Operational Risk Management (Senior Officer)

Job Purpose :

To perform and support the operational risk management function for the life insurance business, covering IT risk and business continuity management (BCM), by carrying out the identification, assessment, monitoring and reporting of operational risks across the insurance value chain — underwriting, policy administration, claims and distribution — so that these risks are controlled within the Board-approved risk appetite and in compliance with insurance regulatory requirements (e.g. OIC regulations, ERM/ORSA).

The role works under the direction of Head of Resilient Risk Management Department, performing day-to-day risk management activities, preparing analyses, working papers and draft reports, coordinating with first-line business units, and providing work guidance to junior team members as assigned.

Key Responsibilities:

Operational Risk Management

• Support the development, implementation and maintenance of the operational risk management framework aligned with the Company's ERM framework and the ORSA (Own Risk and Solvency Assessment) process, and update related policies, procedures, templates and working documents as assigned.

• Coordinate and facilitate Risk & Control Self-Assessment (RCSA) exercises across insurance functions — underwriting, new business, policy servicing, claims, actuarial operations, bancassurance distribution and investment back office; consolidate the results, maintain the operational risk register, and follow up outstanding action items with risk owners.

• Collect, validate and monitor Key Risk Indicators (KRIs) such as claims processing errors, policy issuance turnaround breaches, mis-selling complaints and system downtime; prepare KRI dashboards and promptly highlight threshold breaches to the Manager.

• Maintain the operational loss event database; gather incident information, support investigations into events such as claims payment errors, premium collection failures, fraud events and system failures, assist in root cause analysis, and track remediation actions through to closure.

• Support the monitoring of market conduct and mis-selling risk in coordination with Compliance, particularly for the agency and bancassurance channels.

• Prepare draft risk reports, dashboards and supporting analysis for the Risk Management Committee (RMC), the Risk Oversight Committee of the Board, and regulatory submissions, for review and approval by the Manager.

Business Continuity Management (BCM)

• Maintain the Company's BCM framework documentation, business continuity plans and insurance regulator BCM requirements, and update them following each review cycle.

• Support the conduct of Business Impact Analysis (BIA) for critical insurance services — claims payment, policy issuance, premium collection, call center and policyholder services — and compile the resulting RTO and RPO data for the Manager's review.

• Verify that continuity arrangements are in place for critical outsourced services and maintain the supporting records and evidence.

• Assist in planning and executing annual BCP and DR exercises, including call tree tests, alternate site tests and cyber crisis simulations; prepare exercise scenarios and materials, record observations and results, and draft the post-exercise report for submission to the RMC.

• Act as a member of the BCM support team during actual disruptions such as floods, pandemics, cyber incidents and system outages, performing assigned activation, communication, coordination and event logging duties.

Governance, Culture and Regulatory

• Support the embedding of a three-lines-of-defense risk culture; prepare training materials and deliver operational risk and BCM training sessions to business units.

• Compile documentation, evidence and draft responses for OIC examinations, external audits and internal audit reviews relating to operational risk, IT risk and BCM, and track the status of audit and examination findings.

• Provide work guidance and review support to junior team members as assigned by the Manager.

Undertake any other assignments as directed by the Manager.

Qualifications:

• Bachelor's degree or higher in Risk Management, Insurance, Actuarial Science, Information Technology, Finance, or a related field.

• 3–5 years of experience in operational risk, IT risk or BCM, preferably in life insurance, general insurance, banking or financial services.

• Knowledge of insurance regulations and frameworks, including OIC ERM/ORSA requirements.

• Familiarity with relevant standards: COSO, ISO 31000, ISO 22301 (business continuity) and ISO/IEC 27001 (information security).

• Certifications are an advantage: ISO 22301 / ISO 27001, CBCI / AMBCI.

• Strong analytical, report-writing and presentation skills; able to prepare clear and accurate risk materials for senior management, committees and regulators.

• Good command of English (for communication with the Company's joint venture).

• Proficiency in Microsoft Office, particularly Excel and PowerPoint; experience with GRC or risk management systems is an advantage.