Director

Risk & Compliance Director

| India | Group Services

Purpose of the Role

The Risk & Compliance Director is responsible for leading the Risk & Compliance team supporting Financial Accounting Services (FAS), Procure-to-Pay (PTP), Employee Services and Payroll Solutions (ESPS), and Commercial Services (CS).

Acting as a key member of the Second Line of Defence (2LoD), the role provides leadership, subject matter expertise, independent challenge and assurance across the Group Services (GS) control environment. The role is accountable for strengthening control ownership, improving control effectiveness, maximising the assurance obtained from 2LoD activities and supporting the continued evolution of the Operating Model (OM).

The role acts as a key interface between GS leadership, Global Internal Audit (GIA), external auditors and other assurance providers, ensuring effective coordination of assurance activities while continuously strengthening the control environment.

As GS continues to evolve, the role plays a critical part in ensuring risks and controls are appropriately considered as new entities and processes transition into the OM (e.g. Asset Management, OT, Simandou). In addition to leading a team, the role holder is expected to personally develop assessments, methodologies, governance papers, assurance reviews, strategic recommendations and control documentation.

Key Accountabilities

Leadership and Culture

• Lead, coach and develop the Risk & Compliance (R&C) team, creating a high-performing and engaged culture.
• Foster an environment of collaboration, inclusion, accountability and continuous learning.
• Build technical capability across the R&C team in internal controls, assurance and governance.
• Establish clear objectives, performance expectations and development plans for R&C team members.
• Promote employee respect, wellbeing, engagement and psychological safety.
• Champion Rio Tinto values, leadership behaviours and expected standards of conduct.
• Support succession planning and capability development across the Controls & Assurance function.

Controls and Assurance Leadership

• Lead R&C activities across FAS, PTP, ESPS and CS.
• Act as the primary subject matter expert and trusted advisor on internal controls, governance and assurance matters.
• Provide independent challenge and oversight from a 2LoD perspective.
• Support the development of a strong controls culture focused on ownership, accountability and continuous improvement.
• Promote effective risk management practices and control discipline throughout GS.
• Support the General Manager Controls & Assurance in delivering strategic objectives and priorities across Group Services.

Control Ownership and Operating Model Governance

• Maintain ownership of the R&C control framework across the supported functions.
• Partner with 1LoD to ensure risks and controls remain appropriately designed and operated as the OM evolves.
• Ensure 1LoD accountability and ownership for key controls are clearly defined, documented and understood.
• Review and challenge existing control design to ensure controls remain effective, efficient and sustainable.
• Support the embedding of controls into new operating models, organisational structures and service delivery arrangements (e.g. Asset Management, OT, Simandou, or legacy-Arcadium).

Stakeholder Partnership

• Act as the primary R&C partner for the General Managers of FAS, PTP, ESPS and CS.
• Build strong and trusted relationships with leaders across GS.
• Provide pragmatic and commercially focused advice on risk, controls, governance and assurance matters.
• Influence decision-making through constructive challenge, insight and recommendations.
• Support leaders in addressing control deficiencies and strengthening their respective control environments.
• Facilitate collaboration between GS and stakeholders across Rio Tinto (e.g. M-ERP project).

Assurance and Monitoring

• Develop and execute risk-based assurance activities across GS.
• Continuously seek opportunities to increase assurance coverage and stakeholder confidence while reducing burden on the 1LoD and 2LoD when it comes to testing.
• Consolidate assurance obtained from audits, reviews, monitoring activities, management oversight and other assurance sources.
• Identify control deficiencies, emerging risks and systemic issues.
• Perform root cause analysis and assess the effectiveness of remediation activities.
• Develop meaningful assurance metrics and reporting to support leadership decision-making.
• Drive the adoption and expansion of tools such as Continuous Control Monitoring and data-driven assurance methodologies.

Internal Audit and External Assurance Coordination

• Act as the primary R&C representative for GIA reviews impacting GS.
• Assess audit observations and determine broader implications for the GS control environment.
• Support the development of practical and sustainable remediation plans.
• Build and maintain effective working relationships with external auditors.
• Act as the primary coordination point for external audit activities impacting FAS, PTP, ESPS and CS.
• Review and coordinate responses to external auditor enquiries and requests.
• Challenge and discuss auditor observations where appropriate, ensuring findings are accurately understood and supported by evidence.
• Identify opportunities to increase auditor reliance on existing assurance activities and controls.
• Promote efficient audit delivery whilst minimising disruption to 1LoD.

Continuous Improvement and Control Excellence

• Identify opportunities to standardise, simplify and automate controls and assurance activities.
• Promote preventive and automated controls wherever possible.
• Challenge inefficient, duplicated or low-value control activities.
• Drive initiatives aimed at improving both control effectiveness and operational efficiency.
• Lead initiatives that strengthen the overall maturity of the GS c