Risk Manager

The Risk Manager owns the framework, not the assurance over it. That means maintaining the enterprise risk register, running risk workshops with business owners, defining and monitoring appetite and tolerance measures, and reporting the group's risk profile to the executive committee and the board. Where internal audit reports on what has gone wrong, risk management is accountable for whether the organisation can see what might.

The distinction matters at interview. A Risk Manager designs and facilitates; a business owner owns the risk and the mitigation. Blurring that line is the most common way the role loses credibility, and the most common thing an interviewer probes.

Singapore has an unusually deep market for the seat. Banks and insurers operate formal three-lines models with second-line risk functions supervised against MAS expectations, while listed groups and conglomerates run leaner enterprise risk teams reporting into a Risk or Audit Committee. Regional and operational risk exposure across Southeast Asia entities is standard.

Where this sits: the lateral manager-level seat in the Internal Audit & Risk pathway, alongside Internal Audit Manager. Most holders arrive from Senior Internal Auditor; adjacent finance-side seats are Finance Manager in the Accounting pathway and Treasury Manager where financial risk dominates.

• Own and maintain the enterprise risk management framework, policy and taxonomy.
• Facilitate risk identification and assessment workshops with business and functional owners.
• Maintain the group risk register, including likelihood, impact, control effectiveness and residual ratings.
• Define, monitor and report key risk indicators against approved appetite and tolerance levels.
• Prepare risk reporting for the executive committee, Risk Committee or Audit Committee.
• Coordinate business continuity, crisis response and scenario or stress testing exercises.
• Assess risk in new products, markets, systems and acquisitions before approval.
• Partner with internal audit and compliance so the three lines are complementary rather than duplicative.

• A degree in accountancy, finance, business, economics or engineering.
• Seven to ten years across internal audit, risk, compliance or operations, with framework-level ownership.
• Evidence of running risk assessment workshops with senior business owners, not only maintaining a register.
• CRMA, FRM, CIA or PRM; CA (Singapore) or ACCA where the profile is finance-led.
• Familiarity with ISO 31000 or COSO ERM and with three-lines governance models.
• Comfort presenting an unwelcome risk position to an executive audience.

• Draw the ownership line. Say plainly that the business owns the risk and you own the framework and challenge.
• Bring a live register. Explain how a risk moved rating and what decision that change actually drove.
• Show appetite in practice. A tolerance breach you reported, and what the committee did about it.
• Explain the audit-to-risk shift. Interviewers test whether you can move from retrospective testing to forward-looking judgement.
• Ask which committee you report to. A Risk Committee line implies far more standing than a report routed through management.