Enterprise, Third-Party & Resilience Risk Manager

Value to HT: HT never promises a client more than its partners are bound to deliver, can prove it recovers in the hours it has promised, and gives management one trusted risk picture on every deadline.

What the business gets

• Contracts signed with liability, service credits, data terms and exit rights that match what partners owe HT, so margin on the ₦5.9bn licensing line is not given away in the small print

• A partner, OEM and supplier base that is selected, monitored and scored through the year, with exit plans for the critical ones

• Availability and recovery commitments (99.9% to 99.99%, 2 to 4 hours) backed by tests, so SLA credits and renewal risk fall, and a trained crisis team

• EMC and the Group get the risk register, indicators, losses and actions on every deadline, produced from Sentra, and the CRO's time back for judgement

• A risk champion in every practice, trained and running a self-assessment cycle: the Practice Blueprint's security and risk pillar made real

Key accountabilities

1. Review client, partner and OEM contracts above an agreed threshold before signature: liability caps, indemnities, SLA credits, recovery commitments, data terms, audit rights and exit; keep client commitments and partner obligations back to back; own the contract standard with Legal.

2. Run the third-party lifecycle for critical suppliers and partners: due diligence, tiering, scorecards, annual financial-health review, revenue-share reconciliation, exit plans; client due diligence and sanctions checks for new external and cross-border clients.

3. Own the business continuity management system (ISO 22301): refresh the impact analysis, set recovery targets per critical service, run the annual exercise programme including recovery tests for client platforms, the SOC and NOC and joint tests with bank clients; validate recovery before new SLAs are signed.

4. Stand up crisis management: named crisis team with legal and communications leads, one crisis protocol with the CISO and Marketing, ransomware playbook.

5. Maintain Sentra (register, controls, indicators, actions, loss events); produce the monthly EMC dashboard, the monthly exception report and the quarterly Group submissions on deadline for the CRO; monitor risk appetite, client concentration and revenue at risk.

6. Track audit, regulatory and certification findings to closure.

7. Run the risk champion network and the annual risk and control self-assessment in every practice.

Why now

• Licensing and partnerships are 36% of FY27 revenue, with 37 renewals and new OEM financing; 2026 reviews found partner terms with no liability cap.

• Managed services and cloud sell availability; critical processes have never been exercised and the Board recorded continuity appetite as breached. Group deadlines allow no extension and are met by hand today.

External benchmark: Verizon DBIR 2025: third-party involvement in breaches doubled to 30% in a year. Gartner: 45% of organisations had a third-party-caused business interruption in two years. BCI Horizon Scan 2025: cyber attacks, IT outages and third-party failure are three of the top five threats.

Experience and qualifications

• 7+ years in enterprise, operational or vendor risk in a bank, insurer, telco or technology services firm

• Strong contract literacy; experience with IT outsourcing, cloud and managed-service contracts

• ISO 22301 Lead Implementer or Auditor, or CBCI/MBCI; GRC platform experience

• IRM certificate, CRISC or CTPRP an advantage Risks it leads on

Framework categories: Legal, Credit, Market, Liquidity, Strategic, Operational

• Third-party management lifecycle: evaluation and selection, contract and service initiation, ongoing monitoring, termination

• Channel partner performance; counterparty, credit and concentration analytics

• Enterprise resiliency: business impact analysis, continuity and disaster recovery planning

• Crisis management: response planning, tabletop and war-game exercises, crisis communication, third-party responsibilities

• Programme reporting, risk analytics, metrics and risk culture

Strategy lines it protects

Seller to financier; Reseller to operator; Group to external clients.

Licensing and partnerships ₦5.91bn; managed services and cloud ₦4.3bn (every SLA with a restore clock); EMC, Board and Group confidence

Year-one deliverables

Contract register for every critical supplier and client; deal packs reviewed within 5 working days Q1 2027

No contract with uncapped liability without MD/CEO approval; partner agreements matched to responsibility From Q1 2027

Impact analysis refreshed; recovery tested for the largest managed-service contract before renewal Q1 / Q2 2027

All critical processes exercised; crisis team trained and one simulation run Full year / Q3 2027

Every EMC, Board and Group submission prepared on time; every risk with a live indicator Monthly / Q2 2027

Self-assessment completed in every practice Q3 2027

Measures of success

• Contracts above threshold reviewed before signature: 100%

• Critical suppliers with current due diligence and exit plan: 100%

• Critical services with a successful recovery test in 12 months: 100%

• Submissions on time: 100%; overdue indicators under 10%

Works with: MD/CEO, Legal, Finance, Partnerships, COO, CTIO, practice leads and risk champions, Group Risk

Grows later with: Business Continuity Analyst (exercise programme, crisis management) as managed-service SLAs grow; Enterprise Risk & GRC Analyst (Sentra, reporting, champion network) when Group reporting volume justifies it.