Operational Resilience & System Control Analyst

The role is responsible for strengthening the ARM Group’s operational resilience and risk management framework by identifying, assessing, monitoring and mitigating operational risks across business processes, systems and third-party arrangements. It supports business continuity and disaster recovery planning, risk and control assessments, fraud prevention, and the monitoring of key risk indicators and management actions. The role also reviews IT general and application controls, including user access, system changes, transaction processing and data integrity, while ensuring compliance with established policies and control standards. Additionally, it prepares risk reports for management and governance committees, coordinates remediation of control gaps, and drives continuous improvement in operational risk management and resilience.

• Maintain the ARM Group’s operational resilience database, including the collection, validation, classification, analysis and reporting of operational incidents, near misses and financial and non-financial losses. Monitor key risk indicators (KRIs) and track agreed management actions through to closure.

• Analyse operational risk across business processes covering loss trends, root causes and recurring control failures, and recommend appropriate preventive and corrective actions.

• Support the development, implementation and periodic review of the Group’s business continuity management (BCM) framework, business continuity plans, business continuity and disaster recovery tests, and business impact analyses (BIAs).

• Work with Technology and Information Security to coordinate periodic business continuity and disaster recovery tests covering critical applications and processes, document lessons learned and track remediation of identified gaps.

• Coordinate and periodically review risk and control self-assessments (RCSAs) across business units, ensuring key operational risks and process and system controls are appropriately identified, assessed and documented.

• Work with Technology and Information Security to assess operational resilience dependencies and ensure appropriate recovery and control arrangements exist for critical systems and processes.

• Work with Internal Audit and relevant business functions to support the development and implementation of fraud prevention and detection controls, including fraud risk assessments, monitoring of red flags and investigation support where required.

• Support new projects and initiatives by performing operational risk assessments for new products, processes, systems, vendors, partnerships and significant business changes. Work with stakeholders to assess and implement effective controls in systems and processes.

• Prepare and present periodic operational risk and resilience reports and dashboards for management risk committees, Board committees and other relevant governance forums.

• Promote operational resilience awareness across the business through training, engagement and supervision of risk champions, and other risk culture initiatives.

• Support reviews of third-party and outsourcing arrangements from an operational resilience and business continuity perspective, ensuring relevant risks are assessed and effective controls are established for affected systems and processes.

• Contribute to the continuous enhancement of the ARM Group’s enterprise risk management (ERM) framework, policies, procedures, tools and reporting processes.

• Develop, document and periodically review operational level agreements (OLAs) between internal teams to clearly define service expectations, responsibilities, dependencies and performance standards.

• Establish processes to monitor compliance with agreed OLAs, identify service or performance gaps and coordinate with relevant teams to track corrective actions through to closure.

• Review user access to business applications and privileged accounts, including access requests, role changes, periodic recertification and timely removal of access for leavers. Verify approvals, least-privilege access and segregation of duties, and track exceptions through to closure.

• Assess application controls over transaction initiation, authorisation, processing and posting, including maker-checker controls, approval limits, duplicate checks and exception handling. Identify incompatible roles and recommend corrective actions.

• Review system changes, configuration changes, releases and data amendments to verify documented approvals, testing, user acceptance, appropriate separation of development and production access, and evidence of controlled deployment and rollback arrangements.

• Review controls over interfaces, automated processing and reconciliations between applications and financial records. Monitor failed jobs, rejected transactions and reconciliation exceptions, and follow up on timely resolution with responsible teams.

• Review audit trails and exception reports for unauthorised access, unusual transactions, privileged activity and changes to sensitive data or system parameters. Escalate control breaches and support investigation and remediation with relevant teams.

• Assess the design and operating effectiveness of IT general controls and application controls through risk-based testing and evidence review. Maintain a record of findings, agreed actions and closure evidence, and report significant or overdue issues.

• Participate in system implementations and digital initiatives to assess control requirements during design and user acceptance testing and verify that significant control gaps receive appropriate resolution or documented risk acceptance before deployment.

• Work with Technology, Information Security, Operations and Internal Control to review controls over data accuracy, completeness, retention and recovery, including evidence of backup and restoration tests for critical applications. Maintain independent oversight of controls implemented by system owners.

Requirements

• Strong understanding of operational risk management principles, frameworks and methodologies, including risk and control self-assessments (RCSAs), operational loss event management, key risk indicators (KRIs) and control assessment.

• Good knowledge of business continuity management (BCM), business impact analysis (BIA), disaster recovery (DR) and operational resilience principles.

• Practical understanding of fraud risk management, including fraud risk assessments, fraud indicators, preventive and detective controls, incident escalation and investigation support.

• Strong risk identification, assessment and analytical skills, with the ability to evaluate processes, identify control weaknesses and recommend practical risk mitigation measures.

• Ability to perform root cause analysis on operational incidents, losses, control failures and near misses and translate findings into actionable remediation plans.

• Good understanding of internal controls, process risk and governance frameworks within financial services.

• Strong data analysis and reporting skills, including the ability to analyse risk and incident data, identify trends and prepare meaningful risk dashboards and management reports.

• Familiarity with governance, risk and compliance (GRC) platforms, data visualisation tools or data analytics tools would be an advantage.

• Strong stakeholder management and interpersonal skills, with the confidence to engage and appropriately challenge business units on risk and control matters.

• Good attention to detail, sound judgement and the ability to manage multiple risk activities and deadlines simultaneously.

• Strong problem-solving and critical-thinking skills, with a proactive approach to identifying emerging operational risks and control gaps.

• Ability to work independently while also collaborating effectively with Operations, Technology, Information Security, Compliance, Internal Control, Internal Audit and other business functions.

• Good understanding of the capital markets and broader financial services operating environment, including relevant operational, technology, regulatory and third-party risks.

• Good understanding of relevant international frameworks, standards and regulatory requirements, including COBIT, ISO standards, COSO and DORA.

• Demonstrated ability to promote risk awareness and a strong risk culture across the organisation.

• Good understanding of IT general controls and application controls, including user access management, privileged access, segregation of duties, change management and system operations.

• Ability to assess automated transaction controls, maker-checker workflows, approval limits, system interfaces, reconciliations and controls over master data and transaction amendments.

• Ability to review system logs, audit trails and exception reports, perform control testing and document evidence, findings and remediation actions clearly.

• Practical understanding of the system development life cycle, user acceptance testing, release management and control requirements for digital platforms. Experience using SQL or similar tools for control analysis would be an advantage.