Third Party Risk Officer

The Third Party Risk Officer is a critical second-line-of-defense position within Salmon Bank’s Risk Management Team. The role is responsible for the independent oversight, challenge, and governance of Salmon Bank’s Third Party Risk Management (TPRM) program, ensuring that risks arising from relationships with vendors, affiliates, outsourced service providers, related parties, and other external parties are identified, assessed, monitored, and mitigated in accordance with the Bank’s risk appetite and regulatory requirements.

The role also provides independent risk oversight of third-party arrangements that constitute Related Party Transactions (RPTs), ensuring compliance with Salmon Bank’s RPT Framework and appropriate governance standards.

The Officer serves as the primary subject-matter expert on third-party risk, provides independent challenge to first-line business units, and prepares and presents TPRM reporting to the Risk Oversight Committee (ROC) and senior management.

Key Responsibilities

Second-Line Oversight & Independent Challenge

• Provide independent, risk-based oversight of first-line execution of the TPRM lifecycle covering: onboarding, due diligence, contracting, ongoing monitoring, and offboarding in partnership with first line in accordance with BSP regulations, Salmon Bank's TPRM Policy and Procedures.

• Conduct and challenge first-line risk assessments, due diligence outputs, and remediation plans, escalating material findings to the Head of Risk and relevant governance committees as appropriate.

• Maintain Salmon Bank's independent enterprise-wide third-party risk inventory and risk register, ensuring completeness, accuracy, and timeliness of data at all times.

• Identify emerging risks within the third-party portfolio, including concentration risk, sub-contracting (fourth-party) risk, and critical service dependency risk.

Governance, Policy & Framework

• Own, maintain, and periodically review Salmon Bank's TPRM Policy, Framework, Standards, and Procedures, ensuring alignment with relevant regulatory guidance.

• Define and maintain risk appetite thresholds, key risk indicators (KRIs), and key performance indicators (KPIs) specific to third-party risk at Salmon Bank in partnership with first line.

• Develop and manage tiering and classification criteria to distinguish critical, important, and standard third parties in Salmon Bank's portfolio aligned to the bank’s BC framework and Recovery Plan.

• Ensure Salmon Bank's TPRM framework remains current with evolving regulatory expectations, industry standards and market best practices.

• Oversee and independently challenge the assessment of third-party arrangements involving Related Parties, ensuring that engagements where a third party is also classified as a Related Party are identified, evaluated, approved, monitored, and reported in accordance with Salmon Bank’s Related Party Transactions (RPT) Framework, regulatory requirements, and conflict-of-interest management standards. Coordinate with Compliance, Legal, Procurement, and relevant business units to ensure appropriate governance, arm’s-length treatment, and escalation of material RPT-related risks to the appropriate management and Board committees.

Risk Oversight Committee Reporting

• Design, prepare, and present comprehensive TPRM reporting packs to Salmon Bank's Risk Oversight Committee (ROC) on a regular basis, covering portfolio risk profiles, material third-party issues, emerging risks, regulatory developments, and remediation action status.

• Produce management information system (MIS) and dashboards that provide clear, concise, and actionable insights to senior leadership and Board-level stakeholders at Salmon Bank.

• Coordinate with the Head of Risk and Corporate Secretary to ensure TPRM items are appropriately scheduled on committee agendas and that meeting minutes accurately capture decisions and action items.

• Respond to ad-hoc information requests from the ROC, Internal Audit, and regulators concerning Salmon Bank's third-party risk exposure.

Risk Assessment & Due Diligence

• Conduct or oversee inherent and residual risk assessments for all third parties, encompassing operational, financial, cyber/information security, compliance, reputational, concentration, and strategic risk dimensions relevant to Salmon Bank.

• Review and challenge due diligence outputs, including financial stability assessments, cybersecurity questionnaires, business continuity and disaster recovery capabilities, and regulatory compliance attestations.

• Assess sub-contracting and fourth-party arrangements to ensure material risks to Salmon Bank are identified and appropriately mitigated.

Monitoring, Assurance & Escalation

• Maintain ongoing monitoring of third parties through defined review cycles, performance scorecards, and trigger-event protocols (e.g., adverse news, regulatory actions, financial distress, cyber incidents).

• Track and challenge the closure of issues and remediation actions arising from due diligence reviews, internal audits, and regulatory inspections.

• Manage third-party incidents and escalation procedures, coordinating with Operational Risk, IT/Cyber Security, Compliance, Legal, and Procurement teams within Salmon Bank.

• Oversee exit planning and termination procedures for critical third parties to safeguard Salmon Bank's operational continuity.

Regulatory & Compliance Management

• Act as the primary point of contact for regulatory examinations, internal audits, and external reviews related to TPRM at Salmon Bank, compiling required documentation and coordinating management responses.

• Monitor and assess the impact of new and emerging regulatory requirements on Salmon Bank's TPRM program, driving timely program updates and communicating changes to relevant stakeholders.

• Ensure Salmon Bank maintains a register of outsourcing and material third-party arrangements in the format required by applicable regulators.

Stakeholder Engagement & Training

• Serve as a trusted advisor to Salmon Bank's first-line business units, Procurement, Legal, IT, and Compliance on third-party risk matters throughout the vendor engagement lifecycle.

• Develop and deliver TPRM awareness training and guidance materials to relevant staff across Salmon Bank, promoting a strong risk culture.

• Build and maintain productive relationships with key third-party relationship owners and, where appropriate, with the third parties themselves.

Related Party Transaction (RPT) Oversight

• Provide independent second-line oversight of third-party arrangements involving Related Parties, ensuring compliance with Salmon Bank’s RPT Policy, regulatory requirements, and governance standards.

• Review and challenge the identification, risk assessment, due diligence, and approval processes for third-party engagements involving Related Parties, including affiliates, shareholders, directors, officers, and other covered persons.

• Assess potential conflicts of interest, preferential treatment risks, concentration risks, and reputational risks arising from Related Party arrangements and ensure appropriate mitigating controls are implemented.

• Coordinate with Compliance, Legal, Finance, and business units to ensure that transactions are conducted on an arm’s-length basis and are appropriately documented, monitored, and reported.

• Support the preparation of RPT-related risk reporting and escalation of material issues to the Risk Oversight Committee, Related Party Transactions Committee, and/or Board, as applicable.

Qualifications

• Minimum of 5 years experience in third-party / vendor risk management, operational risk, or a related risk discipline within a regulated financial services environment (bank, fintech, or equivalent).

• Demonstrated experience operating as, or supporting, a second-line-of-defence function with direct exposure to risk governance committees.

• Strong working knowledge of applicable regulatory frameworks of the BSP.

• Proven ability to prepare and present board- or committee-level risk reporting and management information to a high standard.

• Experience managing the full third-party risk lifecycle, including due diligence, risk assessments, ongoing monitoring, and offboarding.

• Bachelor's degree in Finance, Business, Risk Management, Law, Information Technology, or a related discipline; or equivalent professional experience.