Chief Control Officer

Overview

BPAS is a national provider of retirement plan administration, employee benefit solutions, and fiduciary and trust services. For more than 50 years, we've redefined what it means to be a benefits partner. We combine deep expertise, transparent service, and a people-first approach to make benefit plans easier, smarter, and more effective for everyone involved.As a financially stable subsidiary of Community Financial Systems, Inc. (NYSE: CBU), we support 10,375 plans, $132 billion in trust assets, $1.3 trillion in fund administration, and more than 980,000 participants in partnership with advisors, trustees, and financial professionals across the nation. One partner. Smarter benefits. Better results.

Responsibilities

The Chief Control Officer would be accountable for building and leading the first-line risk and control function within BPAS. This includes the first line ownership of the business risk and control self-assessment process, control inventory, issue management lifecycle, governance reporting, escalation routines, vendor risk oversight, data and privacy control alignment, and business-level implementation of enterprise risk policies across all of BPAS business segments, including NRS/GTC, Hand Benefit & Trust .The role would also act as a trusted advisor to business leadership on the risk implications of new products, services, technology implementations, strategic initiatives, platform changes, vendor arrangements, and transformation efforts.Essential Duties:First-Line Risk and Control Ownership

• Own and maintain the benefits administration risk and control self-assessment process, ensuring risks are appropriately identified, rated, and mapped to controls.
• Maintain an accurate risk and control inventory aligned with the enterprise risk framework.
• Ensure key controls are designed appropriately and operating effectively across operational, compliance, technology, third-party/vendor, and conduct risk areas.
• Drive timely identification, escalation, and remediation of control gaps, issues, events, and near misses.Enterprise Risk Framework Execution
• Serve as the business owner for executing the enterprise risk management framework within BPAS.
• Implement enterprise expectations related to operational risk, compliance risk, third-party risk, technology/cyber risk, and business continuity.
• Partner with second-line Risk and Compliance teams to interpret new or updated enterprise policies and regulatory requirements and apply them in a practical, business-specific manner.Governance, Reporting, and Escalation
• Prepare and present risk and control reporting to business leadership, enterprise risk committees, and applicable governance forums.
• Own the issue management lifecycle for the business, including identification, root cause analysis, corrective action planning, validation, and closure.
• Escalate material risks, control breaks, and emerging risks to senior business leadership and enterprise risk partners in a timely manner.
• Support regulatory exam readiness and respond to regulatory or audit inquiries pertaining to the business.Risk Culture and Business Partnership
• Foster a strong risk culture within BPAS by embedding risk ownership and accountability into day-to-day business operations.
• Advise business leadership on risk considerations related to products, services, technology, and strategic initiatives.
• Work closely with Internal Audit, Compliance, Legal, and Enterprise Risk on exams, audits, independent testing, and related business responses.Third-Party and Vendor Risk Oversight
• Oversee third-party and vendor risk management for the business, given the vendor-intensive nature of benefits administration.
• Ensure appropriate due diligence, ongoing monitoring, and contractual risk controls for critical vendors, including recordkeeping platforms, third-party administrators, and data exchange providers.