Background information about the job or company (e.g., role context, company overview)

The Technical and Vocational Education and Training (TVET) Council is established as the national apex body responsible for the regulation, coordination, quality assurance, and strategic oversight of Technical and Vocational Education and Training system in Uganda, in line with the TVET Act, 2025.

The TVET Council invites suitably qualified, competent, and motivated candidates to apply for the following positions:

Senior Internal Auditor (Risk Management)

Kampala, Uganda

Reports to: Manager Internal Audit and Risk Management (MIAR)

Organizational Unit: Internal Audit and Risk Management

Location: TVET Head Office, Kampala

Basic Function

The Senior Internal Auditor (Risk Management) continuously strengthens enterprise risk management (ERM) across the TVET Council. The incumbent is responsible for coordinating risk identification, assessment, monitoring, and reporting processes, and for promoting a proactive risk-aware culture that advances the Council's mandate under the TVET Act 2025 and the TVET Policy Implementation Standards, 2019.

Responsibilities or duties

1. Enterprise Risk Management Coordination

• Initiate the development and implementation of the Council's Enterprise Risk Management Framework and Policy.
• Facilitate the periodic review of the Council's risk management framework including an assessment of the Council’s risk appetite.
• Coordinate risk identification, assessment, and profiling exercises across departments, divisions, units, and projects.
• Maintain and regularly update the Council's risk register, ensuring risks are properly categorized, rated, and assigned risk owners.
• Track changes in the risk profile over time and flag emerging or escalating risks to the Manager Internal Audit and Risk Management.
• Integrate and align departmental and project risk assessments with the Council's strategic and annual work plans.

2. Risk Mitigation and Control Monitoring

• Support the risk owners/champions across departments to design and document appropriate risk mitigation strategies and action plans.
• Monitor the implementation status and effectiveness of agreed risk mitigation measures and internal controls.
• Recommend enhancements to policies, procedures, and controls in response to identified or emerging risks.
• Conduct periodic risk-based reviews/spot checks of key processes to assess control effectiveness in collaboration with the team of Internal Audit section.

3. Risk Reporting

• Prepare periodic risk management reports, e.g., quarterly risk registers, heat maps, key risk indicator dashboards for review by the Manager IARM.
• Contribute risk analysis and advisory input for presentation to the Executive Director/Senior Management and the Audit, Risk Regulatory Committee.
• Track and report on the status of risk incidents, near-misses, and lessons learned.

4. Training and Awareness

• Coordinate risk management training, sensitization, and awareness sessions for staff and Council members.
• Build departmental capacity for self-identification and reporting of risks.
• Promote a proactive, risk-aware culture across the Council through communication and engagement activities.

5. Advisory Services

• Provide advisory input to management on risk considerations in new projects, policies, and major decisions.
• Conduct scenario analysis and stress-testing of key risks affecting the Council's mandate and service delivery.
• Liaise with process owners/champions to ensure risk appetite and tolerance levels set by the Council are understood and applied.
• Perform any other duties as may be assigned from time to time by the department leadership team.

Supervision Received: The Senior Internal Auditor (Risk Management) is directly supervised by Manager Internal Audit and Risk Management.

Supervision Exercised: None.

Qualifications or requirements (e.g., education, skills)

Education requirements.

• Bachelor's degree in Finance, Accounting, Business Administration, Technical & Vocational Education and Training or a related field.
• Post graduate qualification in Risk Management, Business Administration, or a related field.
• Professional qualification or certification in risk management (e.g., CRMA, ISO 31000 Risk Management, or equivalent) is required.
• Master's degree in accounting, finance, auditing, business administration, Information Systems, Technical & Vocational Education and Training or related field is an added advantage.
• Additional certification such as COSO ERM, CIA, or CISA is an added advantage.
• Membership with other professional bodies such as ICPAU, IIA, Corporate Governance, among other bodies.

Experience needed

Experience

• At least Six (6) years relevant audit/risk management experience, with 3 years at a middle management level in a reputable organization, donor funded organizations or public institution.
• Experience developing or implementing risk management frameworks in a public sector or regulatory agency is an added advantage.

Knowledge and Skills

• Sound knowledge of enterprise risk management principles and frameworks (e.g., ISO 31000, COSO ERM).
• Strong analytical skills, with the ability to translate risk data into practical insights and reports.
• Excellent report-writing, presentation, and communication skills.
• Strong stakeholder engagement and facilitation skills, with the ability to build a risk-aware culture across departments.
• High integrity, objectivity, and sound judgment.
• Familiarity with TVET sector issues is an added advantage.

Physical Demands: None

Travel requirements: Limited travel within/out of the country for official work

• Initiate the development and implementation of the Council's Enterprise Risk Management Framework and Policy.
• Facilitate the periodic review of the Council's risk management framework including an assessment of the Council’s risk appetite.
• Coordinate risk identification, assessment, and profiling exercises across departments, divisions, units, and projects.
• Maintain and regularly update the Council's risk register, ensuring risks are properly categorized, rated, and assigned risk owners.
• Track changes in the risk profile over time and flag emerging or escalating risks to the Manager Internal Audit and Risk Management.
• Integrate and align departmental and project risk assessments with the Council's strategic and annual work plans.
• Support the risk owners/champions across departments to design and document appropriate risk mitigation strategies and action plans.
• Monitor the implementation status and effectiveness of agreed risk mitigation measures and internal controls.
• Recommend enhancements to policies, procedures, and controls in response to identified or emerging risks.
• Conduct periodic risk-based reviews/spot checks of key processes to assess control effectiveness in collaboration with the team of Internal Audit section.
• Prepare periodic risk management reports, e.g., quarterly risk registers, heat maps, key risk indicator dashboards for review by the Manager IARM.
• Contribute risk analysis and advisory input for presentation to the Executive Director/Senior Management and the Audit, Risk Regulatory Committee.
• Track and report on the status of risk incidents, near-misses, and lessons learned.
• Coordinate risk management training, sensitization, and awareness sessions for staff and Council members.
• Build departmental capacity for self-identification and reporting of risks.
• Promote a proactive, risk-aware culture across the Council through communication and engagement activities.
• Provide advisory input to management on risk considerations in new projects, policies, and major decisions.
• Conduct scenario analysis and stress-testing of key risks affecting the Council's mandate and service delivery.
• Liaise with process owners/champions to ensure risk appetite and tolerance levels set by the Council are understood and applied.
• Perform any other duties as may be assigned from time to time by the department leadership team.

• Sound knowledge of enterprise risk management principles and frameworks (e.g., ISO 31000, COSO ERM).
• Strong analytical skills, with the ability to translate risk data into practical insights and reports.
• Excellent report-writing, presentation, and communication skills.
• Strong stakeholder engagement and facilitation skills, with the ability to build a risk-aware culture across departments.
• High integrity, objectivity, and sound judgment.
• Familiarity with TVET sector issues is an added advantage.

• Bachelor's degree in Finance, Accounting, Business Administration, Technical & Vocational Education and Training or a related field.
• Post graduate qualification in Risk Management, Business Administration, or a related field.
• Professional qualification or certification in risk management (e.g., CRMA, ISO 31000 Risk Management, or equivalent) is required.
• Master's degree in accounting, finance, auditing, business administration, Information Systems, Technical & Vocational Education and Training or related field is an added advantage.
• Additional certification such as COSO ERM, CIA, or CISA is an added advantage.
• Membership with other professional bodies such as ICPAU, IIA, Corporate Governance, among other bodies.