Risk, Compliance & Governance Lead

Job Title
Risk & Compliance Lead
Reports to:
Chief Operating Officer
Location:
Edinburgh or Glasgow, with travel required
Designated roles:
HMRC Compliance Officer and Data Protection Lead

The Risk, Compliance & Governance Lead will operate and develop Rettie's governance, enterprise risk and compliance framework, providing specialist advice, constructive challenge, assurance and clear reporting to support proportionate decision-making and accountability.

The role reports to the COO, who provides executive sponsorship for governance and enterprise risk and acts as Nominated Officer/MLRO. The Risk, Compliance & Governance Lead will line manage the Risk & Compliance Analyst and will remain accountable for the quality and effectiveness of the function's work.

The postholder will also fulfil the designated role of HMRC Compliance Officer for Rettie's estate agency business and act as Data Protection Lead.

Measures of success

• A practical, live enterprise risk framework supports Executive and Board decision-making.
• Material risks, compliance issues and remedial actions are visible, owned and escalated early.
• AML, data protection and other compliance arrangements are effective, evidenced and proportionate.
• The Risk & Compliance Analyst delivers timely, accurate monitoring, evidence and action tracking.
• Business leaders understand and accept ownership of risks and controls in their areas.

• Operate and continually improve the enterprise risk framework (currently in development) under COO sponsorship.
• Maintain the corporate risk register, risk matrix, risk appetite and tolerance documentation, key risk indicators and escalation arrangements.
• Facilitate risk reviews, ensuring principal and emerging risks have accountable business owners and proportionate controls.
• Prepare clear risk and assurance reporting for the COO, Executive Management Team and Board.

• Maintain a proportionate compliance framework covering AML and sanctions, data protection, consumer protection, anti-bribery and corruption, complaints governance, professional obligations and relevant regulatory requirements.
• Keep policies, controls and procedures current, lead regulatory horizon scanning and coordinate agreed changes.
• Provide practical advice and constructive challenge to senior leaders, managers and colleagues.
• Coordinate targeted external expertise and independent assurance where specialist depth is required.

• Oversee Rettie’s compliance with the Money Laundering Regulations and applicable HMRC requirements across relevant branches and activities.
• Review the effectiveness of AML policies, controls and procedures, including the business-wide risk assessment, and oversee improvements.
• Maintain a risk-based AML monitoring and audit programme, supported by reliable management information and evidence.
• Oversee relevant employees, agents and third-party providers involved in identifying AML risk or operating controls.
• Report material weaknesses, breaches and overdue actions to the COO/MLRO, CEO and appropriate governance forum, and support HMRC inspections and independent audits.
• Maintain clear separation between the Compliance Officer’s oversight role and the MLRO’s responsibility for internal disclosures, SAR decisions and DAML or DATF requests.

• Maintain Rettie’s data protection framework, policies, privacy notices, records of processing, retention arrangements and accountability evidence.
• Advise on data protection risks arising from business change, technology, suppliers and AI, and coordinate DPIAs.
• Oversee data subject rights requests, personal data breaches and privacy incidents, including escalation,…