Global Head of AI and Data Risk Audit

Job Description

The role provides independent, risk-based assurance over RBC's AI and data governance frameworks, ensuring that AI adoption is responsible, compliant, and aligned with the bank's risk appetite—thereby protecting RBC's reputation, clients, and stakeholders while enabling innovation.

• •Independent Assurance : Assess the design and operating effectiveness of AI governance, model risk management, and AI lifecycle controls across global operations
• •Strategic Coverage Planning : Develop and maintain the Global AI Audit Coverage Strategy, ensuring comprehensive audit coverage of AI platforms, use cases, and supporting infrastructure
• •Regulatory Compliance : Validate adherence to evolving AI regulations and coordinate responses to regulatory exams and inquiries
• •Risk Monitoring : Conduct continuous risk monitoring of the AI landscape, identifying emerging risks and reporting to senior leadership
• •Thought Leadership : Position RBC Internal Audit as an industry leader in AI assurance, contributing to standards development and peer collaboration

Strategy and Planning

Develop and Maintain the Global AI Audit Coverage Strategy

• •Annually refresh the AI Audit Coverage Strategy, ensuring alignment with RBC's AI transformation roadmap, regulatory expectations, and emerging risks
• •Define audit methodologies for traditional AI/ML, Generative AI, and Agentic AI technologies
• •Conduct risk assessments over AI-related Auditable Entities (AEs), mapping AI models, platforms, and business processes to audit coverage
• •Coordinate with other IA teams (Model Risk, Data, Technology, Operations, Cybersecurity, Compliance) to ensure integrated audit approach

Lead Annual Audit Planning for AI and Data Risk

• •Partner with Regional Chief Audit Executives (CAEs) to prioritize AI audits based on risk, cycle requirements, and strategic initiatives
• •Balance audit coverage across:
• •2LOD AI Risk Management (AI Risk Governance, Enterprise Model Risk Management)
• •1LOD Centralized AI Governance (AI Group, Data & Analytics, Enterprise Architecture)
• •1LOD Platform Audits (Capital Markets, Wealth Management, Banking, Insurance)

Allocate budget and resources for AI and data audits, including co-sourcing arrangements

Define Audit Methodologies for Emerging AI Technologies

• •Establish audit approaches for Generative AI platforms, AI workbenches, and Agentic AI systems
• •Develop testing methodologies for:
• •AI governance frameworks and committee operating models
• •Model validation processes (bias testing, fairness metrics, model cards, datasheets)
• •AI lifecycle controls (development, deployment, monitoring, change management)
• •Data governance for AI (lineage, retention, classification, consent, privacy impact assessments)
• •Third-party AI vendor risk management
• •AI security and resilience (zero-trust architecture, RBAC, output sanitization, drift detection)
• •Regulatory compliance (EU AI Act, Canadian Federal Anti-Fraud Strategy, OSFI guidance)

Partner with 2LOD and 1LOD on Evolving AI Frameworks

• •Engage proactively with the AI Risk Governance team and Enterprise Model Risk Management to provide input on framework development
• •Serve as a trusted advisor to the AI Group on control design and best practices
• •Participate in industry forums (e.g., OSFI's Financial Industry Forum on AI) to contribute to AI governance standards

Global Audit Execution

Direct Audit Engagements Across Platforms

Oversee execution of AI and data audits across Capital Markets, Wealth Management, Personal & Commercial Banking, Insurance & GAM, and Enterprise Functions.

Oversee Audits of AI Governance, Model Risk Management, and AI Lifecycle Controls

• •AI Governance Audits : Assess the design and effectiveness of governance structures, policies, committee operations (AI Working Forum, Executive AI Council, platform AI committees), and escalation processes
• •Model Risk Management Audits : Evaluate model validation frameworks, ongoing monitoring, model documentation, and validation independence
• •AI Lifecycle Audits : Review controls for AI development, deployment, monitoring, incident response, and decommissioning

Coordinate Integrated Audits with Technology, Operations, Data, Model Risk, and Cybersecurity Teams

• •Lead integrated audits that combine AI-specific testing with broader IT, data, and operational risk assessments
• •Partner with:
• •Cyber & IT Risk Audit : AI security controls, cryptography, access management
• •Model Risk Audit : Model validation, EMRM oversight
• •Technology Infrastructure Audit : Cloud platforms, disaster recovery, IT asset management supporting AI
• •Global Compliance Audit : BSA/AML controls, fair lending, regulatory compliance

Regulatory and Compliance Oversight

Monitor Evolving AI Regulations

• •Track and interpret regulatory developments across key jurisdictions (Examples below):
• •European Union : EU AI Act (risk-based classification, prohibited practices, transparency requirements)
• •Canada : Federal Anti-Fraud Strategy, OSFI guidance on model risk and AI governance
• •United States : OCC guidance, FCAC consumer protection, state-level AI regulations
• •UK : UK AI Bill, FCA expectations
• •APAC : MAS AI governance frameworks, Australian Scams Prevention Framework

Assess implications for RBC's AI programs and audit coverage strategy

Lead Regulatory Issue Validation and Coordinate Regulatory Exam Responses

• •Validate management's remediation of regulatory issues related to AI (e.g., GRM AI Governance issues, Capital Markets AI Governance Framework issues)
• •Coordinate responses to regulatory exams on AI governance, model risk management, and data governance
• •Liaise with regulatory affairs teams and external auditors to ensure consistent messaging

Ensure Audit Coverage Addresses Regulatory Expectations Across Jurisdictions

Liaise with Regulators (OSFI, OCC, FCAC, FCA, MAS, etc.)

• •Serve as the primary IA contact for regulatory inquiries on AI and data governance
• •Present audit findings and observations to regulators during examinations
• •Participate in regulatory forums and roundtables on AI risk management

Governance and Reporting

Provide Executive Reporting to the Audit Committee and Risk Committee of the Board

• •Deliver quarterly presentations on:
• •AI risk profile and emerging trends
• •Status of AI audit plan execution
• •Key audit findings and management action plans
• •Regulatory issues and validation status
• •Continuous risk monitoring insights

Prepare written reports summarizing AI governance maturity, control environment effectiveness, and areas requiring Board attention

Present AI Risk Profile Assessments and Audit Findings to Senior Leadership

Participate as IA Observer in Key Governance Forums

Maintain Continuous Risk Monitoring of the AI Landscape

• •Conduct quarterly Continuous Risk Monitoring (CRM) assessments for AI-related Auditable Entities
• •Assign risk ratings (Satisfactory, Requires Improvement, Unsatisfactory) and escalate concerns to senior leadership

What do you need to succeed?

• •A minimum of 12-15 years of experience in financial sector audit with practice focus and expertise in IT
• •Undergraduate degree
• •Excellent communication skills
• •Accountability, leadership, initiative, teamwork, change agent and impact and influence
• •Risk management and audit expertise
• •In-depth knowledge of US regulatory landscape and strong working background/experience with key US regulators
• •Strong analytical, communication, strategic and creative mindset with strong execution ability
• •High level of general management skills, including leading, negotiating, communication and team building
• •Effective interaction/dealing with executives and senior management and ability to maintain a strong relationship with IA staff, partners and external stakeholders
• •Strong analytical, communication, computer, and interpersonal skills

What's in it for you?

We thrive on the challenge to be our best, progressive thinking to keep gro