Enterprise Risk & Compliance Manager

Touro University; New York (NY); On-site; USD 120,000 - 150,000; Full time

Job summary

Touro University in New York seeks an Enterprise Risk Manager to lead the institution's risk management and compliance program, embedding risk awareness in strategic planning and decision-making. You will partner with executive leadership, Internal Audit, Compliance, and Legal to ensure effective governance and resilience across academic and administrative operations.

Responsibilities include maintaining the risk framework, overseeing KRIs, and coordinating governance, accreditation, and vendor

Qualifications

• Bachelor's degree in risk management, accounting, finance, business administration, or related field.
• 7–10 years of experience in compliance auditing or internal auditing.
• Minimum 3 years in a supervisory or management role.

Responsibilities

• Design and enhance the institution's ERM framework aligned with COSO ERM.
• Maintain risk register, taxonomy, and risk appetite statements.
• Lead annual enterprise-wide risk assessments and targeted reviews.
• Integrate ERM insights into strategic planning and financial sustainability.
• Prepare risk assessments, heat maps, KRIs, and reports for leadership and Board.
• Oversee third-party and vendor risk assessments with Procurement, IT, and Legal.
• Support AI risk governance using NIST AI RMF.
• Promote risk-aware culture through training and governance.
• Coordinate alignment with accreditation and regulatory requirements.
• Supervise Enterprise Risk Analyst and Compliance Auditor.

Skills

Executive communication

Influence without authority

Facilitation

Writing & presentations

Risk assessment

Risk appetite

Higher ed knowledge

Data visualization

Education

Bachelor's degree in related field

Tools

Excel

Power BI

Tableau

GRC platforms (Archer, ServiceNow GRC, LogicGate)

Job description

Overview

The Enterprise Risk Manager leads and advances the institution's enterprise risk management (ERM) and compliance program to identify, assess, monitor, and report risks that may impact the university's strategic objectives, academic mission, financial sustainability, compliance obligations, operational effectiveness, and reputation. This role partners closely with executive leadership, academic and administrative units, Internal Audit, Compliance, and Legal to embed risk awareness into strategic planning and institutional decision-making. The Enterprise Risk Manager operates with appropriate independence and provides objective risk insights to senior leadership and the Audit Committee.

Responsibilities

Responsibilities include but not limited to:

Enterprise Risk Management Program

• Design, implement, and continuously enhance the institution's Enterprise Risk Management framework, aligned with COSO ERM and higher education best practices.
• Maintain the enterprise risk register, risk taxonomy, and risk appetite/tolerance statements.
• Lead the annual enterprise-wide risk assessment and periodic targeted risk reviews.
• Integrate ERM insights into institutional strategic planning, enrollment management, and long-term financial sustainability discussions.
• Prepare and maintain enterprise risk assessments, risk registers and heat maps, KRI dashboards, concise, decision-useful risk reports for executive leadership, the Audit Committee, and the Board of Trustees, mitigation action plans, and scenario and resilience analyses.

Risk Identification, Assessment & Monitoring

• Facilitate risk assessment workshops and interviews with academic leadership, administrative departments, and shared governance bodies.
• Identify and assess strategic, academic, operational, financial, compliance, technology, research, enrollment, reputational, and student-related risks.
• Evaluate inherent risk, residual risk, and control effectiveness, including emerging and evolving risks and track risk mitigation action plans.
• Oversee third-party and vendor risk assessments in partnership with Procurement, IT, and Legal, including data privacy and security reviews of vendors that handle student, employee, or institutional data.
• Support governance and risk assessment of artificial intelligence (AI) tools used in academic and administrative operations, aligned with recognized frameworks such as the NIST AI Risk Management Framework.
• Develop, monitor, and refine Key Risk Indicators (KRIs) relevant to higher education (ie: enrollment trends, financial performance, cybersecurity events, regulatory findings, accreditation risks).

Compliance Oversight

• Oversee the compliance monitoring and testing program, including developing and executing an annual risk-based compliance plan.
• Direct compliance risk assessments and testing of adherence to federal, state, and accreditation requirements and institutional policies.
• Partner with the Chief Compliance Officer, Legal, and policy owners to monitor regulatory changes and assess their impact on institutional risk.
• Report compliance findings, trends, and remediation status to senior leadership and the Audit Committee, and track corrective actions through closure.

Team Leadership

• Supervise the Enterprise Risk Analyst and Compliance Auditor, including setting priorities, assigning work, and reviewing work products for quality and accuracy.
• Provide coaching, training, and performance feedback, and support staff professional development and cross-training.

Institutional Resilience & Stakeholder Engagement

• Support institutional resilience through risk-informed crisis management, business continuity planning, and scenario analysis.
• Participate in lessons-learned reviews following significant incidents or disruptions and incorporate outcomes into the ERM program.
• Serve as a trusted advisor to academic and administrative leadership on enterprise risk matters.
• Promote a risk-aware culture through training, communication, and integration of ERM into everyday decision-making.
• Enhance risk literacy across the institution while respecting shared governance principles.

Governance & Accreditation

• Align ERM activities with accreditation requirements (ie: Middle States and other regional accreditors) and applicable regulatory expectations (ie: Title IV, FERPA, Clery Act, research compliance).
• Coordinate with Internal Audit, Compliance, and Legal to align assurance activities with institutional risk priorities and avoid duplication of effort.

Education/Experience

Qualifications

• Bachelor's degree in Risk Management, Accounting, Finance, Business Administration, or a related field.
• 7-10 years of experience in compliance auditing or internal auditing.
• Minimum 3 years in a supervisory or management role.

Knowledge/Skills/Abilities

• Strong executive and Board-level communication skills.
• Ability to influence without direct authority.
• Strong facilitation, collaboration, and consensus-building skills.
• Clear, concise writing and presentation skills.Technical Skills
• Enterprise-wide risk assessment facilitation, risk register and taxonomy development.
• Risk appetite and tolerance articulation, KRI development and monitoring, and control effectiveness evaluation.
• Knowledge of higher education accreditation, governance structures, and regulatory risks (Title IV, FERPA, Clery Act).
• Understanding of enrollment, financial aid, cybersecurity, technology, research, and reputational risks.
• Data analysis and visualization (Excel, Power BI, Tableau); familiarity with GRC platforms (e.g., Archer, ServiceNow GRC, LogicGate).

Certifications/Licensures

• Professional certifications such as CIA, CPA, CISA, CFE, CCEP (Certified Compliance & Ethics Professional), CRMA (Certification in Risk Management Assurance), or RIMS-CRMP preferred.

Travel

• Occasional domestic and international travel to Touro University campuses as needed.

Working Conditions

• Extensive use of computers
• Extensive time sitting and standing
• Able to lift up to 5 lbs.

Maximum Salary

USD $150,000.00/Yr.

Minimum Salary

USD $120,000.00/Yr.