Establish and maintain a company-wide compliance framework covering applicable legal, statutory, regulatory, licensing, and internal policy obligations.

• Maintain a compliance obligations register and regulatory calendar, with clear accountability for submissions, renewals, reporting deadlines, and other required deliverables.

• Monitor applicable local laws, regulations, regulatory guidance, and licence conditions relevant to the Company's business and regulatory status.

• Coordinate compliance assessments across Head Office and branches and monitor the implementation of required controls.

• Advise Management and relevant functional leaders on regulatory changes, compliance risks, and required corrective actions.

• Oversee compliance monitoring relating to applicable data protection, customer protection, anti-money laundering and counter-terrorism financing, anti-bribery and corruption, record retention, and other relevant obligations.

• Coordinate regulatory inspections, reviews, information requests, and submissions, working with the relevant internal functions and professional advisers as necessary.

• Maintain records of regulatory correspondence, findings, commitments, remediation plans, and supporting evidence.

• Review Company policies, procedures, and internal governance standards periodically to identify gaps, inconsistencies, or outdated requirements.

• Monitor adherence to the Company's Code of Conduct, conflict-of-interest requirements, whistleblowing arrangements, and other applicable governance standards.

• Promote employee and management awareness of relevant compliance obligations through appropriate communication and training initiatives.

• Escalate actual or potential material regulatory breaches promptly through the approved reporting channels.

• Monitor the closure of compliance gaps and validate that corrective actions address the underlying causes.

D. Fraud Prevention, Investigations and Incident Management

• Establish and maintain appropriate arrangements for identifying, reporting, assessing, and responding to suspected fraud, theft, corruption, misconduct, and material control breaches.

• Coordinate or oversee investigations into reported irregularities in accordance with approved investigation procedures and appropriate independence requirements.

• Ensure investigations are conducted objectively, confidentially, and on the basis of verifiable evidence.

• Coordinate the preservation and review of relevant documents, transaction records, system logs, access records, and other evidence.

• Prepare investigation reports setting out verified facts, findings, potential exposure, root causes, control weaknesses, and recommended actions.

• Escalate material incidents and suspected misconduct promptly to the appropriate Management or Board authority.

• Work with Human Resources, Legal, Finance, IT, and relevant business leaders where investigations require cross-functional support.

• Maintain a central register of incidents, investigations, outcomes, recoveries, and preventive or corrective actions.

• Identify recurring incident patterns and recommend improvements to processes, supervision, access controls, approvals, and employee awareness.

• Monitor implementation of agreed preventive measures and assess whether they reduce the likelihood of recurrence.

• Ensure investigations support fair and evidence-based decision-making without prejudging disciplinary, employment, legal, or other outcomes reserved for authorised decision-makers.

E. Internal Controls, Operational Assurance and Business Process Improvement

• Evaluate the design and operating effectiveness of internal controls across all material business functions and branches.

• Review segregation of duties, maker-checker arrangements, approval limits, reconciliations, access rights, exception handling, and supervisory controls.

• Assess whether approved policies, procedures, and delegated authorities are consistently implemented across the organisation.

• Identify control gaps, process inefficiencies, unauthorised workarounds, and weaknesses that expose the Company to financial loss, non-compliance, or operational disruption.

• Review controls over procurement, expenditure, payroll, asset management, vendor engagements, records management, and other material processes.

• Assess controls over information systems, cybersecurity, data access, information handling, and technology-enabled business processes in collaboration with the relevant technical owners.

• Evaluate the adequacy of controls over outsourced services, third-party engagements, and other external dependencies.

• Recommend practical improvements that strengthen accountability, protect Company resources, and improve operational efficiency.

• Work with process owners to clarify control requirements, responsibilities, documentation standards, and evidence of compliance.

• Independently verify that implemented corrective actions address identified root causes and improve control effectiveness.

• Maintain clear boundaries between independent assurance and operational ownership of business processes.

F. Management, Board Reporting and Risk Intelligence

• Prepare periodic enterprise risk reports highlighting material exposures, risk trends, incidents, mitigation progress, and matters requiring Management attention.

• Present internal audit results, significant findings, recurring weaknesses, and overdue corrective actions to the appropriate Management and Board forums.

• Prepare compliance reports showing the status of applicable obligations, outstanding deliverables, identified breaches, regulatory engagements, and remediation actions.

• Provide timely notification of critical incidents, suspected material fraud, significant compliance breaches, and critical control failures.

• Translate technical findings into clear business implications, potential financial exposure, operational consequences, and recommended management actions.

• Maintain accurate and current risk registers, audit trackers, compliance records, and investigation documentation.

• Develop dashboards that support monitoring of risk exposure, audit coverage, compliance performance, and closure of corrective actions.

• Provide quarterly and annual summaries of the Company's risk profile, audit results, compliance status, and control environment, or at the frequency approved by the relevant governance forum.

• Ensure that reports are supported by reliable evidence, clearly identify accountability, and distinguish confirmed findings from matters still under investigation.

• Monitor the timely implementation of Management and Board decisions relating to material risk, audit, and compliance matters.

G. Business Risk Oversight and Strategic Advisory

• Provide independent risk and control advice to Management on business initiatives, new products, material operational changes, and strategic decisions.

• Assess enterprise-level risks arising from business growth, branch expansion, changes in customer channels, new technology, and third-party arrangements.

• Monitor relevant credit-related exposures from an enterprise risk perspective without assuming responsibility for day-to-day credit assessment, approvals, credit administration, or collections.

• Work with functional leaders to assess operational risks affecting customer service, business continuity, data integrity, financial performance, and regulatory standing.

• Provide risk-based input into policies, procedures, delegated authorities, and governance arrangements.

• Challenge practices that create material risk, weaken internal controls, or expose the Company to avoidable loss or regulatory action.

• Recommend proportionate risk mitigation measures that support sustainable growth and protect the Company's assets and reputation.

• Promote a forward-looking approach to risk management, including the assessment of emerging risks and the potential impact of significant business changes.

• Support Management in prioritising risk mitigation resources according to materiality, likelihood, potential impact, and the Company's approved risk appetite.

H. Regulatory Engagement, Assurance Coordination and External Relationships

• Coordinate relevant engagement with regulators and other oversight bodies within the scope of the role and the Company's approved governance arrangements.

• Support the preparation of accurate and timely responses to regulatory requests, inspections, and compliance reviews.

• Coordinate with external auditors, independent assurance providers, and professional advisers on matters relating to risk, audit, and compliance.

• Track external audit findings, regulatory observations, and agreed remediation commitments, ensuring accountability and timely follow-up.

• Maintain appropriate records of regulatory correspondence, external assurance reports, and management responses.

• Ensure that regulatory and external assurance issues are escalated to the appropriate internal authorities.

• Collaborate with Legal and relevant subject-matter experts when specialist interpretation or advice is required.

• Maintain professional relationships with external stakeholders while protecting the Company's confidentiality, interests, and governance requirements.

I. People Leadership and Functional Effectiveness

• Provide strategic and operational leadership to the Risk, Internal Audit and Compliance function.

• Establish clear responsibilities, work plans, performance expectations, and accountability mechanisms for direct reports.

• Lead, coach, and develop team members to strengthen technical competence, professional judgement, and delivery standards.

• Establish functional KPIs, review mechanisms, and development priorities aligned with the Company's enterprise objectives.

• Ensure that departmental resources are allocated according to risk exposure, audit priorities, and compliance requirements.

• Promote professional integrity, independence, confidentiality, and evidence-based decision-making across the function.

• Strengthen collaboration with HODs, branch managers, and other stakeholders while maintaining the independence of assurance activities.

• Identify capability gaps and coordinate relevant professional development and training.

• Manage departmental budgets, tools, and external service providers within approved limits.

• Foster a culture of accountability, continuous improvement, and proactive risk identification.

• Monitor departmental performance and implement corrective actions where delivery falls below agreed standards.

5. Qualifications & Experience

Academic Qualifications

• Bachelor's degree in Risk Management, Accounting, Finance, Auditing, Business Administration, Law, or a related field.

• A relevant postgraduate qualification in Risk Management, Finance, Business Administration, Governance, or a related discipline will be an added advantage.

• Professional qualifications in internal audit, risk management, accounting, compliance, or related disciplines will be an advantage.

Professional Experience

• At least 8-10 years of relevant progressive experience in enterprise risk management, internal audit, regulatory compliance, governance, or assurance.

• Demonstrated experience in a senior management or leadership role with responsibility for risk oversight, audit delivery, compliance monitoring, or internal controls.

• Experience developing and implementing enterprise risk frameworks, risk registers, risk-based audit plans, compliance programmes, and management reporting arrangements.

• Demonstrated capability in conducting or overseeing branch audits, operational reviews, control assessments, and investigations.

• Experience monitoring regulatory obligations, managing compliance issues, and coordinating corrective actions.

• Experience engaging senior Management, Boards, external auditors, and regulatory authorities.

• Strong understanding of applicable legal and regulatory requirements relevant to the Company's business and regulatory status.

• Experience in microfinance, microcredit, digital lending, financial services, or another regulated, multi-branch business will be strongly preferred.

• Demonstrated experience improving internal controls, addressing recurring audit findings, and strengthening accountability across business functions.

• Experience leading and developing multidisciplinary teams and managing competing operational and assurance priorities.

6. Leadership & Behavioral Competencies

Strategic and Risk-Based Thinking

• Connects risk management, audit, and compliance priorities to enterprise strategy and business sustainability.

• Identifies material and emerging risks and prioritises them according to exposure, likelihood, and potential impact.

• Balances the need for effective controls with operational efficiency and commercial objectives.

Execution and Results Orientation

• Translates risk, audit, and compliance priorities into clear work plans, measurable targets, and disciplined execution.

• Demonstrates ownership and accountability for deliverables, reporting deadlines, and follow-up actions.

• Drives timely resolution of material findings and persistent control weaknesses.

Integrity and Professional Independence

• Demonstrates high ethical standards, objectivity, and sound professional judgement.

• Is willing to challenge decisions or practices that expose the Company to material risk.

• Maintains confidentiality and protects the independence of assurance activities.

Analytical Decision-Making and Problem-Solving

• Uses evidence, data, and structured analysis to assess risks and determine appropriate responses.

• Identifies root causes rather than addressing only the symptoms of control failures.

• Recommends practical, proportionate, and sustainable solutions.

Leadership and Team Development

• Builds a capable, accountable, and technically competent team.

• Sets clear expectations, provides constructive feedback, and addresses underperformance.

• Develops professional capability and promotes continuous improvement.

Stakeholder Management and Collaboration

• Builds effective working relationships with the Board, Management, HODs, branch leaders, and relevant external stakeholders.

• Influences stakeholders to address control weaknesses and meet agreed obligations.

• Communicates sensitive findings and complex risk matters clearly and professionally.

Adaptability and Resilience

• Operates effectively in a fast-paced, multi-branch business environment.

• Manages competing priorities while maintaining quality, independence, and professional standards.

• Responds constructively to changing risks, regulatory developments, and business requirements.

Accountability and Ethical Leadership

• Promotes transparency, ownership, and responsible decision-making.

• Encourages early reporting of incidents, errors, and control weaknesses.

• Reinforces a culture in which accountability and corrective action are valued.

7. Industry and Business Environment

The ideal candidate will have experience in one or more of the following environments:

• Microfinance and microcredit institutions.

• Digital credit providers and digital lending businesses.

• Banks and other financial services institutions.

• Fintech organisations operating in lending, payments, or related financial services.

• Regulated businesses with complex operational processes, multiple branches, or geographically distributed teams.

• Other organisations with established enterprise risk, internal audit, compliance, and governance requirements.

Candidates with direct experience overseeing enterprise risk, internal audit, and regulatory compliance within a multi-branch financial services environment will be particularly relevant to the role.

Experience operating within the applicable regulatory environment and engaging relevant regulatory and assurance stakeholders will be an advantage.

Originally posted on Himalayas