Quality and control
- Own the control framework, the policy and obligation register and the role-and-access matrices.
- Run control testing and report results to the client's risk and audit forums.
- Confirm that no process goes live until its controls, ownership and evidence route are in place.
Independence and neutrality
- Own the conflict register, recusal log and declarations, and the quarterly conflict reviews.
- Investigate and report breaches, and drive containment and corrective action.
- Make sure specialist teams stay inside their approved boundaries.
Risk and audit
- Maintain the risk register and report material risks and dependencies.
- Support internal and external audit with complete evidence packs.
- Report control failures and repeated exceptions through governance.
Governance
- Chair the quality and risk forum and attend service governance forums.
- Work with the Compliance and Regulatory Lead, who carries out regulatory execution day to day.
What success looks like
- No process goes live without its controls, owner and evidence route.
- Control testing completed on schedule and reported to the client's risk and audit forums.
- Conflict register, recusal log and declarations current, with quarterly reviews held.
- Audits supported with complete evidence and no unresolved repeat findings.
Boundaries of the role
Independence is central to this service. This role does not:
- accept risk or grant a policy dispensation on the client's behalf: the client accepts risk.
- override, or act in place of, a client decision on policy, budget, rates, selection, payment, settlement or risk acceptance.
- favour or disadvantage any supplier or candidate.
You must declare any current or recent relationship with the client institution or with any supplier on its panel.