Enterprise Risk & Compliance Manager

The Enterprise Risk Manager leads and advances the institution's enterprise risk management (ERM) and compliance program to identify, assess, monitor, and report risks that may impact the university's strategic objectives, academic mission, financial sustainability, compliance obligations, operational effectiveness, and reputation. This role partners closely with executive leadership, academic and administrative units, Internal Audit, Compliance, and Legal to embed risk awareness into strategic planning and institutional decision-making. The Enterprise Risk Manager operates with appropriate independence and provides objective risk insights to senior leadership and the Audit Committee.

Responsibilities include but not limited to:

Enterprise Risk Management Program

• →Design, implement, and continuously enhance the institution's Enterprise Risk Management framework, aligned with COSO ERM and higher education best practices. 
• →Maintain the enterprise risk register, risk taxonomy, and risk appetite/tolerance statements.
• →Lead the annual enterprise-wide risk assessment and periodic targeted risk reviews.
• →Integrate ERM insights into institutional strategic planning, enrollment management, and long-term financial sustainability discussions. 
• →Prepare and maintain enterprise risk assessments, risk registers and heat maps, KRI dashboards, concise, decision-useful risk reports for executive leadership, the Audit Committee, and the Board of Trustees, mitigation action plans, and scenario and resilience analyses.                                                           

Risk Identification, Assessment & Monitoring

• →Facilitate risk assessment workshops and interviews with academic leadership, administrative departments, and shared governance bodies. 
• →Identify and assess strategic, academic, operational, financial, compliance, technology, research, enrollment, reputational, and student-related risks. 
• →Evaluate inherent risk, residual risk, and control effectiveness, including emerging and evolving risks and track risk mitigation action plans. 
• →Oversee third-party and vendor risk assessments in partnership with Procurement, IT, and Legal, including data privacy and security reviews of vendors that handle student, employee, or institutional data. 
• →Support governance and risk assessment of artificial intelligence (AI) tools used in academic and administrative operations, aligned with recognized frameworks such as the NIST AI Risk Management Framework. 
• →Develop, monitor, and refine Key Risk Indicators (KRIs) relevant to higher education (ie: enrollment trends, financial performance, cybersecurity events, regulatory findings, accreditation risks).                                                                                                                                                                                  

Compliance Oversight

• →Oversee the compliance monitoring and testing program, including developing and executing an annual risk-based compliance plan. 
• →Direct compliance risk assessments and testing of adherence to federal, state, and accreditation requirements and institutional policies. 
• →Partner with the Chief Compliance Officer, Legal, and policy owners to monitor regulatory changes and assess their impact on institutional risk. 
• →Report compliance findings, trends, and remediation status to senior leadership and the Audit Committee, and track corrective actions through closure. 

Team Leadership

• →Supervise the Enterprise Risk Analyst and Compliance Auditor, including setting priorities, assigning work, and reviewing work products for quality and accuracy. 
• →Provide coaching, training, and performance feedback, and support staff professional development and cross-training.                                                                   

Institutional Resilience & Stakeholder Engagement

• →Support institutional resilience through risk-informed crisis management, business continuity planning, and scenario analysis. 
• →Participate in lessons-learned reviews following significant incidents or disruptions and incorporate outcomes into the ERM program. 
• →Serve as a trusted advisor to academic and administrative leadership on enterprise risk matters. 
• →Promote a risk-aware culture through training, communication, and integration of ERM into everyday decision-making. 
• →Enhance risk literacy across the institution while respecting shared governance principles.                              

Governance & Accreditation

• →Align ERM activities with accreditation requirements (ie: Middle States and other regional accreditors) and applicable regulatory expectations (ie: Title IV, FERPA, Clery Act, research compliance). 
• →Coordinate with Internal Audit, Compliance, and Legal to align assurance activities with institutional risk priorities and avoid duplication of effort. 

• Bachelor's degree in Risk Management, Accounting, Finance, Business Administration, or a related field.
• 7-10 years of experience in compliance auditing or internal auditing.
• Minimum 3 years in a supervisory or management role.

• Strong executive and Board-level communication skills.
• Ability to influence without direct authority.
• Strong facilitation, collaboration, and consensus-building skills.
• Clear, concise writing and presentation skills.Technical Skills
• Enterprise-wide risk assessment facilitation, risk register and taxonomy development.
• Risk appetite and tolerance articulation, KRI development and monitoring, and control effectiveness evaluation.
• Knowledge of higher education accreditation, governance structures, and regulatory risks (Title IV, FERPA, Clery Act).
• Understanding of enrollment, financial aid, cybersecurity, technology, research, and reputational risks.
• Data analysis and visualization (Excel, Power BI, Tableau); familiarity with GRC platforms (e.g., Archer, ServiceNow GRC, LogicGate).

• Professional certifications such as CIA, CPA, CISA, CFE, CCEP (Certified Compliance & Ethics Professional), CRMA (Certification in Risk Management Assurance), or RIMS-CRMP preferred.

• Occasional domestic and international travel to Touro University campuses as needed.

• Extensive use of computers
• Extensive time sitting and standing
• Able to lift up to 5 lbs.