Review client, partner and OEM contracts above an agreed threshold before signature: liability caps, indemnities, SLA credits, recovery commitments, data terms, audit rights and exit; keep client commitments and partner obligations back to back; own the contract standard with Legal.
Run the third-party lifecycle for critical suppliers and partners: due diligence, tiering, scorecards, annual financial-health review, revenue-share reconciliation, exit plans; client due diligence and sanctions checks for new external and cross-border clients.
Own the business continuity management system (ISO 22301): refresh the impact analysis, set recovery targets per critical service, run the annual exercise programme including recovery tests for client platforms, the SOC and NOC and joint tests with bank clients; validate recovery before new SLAs are signed.
Stand up crisis management: named crisis team with legal and communications leads, one crisis protocol with the CISO and Marketing, ransomware playbook.
Maintain Sentra (register, controls, indicators, actions, loss events); produce the monthly EMC dashboard, the monthly exception report and the quarterly Group submissions on deadline for the CRO; monitor risk appetite, client concentration and revenue at risk.
Track audit, regulatory and certification findings to closure.
Run the risk champion network and the annual risk and control self-assessment in every practice.
Why now
Licensing and partnerships are 36% of FY27 revenue, with 37 renewals and new OEM financing; 2026 reviews found partner terms with no liability cap.
Managed services and cloud sell availability; critical processes have never been exercised and the Board recorded continuity appetite as breached. Group deadlines allow no extension and are met by hand today.
External benchmark: Verizon DBIR 2025: third-party involvement in breaches doubled to 30% in a year. Gartner: 45% of organisations had a third-party-caused business interruption in two years. BCI Horizon Scan 2025: cyber attacks, IT outages and third-party failure are three of the top five threats.
Experience and qualifications
7+ years in enterprise, operational or vendor risk in a bank, insurer, telco or technology services firm
Strong contract literacy; experience with IT outsourcing, cloud and managed-service contracts
ISO 22301 Lead Implementer or Auditor, or CBCI/MBCI; GRC platform experience
IRM certificate, CRISC or CTPRP an advantage Risks it leads on