BPAS is a national provider of retirement plan administration, employee benefit solutions, and fiduciary and trust services. For more than 50 years, we’ve redefined what it means to be a benefits partner. We combine deep expertise, transparent service, and a people-first approach to make benefit plans easier, smarter, and more effective for everyone involved.
As a financially stable subsidiary of Community Financial Systems, Inc. (NYSE: CBU), we support 10,375 plans, $132 billion in trust assets, $1.3 trillion in fund administration, and more than 980,000 participants in partnership with advisors, trustees, and financial professionals across the nation. One partner. Smarter benefits. Better results.
Responsibilities:
The Chief Control Officer would be accountable for building and leading the first-line risk and control function within BPAS. This includes the first line ownership of the business risk and control self-assessment process, control inventory, issue management lifecycle, governance reporting, escalation routines, vendor risk oversight, data and privacy control alignment, and business-level implementation of enterprise risk policies across all of BPAS business segments, including NRS/GTC, Hand Benefit & Trust .
The role would also act as a trusted advisor to business leadership on the risk implications of new products, services, technology implementations, strategic initiatives, platform changes, vendor arrangements, and transformation efforts.
Essential Duties:
First-Line Risk and Control Ownership
- Own and maintain the benefits administration risk and control self-assessment process, ensuring risks are appropriately identified, rated, and mapped to controls.
- Maintain an accurate risk and control inventory aligned with the enterprise risk framework.
- Ensure key controls are designed appropriately and operating effectively across operational, compliance, technology, third-party/vendor, and conduct risk areas.
- Drive timely identification, escalation, and remediation of control gaps, issues, events, and near misses.
Enterprise Risk Framework Execution
- Serve as the business owner for executing the enterprise risk management framework within BPAS.
- Implement enterprise expectations related to operational risk, compliance risk, third-party risk, technology/cyber risk, and business continuity.
- Partner with second-line Risk and Compliance teams to interpret new or updated enterprise policies and regulatory requirements and apply them in a practical, business-specific manner.
Governance, Reporting, and Escalation
- Prepare and present risk and control reporting to business leadership, enterprise risk committees, and applicable governance forums.
- Own the issue management lifecycle for the business, including identification, root cause analysis, corrective action planning, validation, and closure.
- Escalate material risks, control breaks, and emerging risks to senior business leadership and enterprise risk partners in a timely manner.
- Support regulatory exam readiness and respond to regulatory or audit inquiries pertaining to the business.
Risk Culture and Business Partnership
- Foster a strong risk culture within BPAS by embedding risk ownership and accountability into day-to-day business operations.
- Advise business leadership on risk considerations related to products, services, technology, and strategic initiatives.
- Work closely with Internal Audit, Compliance, Legal, and Enterprise Risk on exams, audits, independent testing, and related business responses.
Third-Party and Vendor Risk Oversight
- Oversee third-party and vendor risk management for the business, given the vendor-intensive nature of benefits administration.
- Ensure appropriate due diligence, ongoing monitoring, and contractual risk controls for critical vendors, including recordkeeping platforms, third-party administrators, and data exchange providers.
Data, Privacy, and Technology Risk
- Help ensure controls around sensitive data, including PII, PHI, and financial account data, meet enterprise and regulatory standards.
- Partner with Technology Risk and Cybersecurity on control requirements for platforms supporting Benefits Administration.
Team Leadership
- Build and lead a business-embedded control and risk team, potentially including resources focused on control testing, issue management, and reporting analysis.
- Develop talent and establish clear roles and responsibilities across the three lines of defense model.
Qualifications:
Education, Training, Experience, and Skill Requirements:
- 12 to 15 or more years of progressive experience in risk management, controls, audit, or compliance within financial services or a regulated industry.
- Bachelor’s degree required; MBA or advanced degree preferred.
- Relevant certifications such as CRCM, CERP, CIA, CRMA, CAMS, CFA Charter holder or similar risk/compliance credentials are a plus.
Min: USD $132,500.00/Yr. Max: USD $245,997.00/Yr. Other Job Information:
Compensation: Commensurate with experience plus potential for annual merit increase. In addition to your competitive salary, you will be rewarded benefits including: 11 paid holidays, paid vacation, Medical, Vision & Dental insurance, 401K with generous match, Pension, Tuition Reimbursement, Banking discounts and the list goes on!
Physical Requirements:
The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. While performing the duties of this job, the employee may be required to stand, walk or sit. Use hands and fingers, handle or feel, reach with hands or arms, and speak and hear. The employee may occasionally be required to lift and or move up to 25 pounds. Specific vision abilities required by this job include close vision, and the ability to focus.
The Company is an Affirmative Action, Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex (including pregnancy, sexual orientation and gender identity), national origin, citizenship status, age, disability, genetic information, veteran status, or any other characteristic protected by applicable federal, state or local law.
The Company will make reasonable accommodations for qualified individuals with a disability. If you have a physical or mental impairment and would like to request an accommodation with respect to the application process, please contact the Human Resources Department.
