Governance, Risk & Compliance Officer

Role Purpose:

Ethos Care is a private nursing home group providing residential care for older people across Ireland. The group operates 18 HIQA-registered designated centres nationwide and is expanding, with plans to grow to 21 centres by the end of 2027. The Governance, Risk & Compliance Officer will provide group-wide leadership on risk management, regulatory and legal compliance, data protection, health and safety and protected disclosures. The postholder will give the Board and the senior leadership team assurance that the group's risks are identified, managed and reported effectively and that the group meets all its legal and regulatory obligations across every centre and function.

Key Responsibilities

1. Risk Management

· Establish and maintain the group risk management framework and Corporate Risk Register, introduce centre-level and functional risk registers, facilitate monthly risk reviews with the senior leadership team and report quarterly to the Board.

2. Regulatory Compliance

· Provide assurance to the Board and the senior leadership team that the group meets all its regulatory and legal obligations, including under the Health Act 2007, the Care and Welfare Regulations 2013 and the HIQA National Standards.

· Support the Clinical & Governance Lead and Quality Managers on HIQA compliance, monitoring inspection outcomes, compliance plans and statutory notifications and escalating risks or gaps.

· Support centre registrations, including new centres.

3. Policy Governance

· Own the group's policy management framework, including the central policy register, review schedule, version control and approval process.

· Ensure policies reflect current legislation and regulatory requirements, including the Schedule 5 policies, working with policy owners such as the Clinical & Governance Lead.

· Ensure policies are communicated and understood across every centre and function.

4. Data Protection (DPO)

· Act as the group's Data Protection Officer under GDPR and the Data Protection Act 2018, including breach management and DPC notification within 72 hours, subject access requests, DPIAs, records of processing and liaison with the Data Protection Commission.

5. Health and Safety

· Develop, maintain and continually improve the group's health and safety management systems under the Safety, Health and Welfare at Work Act 2005, keep the Safety Statement and risk assessments up to date, oversee fire and statutory compliance with the Facilities Manager and report incidents to the HSA as required.

6. Protected Disclosures

· Act as designated person under the Protected Disclosures Acts 2014–2022, maintaining confidential reporting channels, meeting statutory timeframes, protecting reporting persons and preparing the annual report.

7. Audit and Assurance

· Develop and deliver a risk-based annual audit programme covering governance, data protection, health and safety and other compliance areas across every centre and function, working with the Quality Managers.

· Report audit findings and recommendations to the senior leadership team and Board.

· Track internal audit, external audit and inspection actions through to completion.

8. Complaints Oversight

· Act as independent review officer under Regulation 34 and report complaint trends and learning to the senior leadership team and Board.

9. Insurance and Claims

· Monitor insurance claims and incident trends across the group, working with the CFO and brokers, and report patterns, emerging risks and learning to the senior leadership team and Board.

10. Business Continuity

· Own the business continuity framework, ensuring every centre and group function has a tested plan and annual exercises take place.

11. Horizon Scanning

· Monitor new legislation and HIQA guidance (e.g. the Assisted Decision-Making (Capacity) Act 2015) and brief the senior leadership team and Board.

12. Contracts Register

· Maintain a central register of key contracts, ensuring appropriate data protection, continuity and performance terms.

13. Board Secretariat

· Support the Board and its committees with papers, minutes, action logs, governance calendar and register of interests.

14. Child Safeguarding

· Act as the group's Designated Liaison Person under the Children First Act 2015 and Children First National Guidance (2017).

· Maintain the child safeguarding policy (and Child Safeguarding Statement where required).

· Ensure mandated persons, such as registered nurses, understand their duty to report to Tusla.

· Oversee safeguards for children visiting centres and for under-18s on work experience or in employment, including Garda vetting.

· Keep secure records of concerns and referrals.

15. Adult Safeguarding

· Working with the Clinical & Governance Lead, maintain the group adult safeguarding policy in line with HIQA Regulation 8 (Protection), the National Standards and the HSE Safeguarding Vulnerable Persons at Risk of Abuse policy.

· Ensure every centre has a trained designated officer and staff complete safeguarding training.

· Monitor that concerns are reported to HSE Safeguarding and Protection Teams and notified to HIQA (NF06) within required timeframes.

· Analyse safeguarding trends across centres and report learning to the senior leadership team and Board.

· Track new adult safeguarding legislation and policy.

16. Training and Support

· Develop and deliver training and guidance on risk management, data protection, health and safety, protected disclosures and other compliance obligations.

· Build governance and compliance capability among Persons in Charge, managers and staff.

· Act as a source of advice and support to colleagues across every centre and function.

Other Duties

The postholder may be required to carry out other duties appropriate to the role, as assigned by the Chief Executive Officer. This job description will be reviewed periodically to reflect the changing needs of the group.

Person Specification Essential

· Degree (NFQ Level 7 or 8) in law, governance, risk management, health and safety, healthcare management, nursing or a related discipline, or equivalent professional qualifications and relevant experience (e.g. a Postgraduate Diploma in Corporate Governance or Healthcare Risk Management, NEBOSH National Diploma, a Compliance Institute professional diploma or an IRM International Certificate in Risk Management).

· At least 5 years' experience in a governance, risk, compliance or legal role, ideally within a multi-site or regulated environment.

· Strong working knowledge of GDPR and the Data Protection Act 2018.

· Practical experience of designing and running risk management frameworks and risk registers.

· Working knowledge of Irish health and safety legislation.

· Excellent report writing and presentation skills, including reporting to Boards.

· Sound judgement, integrity and discretion when handling confidential and sensitive matters.

· Full driving licence and ability to travel to all centres.

Desirable

· Experience in a HIQA-regulated or healthcare setting, ideally residential care for older people.

· Recognised data protection qualification (e.g. Certified Data Protection Officer or IAPP CIPP/E).

· Qualification in health and safety (e.g. NEBOSH or a Diploma in Safety, Health and Welfare at Work).

· Risk management qualification (e.g. IRM certificate or equivalent).

· Experience handling protected disclosures or conducting workplace investigations.

· Experience supporting multi-site organisations through growth or acquisitions.

Key Competencies

· Independent and confident in challenging senior colleagues constructively.

· Collaborative, building trust with Persons in Charge and frontline teams.

· Highly organised, able to manage competing priorities across multiple sites.

· Pragmatic, making compliance practical rather than bureaucratic.