VP, Business Control Assurance

Bank of Montreal•New York, NY

About The Position

The VP, Business Control Assurance is part of Governance and Controls within the Capital Markets Office of the Chief Operating Officer (OCOO). Reporting to the MD, Control Assurance, the role supports a consistent, risk-based first-line assurance program across BMO Capital Markets businesses, functions, legal entities and non-financial risk categories. The VP leads assigned assurance portfolios and the day-to-day planning, execution and quality review of control testing, with primary responsibility for Design Effectiveness and Operating Effectiveness assessments. Operating within the strategy, methodology, risk appetite and annual plan established by the MD, the role develops test approaches, supervises testers and assigned resources, challenges evidence and conclusions, and escalates material findings, capacity constraints and methodology questions. The VP works closely with Business Control teams, control owners, Operations, Technology, first-line Enterprise Control Functions, Regulatory Business Control, second-line risk and Internal Audit while preserving the independence and objectivity of first-line testing.

Requirements

Undergraduate degree in Business Administration, Risk Management, Economics, Finance, Accounting or a related discipline; graduate degree or relevant professional designation is an asset.
7+ years of experience in financial services, Capital Markets, business controls, non-financial risk, internal audit, compliance testing, technology risk or related assurance disciplines.
Demonstrated experience leading the control testing lifecycle, including risk-based planning, test design, Design Effectiveness and Operating Effectiveness assessment, sampling, documentation, quality review, reporting and remediation follow-up.
Strong understanding of internal control frameworks and the respective accountabilities of first-line business and control teams, first-line Enterprise Control Functions, second-line oversight and Internal Audit.
Knowledge of Capital Markets products, front-to-back processes and associated operational, regulatory, technology, data, third-party and resilience risks is strongly preferred.
Experience presenting testing outcomes, thematic insights and recommendations to senior management and supporting regulatory or audit engagements.
Experience with governance, risk and compliance platforms and data-driven reporting; GRCE, Excel and Power BI experience is an asset.
Professional designations such as CPA, CIA, CISA, CRMA or equivalent are an asset; prior audit experience is valued but not mandatory.
Strong control assurance judgment, including the ability to assess whether control design, evidence and operating performance support a defensible conclusion.
Ability to develop risk-based plans, manage concurrent testing portfolios and deliver to clear quality and timing standards.
Clear, concise written and verbal communication, including the ability to explain complex findings and business implications to senior stakeholders.
Effective stakeholder management and constructive challenge across front-office businesses, Operations, Technology, specialist first-line teams, second-line risk and Internal Audit.
Strong analytical capability, attention to detail and ability to identify patterns across controls, processes, issues and testing outcomes.
Demonstrated ability to lead, coach and quality-review employees and contractors in a high-expectation environment.
Independent, objective and willing to challenge constructively.
Practical problem solver who distinguishes material risk from process noise.
Self-directed, accountable and disciplined in execution.
Calm under pressure and able to manage competing priorities and sensitive findings.
Collaborative and credible, with sound judgment and high professional standards.

Nice To Haves

Graduate degree or relevant professional designation is an asset.
Knowledge of Capital Markets products, front-to-back processes and associated operational, regulatory, technology, data, third-party and resilience risks is strongly preferred.
GRCE, Excel and Power BI experience is an asset.
Professional designations such as CPA, CIA, CISA, CRMA or equivalent are an asset; prior audit experience is valued but not mandatory.

Responsibilities

Translate the MD-approved Capital Markets assurance strategy and annual plan into executable testing portfolios, using risk, control inventory, prior testing, issues, events, audit results, business change and regulatory priorities to focus coverage on material exposures.
Define scope, sequencing, frequency and testing approach across businesses, processes, legal entities and risk categories; identify overlaps and gaps across first-, second- and third-line assurance activity.
Develop proportionate test strategies, scripts, sampling approaches and evidence requirements that address the control objective and underlying risk.
Engage Business Control teams and subject matter experts during planning and test design without compromising independent execution or conclusions.
Document and operationalize clear roles across Business Control teams, Governance and Controls, control owners, first-line Enterprise Control Functions and other assurance providers for assigned portfolios; identify overlaps, gaps or conflicting expectations and escalate matters requiring enterprise or senior management resolution to the MD.
Deploy assigned employees and contractors based on risk, product knowledge, technical capability and capacity; manage day-to-day delivery and escalate structural capacity or capability gaps to the MD.
Perform or oversee Design Effectiveness and Operating Effectiveness testing; document scope, populations, samples, evidence, exceptions, ratings and rationale in accordance with enterprise and Capital Markets requirements.
Review work for completeness, consistency and supportability; challenge weak evidence, unsupported conclusions and methodology deviations before submission.
Communicate deficiencies promptly, support root-cause and issue assessment, agree practical actions with accountable owners, and track remediation and re-testing to closure without assuming business ownership.
Ensure testing plans, results, approvals, evidence and required records are complete, accurate, timely and audit-ready in GRCE.
Coordinate with second-line risk stakeholders, respond to challenge, resolve factual or methodological questions and escalate unresolved matters through the appropriate governance path.
Report plan delivery, test outcomes, overdue activity, recurring deficiencies, risk concentrations and remediation status to the MD, Control Assurance and relevant governance forums.
Analyze results across businesses and risk categories to identify systemic control weaknesses, inconsistent practices and opportunities for preventative controls, automation or control simplification.
Maintain procedures, templates and quality standards; integrate lessons learned; support training and capability development; and improve data, workflow and reporting efficiency.
Present complex findings clearly and credibly to business leaders, control owners, risk partners, auditors and regulators where required.