Identify and document key processes and sub-processes across functions
Map risks associated with each sub-process
Document existing controls and clearly define control ownership
Conduct annual RCSA for major functions
Ensure that risks are comprehensively identified, controls are adequately designed and controls are operating effectively
Highlight control gaps and track closure of action items
Define and monitor KRIs for key risk indicators to assess whether risks are occurring, increasing, or under control
Escalate threshold breaches and recommend corrective actions
Capture and assess operational risk incidents - Financial loss events, Customer impact cases or Reputational impact cases
Map incidents to the relevant risk category and validate whether the existing controls are adequate or additional controls required.
Ensure Root Cause Analysis (RCA) is obtained from concerned teams and track timely closure of action points Ensure compliance with DPDP Act 2023 and applicable data privacy regulations across business functions.
Support implementation and monitoring of data privacy controls, policies, and procedures.
Conduct privacy impact assessments (PIA/DPIA) for systems, applications, and new initiatives.
Manage and report data privacy incidents/breaches, including root cause analysis and remediation.
Coordinate with stakeholders to drive data classification, consent management, and data lifecycle governance.
Drive data classification, retention, and minimization practices across business units.
Implement and monitor data protection controls (encryption, access control, masking, etc.) for sensitive data.
Support audit, regulatory, and compliance requirements, including evidence preparation and closure of findings
