Paul Ndung'U. Email and Phone Number

Risk Management, Compliance, and Security Specialist | Governance and Security Risk Management in East and South African Markets | Information Security, Business Continuity, Contract Management, and Risk Reporting Expert:• Information security– technical counter service measures (TSCM) and clear desk.• Business continuity and crisis management – training of functional continuity managers,writing of BIAs and BCPs and testing of plans.• Contract management –supplier reviews, due diligence on onboarding in line with Anti-Financial crime requirements.• Risk and audit committee reporting for the listed entities – Kenya, Uganda, Zambia• Records management compliance• Threat and Risk assessment actions tracking • Updating of Risk registers – country and functional • Talent management of other Risk and Security managers Overall, sharing lessons learned with the business and drive process improvements through policy changes or enhanced ways of working.

My role is an oversight role on investigations conducted by cluster investigation security managers in West, East and South African markets, that all investigation processes adhere to principles that guarantee objective investigations and safeguard the rights, dignity, and reputation of the subjects, witnesses, and complainants involved.This includes maintaining confidentiality during investigations related to standards of business conduct, fraud, corruption, conflict of interest, sexual harassment, and workplace harassment:• Confidentiality – in conducing investigations into allegation including standards of business conduct (SoBC), Fraud, corruption, conflict of interest, sexual harassment, workplace harassment; ensuring the process of investigation is• Independent,Impartial and Objective• Impartiality/Professionalism – in conducting interviews,report writing and disciplinary evidence requirements • Compliant to BAT group requirements on investigations, compliance and reporting standardsAdditionally: Governance and Security Risk Management in East and South African Markets | Information Security, Business Continuity, Contract Management, and Risk Reporting Expert:Overall, sharing lessons learned with the business and drive process improvements through policy changes or enhanced ways of working.

• Security Risk Management (SRM) • Business Continuity Management and BIA • Information Security (Clear Desk/TSCM) • Security Awareness & Education Training • Travel Security (Travel Risk management)• Investigations and Fraud awareness • Loss reporting – audit committee and regional reports

Key Achievements:i)Developed framework security policies and procedures, outlining the minimum baseline standards and procedures required across the security function for international clients, following a risk-based vulnerability assessment of their processes.ii)Overseeing on-going implementation of projects, security policies, standard operating procedures for clients in the UK, Eastern and South Africa.iii)Developing evacuation plans for an ultra-luxury resort with operations in Dubai and Rwanda.iv)In accordance with Group Global standards for an international client; developed, executed and updated information security strategy, standards and processes, including tools, documents and training modules.v) Trained and advised project personnel on how to react to an incident or emergency including active shooter in Kenya, South Sudan, Somalia, Uganda, Ethiopia and South Africa.vi)Developed risk management strategies along with policies and procedures for a regional FMCG.vii)Conducted on behalf of a national the tender process for the engagement of a 3rd party manned guarding security provider including the creation of the Terms of Reference (ToR) specific to the client’s requirements.viii)Conducted investigations and fraud risk assessments as well as special audits for a regional FMCG organization in Kenya and an automotive client in Uganda on suspected fraud and recommended mitigating controls.ix)Conducted investigations, audits, special event coordination and other safety, security or business continuity efforts for clients in Kenya, South Africa and Ethiopiax)Developed Risk Management frameworks for an international audit firm, to embed best practice risk management, internal control processes, establishment of formal communication and an effective escalation matrix regarding risk response.

Key achievements;-i) Annual Plans; Successful drafting of annual country risk and quality plans against eleven risk management standards to approval as well as implementation of all internal audit recommendations ensuring timely action and mitigation of risk.ii) Cost Savings: implemented a cost-effective communication strategy that has brought awareness to compliance activities and embedment of the process measured by the annual compliance certification completion ratings rising from 79% to 98.4%iii)Process Improvement. • Part of the team that championed the firm wide information security management system (ISMS) ISO 27001 audit which included extraction and analysis of data and closure of all gaps arising from audits by the British International Institute (BSI).•Increased partners and staff awareness on the utilization of critical business tools that supported continued smooth operations in providing client services in the event of an incident or disruption.

i)Projects: championed the project on automation of the POD process to a successful completion and implementation this ensured the processing of all Invoices and easy retrieval for auditing purposes.ii)Cost Savings: Aligned the ISANDA Direct Selling account from a variance of KSh70 million to Ksh3 million thus ensuring savings for the company.iii)Process Improvement: Initiated control framework around ISANDA distributor which did not only bring cost cutting as well as ensuring seamless operations and subsequent recommendations on ways of working for other distributors.iv)Controls Assurance & Risk Management: •Championed the annual Controls Assurance and Risk Management (CARM) process in BWISE - System for all the EABL entities from a successful design assessment stage, testing to review and sign off by the Chief Executive Officer.•Increased staff awareness on risk management as an enabler to effective and efficient operations.