Head, Enterprise Risk and Internal Controls

The Head, Enterprise Risk and Internal Controls is a senior, organization-wide function responsible for the design, implementation, and continuous strengthening of ITU’s enterprise risk management, internal control and related second-line oversight frameworks. The role supports coherent implementation of the Three Lines Model and ensures risk management is integrated into corporate strategy and aligned with international practices.

Responsibilities

• Own and oversee ITU’s enterprise risk management, internal controls and related second-line frameworks, policies, and methodologies, ensuring alignment with leading practices and ITU’s strategic and operational objectives and performance management processes.
• Provide second-line challenge, advice, and oversight, to managers and risk owners across all Bureaus and Departments, on the identification, assessment, mitigation, escalation and monitoring of strategic, operational, financial, fiduciary, technology, cyber, compliance and emerging risks - challenging assumptions related to major transformation initiatives, digital governance, and long-term financial sustainability, including ASHI liabilities and the implications of zero nominal growth.
• Own the ERM framework, the reporting approach and quality assurance of risk information, and oversee the enterprise risk profile, corporate risk register, risk taxonomy, risk-rating methodology, risk appetite-related parameters, ensuring consistency, quality, timely updates and effective escalation of material risks (while risk ownership remains with first-line managers in the Bureaux, Departments and operational units).
• Strengthen and coordinate the internal controls and compliance follow-up framework, as part of the overall Accountability Framework, including through ensuring up-to-date and monitoring of oversight recommendations through the Compliance Dashboard and supporting robust validation and challenge mechanisms for the Letter of Representation and Statement on Internal Controls processes.
• Coordinate risk interdependencies across the Three Lines model of the organization, working closely with the relevant assurance functions (including Oversight/Internal Audit/Evaluation, Ethics, Legal, Information Security and other relevant functions) in order to support coherent, non-duplicative coverage and effective escalation, ensuring an integrated assurance approach.
• Lead integration of risk considerations into strategic planning, operational planning, major initiatives, performance management and decision-support processes, including through horizon scanning, scenario analysis, and assessment of emerging risks and risk interdependencies.
• Prepare and present consolidated risk and control reporting to senior management and relevant Governing bodies, including any related risk management committees and other Executive forums, covering key exposures, trends, control effectiveness, mitigation progress and matters requiring management action or escalation.
• Promote a strong risk and internal control culture across the organization through role-based training, awareness initiatives, guidance and engagement with managers and staff to strengthen accountability and risk-informed decision-making.
• Serve as Secretary to the relevant risk management committee, preparing high-quality materials and supporting the committee in fulfilling its governance, oversight, and advisory mandate.
• Perform any other related duties as necessary.

Requirements

• Advanced university degree in Risk Management, Business Administration, Finance, Engineering, Telecommunications, or a related field OR education from a reputed college of advanced education with a diploma of equivalent standard to that of an advanced university degree in one of the fields above.
• For internal candidates, a first university degree in one of the fields above in combination with fifteen years of qualifying experience may be accepted in lieu of an advanced university degree for promotion or rotation purposes.
• Professional certifications such as IRM Diploma, ISO 31000 Lead Risk Manager, COSO ERM, CRMA or CERM are desirable.
• At least ten years of progressively responsible experience in enterprise risk management, internal controls, compliance monitoring and/or related second-line governance functions, including leadership of an ERM function or equivalent strategic oversight role, including at least five at the international level.
• A Doctorate in a related field can be considered as a substitute for three years of working experience.
• Experience integrating risk management with strategy, planning, and performance management.
• Experience supporting senior governance bodies and committees.
• Experience in international or multilateral organizations would be an advantage.
• Experience in fraud risk assessment would be an advantage.
• Demonstrated experience integrating risk management into strategy, planning, performance management and decision-making processes.
• Knowledge of one of the six official languages of the Union (Arabic, Chinese, English, French, Russian, Spanish) at advanced level and knowledge of a second official language at intermediate level.
• Knowledge of a third official language would be an advantage.

Skills

• Enterprise Risk Management
• Internal Controls
• Compliance Monitoring
• Second-line Governance
• Risk Management Integration
• Strategy Planning and Execution
• Performance Management
• Governance Support
• Fraud Risk Evaluation
• ISO 31000 Lead Risk Manager
• COSO ERM
• IRM Diploma
• CRMA
• CERM
• Financial Risk Frameworks
• International Risk Management
• Risk Oversight
• Risk Assessment
• Risk Reporting

Languages

Arabic, Chinese, English, French, Russian, Spanish