Mike Szeto

● Information Risk Committee: Improved decision-making and risk preparedness by analyzing regulatory updates, incidents, program metrics, and industry trends, and driving proactive discussions on critical risks. ● Business Resiliency: Strengthened resiliency and recovery capabilities by evaluating the adequacy of business impact analysis, business continuity plans, and disaster recovery plans, related testing results ensuring compliance with company standards and regulatory requirements. ● Third-Party Information Risk Management: Reduced third-party risk and strengthened governance by validating risk artefacts, assessing control effectiveness, and evaluating adequacy and actionability of exit plans for critical vendors. ● Information Risk Reporting: Supported information risk oversight by analyzing internal and external information on a quarterly basis to identify risk exposures and assess their severity, preparing reports for management review, and driving business commitment to strengthen risk posture. ● Team Efficiency: Streamlined oversight processes by leveraging Power BI to identify inefficiencies, highlight delays, and propose corrective actions, improving project efficiency

● Information Risk Reporting: Enabled risk monitoring by developing key risk indicators aligned with business strategies, focusing on emerging risks and reporting risks to management on quarterly basis. ● Information Risk Awareness and Education: Strengthened the organization’s security culture by designing and implementing a company-wide information security awareness campaign and supoprting the phishing program by analyzing trends and incidents, providing actionable insights to reduce related risks. ● Regulatory Compliance Review: Ensured regulatory compliance by preparing responses to regulatory authorities (e.g., OSFI, MAS). Reduced first-line regulatory risks by identifying process gaps and reviewing first line of defense responses to regulatory authorities, including corrective action plans.

● System Control Assurance Services: Delivered assurance on IT controls by leading IT general control testing and evaluating system configurations, identifying deficiencies and providing recommendations for improvement ● Data Analytics for Fraud Investigation: Identified fraudulent transactions using Oracle DB. Increased efficiency in audit workflows by reducing transaction review time through advanced data analytics techniques. ● Governance, Risk, and Compliance (GRC) Process Improvement: Enhanced GRC processes for one of the largest banks in China and Hong Kong by performing gap analysis, recommending remediation actions, and implementing a GRC tool, improving compliance and operational efficiency.