What we do Scope Our network Positions Work with us About Contact
Risk · Resilience · Cyber · Change

Independent Risk Assurance & Validation for Regulated Financial Institutions

Across APAC and the Middle East, regulated financial institutions are not struggling with a lack of operational risk frameworks, policies, or controls. They are struggling with a harder question:

"If we are challenged today, will our position stand up clearly, consistently and confidently?"

Start a conversation What we do →
ORP2b at a glance
75%
Repeat businessfrom regulated clients
350+
Domain expertsacross 20+ countries
24hr
Turnaroundon engagement scoping
15+
Yearsin practice · founded Singapore 2011
Independent Assurance· FEAT Principles· Operational Resilience· MAS Notice 655· AI Risk & Governance· DORA· Technology Risk· BCBS 239· Cyber Security· CBUAE· Third Party Risk· Senior Judgement· Defensibility Under Scrutiny· NACSA Direction 8 & 9· Independent Assurance· FEAT Principles· Operational Resilience· MAS Notice 655· AI Risk & Governance· DORA· Technology Risk· BCBS 239· Cyber Security· CBUAE·
What we do

Independent Assurance Across Operational Risk, Cyber, Resilience, AI & Change

"ORP2b provides independent risk validation and senior-led assurance to help boards and CROs of regulated financial institutions determine: what is defensible today under regulatory scrutiny, where exposure exists despite documented artefacts, and what actions are proportionate, necessary, and clearly owned.

Our approach is judgement-led, platform-agnostic, and independent. Delivered with domain depth and named senior accountability. Every engagement is focused, time-boxed, and scoped within 24 hours.

We are not a framework factory. We do not produce policy for its own sake. We tell leadership what will stand up under examination — and what will not."

01
"If a serious cyber incident occurs, will our cyber risk posture withstand regulatory review, audit challenge, and board scrutiny?"

Cyber & Technology Risk Assurance

Regulatory defensibility of cyber posture · clarity of ownership and escalation · Technology Risk COE
02
"If a major disruption occurs, are our resilience claims credible and defensible across entities and markets?"

Operational Resilience Readiness

Critical process mapping · impact tolerances · governance and execution readiness · BCM-DR
03
"Which outsourcing or third-party arrangements would expose us if challenged today?"

Third-Party Risk & Outsourcing

Critical dependencies · accountability gaps · regulatory defensibility of outsourcing posture
04
"Are we securing the right outcomes from our transformation and change management initiatives?"

Change Management & QA

Governance and Quality Assurance · Project & Programme delivery · Transformation & Change
Full scope

Full Scope of Independent Assurance Services

ORP2b delivers across four interconnected domains — each with advisory, experts for hire, training, and niche products available alongside assurance work. All delivered through a flexible, platform-agnostic model.

Operational Resilience & GRC

  • ERM, NFRM, ORM frameworks
  • Process risk & governance
  • Third party & supply chain
  • BCP / DR / Crisis management
  • Scenarios & stress testing
  • AI risk & governance
  • Compliance & assurance
  • Continuous controls monitoring

IT & Cyber Security

  • Technology risk
  • VAPT
  • Cloud security
  • Information security
  • SOC
  • Identity & access management
  • Threat & risk assessment
  • Maturity assessments

Transformation & Change

  • Transformation strategy
  • Project / programme management
  • Quality assurance
  • Testing & reliability engineering
  • Business process reengineering
  • Front-to-back delivery

Learning & Products

  • Skills assessment & training design
  • Certifications & performance
  • Change management & culture
  • ERM-ORM-GRC solution
  • Cyber GRC & VAPT products
  • Testing automation & reliability
  • Client lifecycle management
Assurance & Advisory
Independent validation, senior-led reviews, regulatory defensibility assessments — Lane A ORP2b-led engagements
Experts for Hire
On-demand access to 350+ curated domain experts matched to scope, seniority, and jurisdiction — flexible and time-boxed
Delivery model
PMO & governance · Build-Operate-Transfer · Managed services · Hybrid, remote, onsite across APAC & Middle East
Our network

Boutique Independence with Institutional Delivery Capacity

ORP2b operates through a three-layer delivery architecture — so "can you actually staff this?" always has a credible answer, without the overhead structure that dilutes boutique advisory.

Our expert network spans 20+ countries, covering every domain we deliver. Experts are matched to scope, tagged by mode — validator, advisor, implementer — and convened under ORP2b leadership. This is not a staffing pool. It is a curated capability.

"Policy is not evidence. ORP2b assesses what would survive a live supervisory examination — not what has been documented to suggest it would." — Rajit Punshi, Founder, ORP2b
350+
Domain experts globally
20+
Countries represented
75%
Repeat client rate
Singapore Malaysia UAE Philippines India Hong Kong Kuwait Saudi Arabia UK & EU Australia
Three-layer delivery

Practitioner leadership

Senior-led origination, advisory, and quality control. Every engagement has named practitioner accountability — not a project manager in front of junior resource.

Strategic delivery partnerships

A select number of complementary specialist firms where ORP2b delivers specific scope inside larger engagements — geographic, technical, or sector-specific.

Curated expert network

350+ domain specialists matched to engagement scope. Not a staffing pool — a managed capability that ORP2b convenes, leads, and stands behind.
Partnership credential
Strategic CCP Partner
Cybersecurity Malaysia — recognised national cybersecurity competency partner
ORP2b Positions

Our Published Positions on Risk, Resilience & Regulatory Supervision

A real position forces real refusals. These are views earned through engagement, regulatory observation, and production experience. Each invites disagreement. Below them: the arguments that demonstrate them.

01

Examinability is the real test

Policy is not evidence. Supervisors are increasingly asking institutions to demonstrate their AI and resilience frameworks operate — not merely that they exist. A validation report is the beginning of that demonstration, not the end.

AI Governance
02

AI risk is NFRM

ORP2b's position: AI risk is Non-Financial Risk (NFRM), not a separate governance domain. Institutions building separate AI risk structures disconnected from operational risk, technology risk, and model risk governance are creating the regulatory fragmentation that APAC and Middle East supervisors — including MAS, BNM, and CBUAE — are beginning to challenge. The discipline is applying existing NFRM frameworks rigorously to AI systems, not duplicating them.

Non-Financial Risk
03

Validation is the missing capability

Independent validation and challenge of AI and risk frameworks is the gap most regulated institutions have — and the one regulators will close next. Building that capability internally takes years. Independent assurance earns time while it is built.

Assurance
04

Supervisory speed is the new speed

Regulatory clocks have outrun quarterly consulting cycles. Institutions that cannot match regulator cadence — on AI, on resilience, on technology risk — will lose the initiative. Firms running six-month engagement cycles compound that problem.

Regulatory
Published arguments
Work with us

Join the Expert Practitioner Network

ORP2b's delivery capacity operates through a curated network of senior practitioners — mobilised per engagement for specific technical or domain depth. This is not a staffing pool. It is a convened capability that ORP2b leads and stands behind.

If you are a senior practitioner in any of the domains below and would consider project-based collaboration, we would like to hear from you.

Domains we are building in
Non-Financial Risk Operational Resilience AI Risk & Governance Model Validation Technology Risk Cyber Security BCBS 239 / Data Risk VAPT Third Party Risk Transformation QA FRAML BCM / DR
What engagement looks like
Project-based — discrete engagements matched to your availability and domain
ORP2b-led — you deliver the domain expertise; ORP2b holds the client relationship and engagement governance
Senior only — we are not building a junior resource pool. Practitioners must be able to operate independently at board or CRO level
APAC and GCC — primary geographies are Southeast Asia, UAE, Kuwait, Saudi Arabia and broader MENA
Express interest
Tell us about yourself. If there is a fit, we will follow up directly — no automated responses.
About ORP2b

About ORP2b — Founded 2011, Practitioner-Led, Independent

ORP2b (The Operational Risk Practice Pte. Ltd.) is a practitioner-led independent risk assurance firm founded in Singapore in 2011 by Rajit Punshi — recognised globally as one of the Top 50 Faces of Operational Risk. ORP2b provides independent validation and senior-led assurance for regulated financial institutions across Operational Risk, Cyber Resilience, Operational Resilience, AI Governance, and Regulatory Change — serving APAC and the Middle East from Singapore, with a subsidiary in Malaysia (ORP2bTech Sdn Berhad). 75% of engagements are repeat business from regulated clients. The firm scopes all engagements within 24 hours.

ORP2b was founded in Singapore in 2011 by Rajit Punshi — recognised globally as one of the Top 50 Faces of Operational Risk — after a 21-year career at Standard Chartered, culminating as Group Head of Operational Risk Policy and Process. A past Board Member of ORX — the world's largest operational risk data consortium — Rajit has been a practitioner voice in regulatory dialogue across FSA, BBA, IIF, and G20 financial reform processes.

Today ORP2b serves regulated banks, digital financial institutions, and central bank mandates through a curated network of 350+ practitioners across 20+ countries. 75% of engagements are repeat business from regulated clients. All engagements scoped in 24 hours.

75% repeat business 24hr turnaround Founded 2011 CCP Partner — Cybersecurity Malaysia ORP2bTech Sdn Berhad — Malaysia NACSA Direction 8 — Active Bid APAC · Middle East · EU-UK

Our engagements span regulated banks, digital banks, and central bank mandates. The question is always the same: if challenged today by a supervisor, a board, or an auditor — will the institution's position hold? We provide the independent, senior view that helps leadership answer that question honestly.

Leadership
RP

Rajit Punshi

Founder & Principal

21-year career at Standard Chartered, last role Group Head of Operational Risk Policy & Process. Recognised as one of the "Top 50 Faces of Operational Risk" globally post-GFC. Past Board Member, ORX — the world's largest operational risk data consortium.

Operational Risk AI Governance Resilience Regulatory
LinkedIn rajitpunshi@orp2b.com
A

Akshaya

CIO & Project Advisor · 25+ years

Senior technology and transformation leader with 25+ years across financial services. Brings Group CIO-level perspective to technology governance, digital transformation, strategic sourcing, and IT outsourcing — from strategy through execution.

Technology Governance Digital Transformation IT Outsourcing Strategic Sourcing
LinkedIn
N

Nilo

Financial Services & Digital · 25+ years

Practitioner with 25+ years across financial services and digital business in Asia. Deep expertise in financial services operations, digital banking, and risk — bringing institutional knowledge of regional market dynamics across Southeast Asia.

Financial Services Digital Banking SE Asia Risk

LinkedIn
350+ expert network — skills by domain

Our curated expert network covers every domain we deliver — matched to scope, seniority, and jurisdiction. What follows is the skills landscape available across the 350+ practitioners we convene.

Non-Financial Risk & Operational Resilience
ERM / ORM frameworks NFRM design & validation RCSA & assurance Operational resilience Important business services Impact tolerance setting BCP / DR / Crisis management Scenario & stress testing Process risk & governance Third party & outsourcing risk Supply chain risk Risk appetite & policy Internal controls Fraud risk Risk culture
Technology Risk & AI Governance
AI risk & governance Model validation FEAT readiness AI model inventories Technology risk frameworks ICT risk assurance BCBS 239 / RDARR Data risk governance MAS Notice 655 DORA compliance Quantum readiness Cloud risk Technology risk COE Continuous controls monitoring RegTech & GRC solutions
Cyber & Information Security
Cyber risk assurance VAPT Cloud security Mobile banking security SOC design & review Identity & access management Threat & risk assessment Cyber resilience Information security frameworks NACSA Direction 8 audit NACSA Direction 9 — post-quantum CBUAE cyber Cyber GRC Virtual CISO Privacy & GDPR Security benchmarking
Transformation, Change & Learning
Programme & project management Quality assurance Testing & reliability engineering SDLC assurance Business process reengineering Murex & capital markets tech Digital transformation Build-Operate-Transfer COE design Training design & delivery Skills assessment Certifications Change management & culture FRAML Client lifecycle management
Malaysian subsidiary · 100% owned by ORP2b
ORP2bTech
Sdn Berhad
Incorporated in Malaysia · Technology Risk, Cyber & AI Governance
BNM — Bank Negara Malaysia NACSA — Cyber Security Act 2024 CCP Partner — Cybersecurity Malaysia Engagements available under ORP2b or ORP2bTech
ORP2bTech Sdn Berhad — Malaysia Cyber Risk & Technology Assurance
In-market presence

ORP2bTech Sdn Berhad is a 100% subsidiary of The Operational Risk Practice Pte. Ltd. (ORP2b), incorporated in Malaysia as the group’s in-market entity for technology risk, cyber assurance, and AI governance under BNM and NACSA frameworks.

For Malaysian regulated institutions, NCII entities, and government procurement, ORP2bTech provides a locally incorporated counterparty — with full backing of ORP2b’s 15-year practitioner depth and 350+ expert network.

BNM regulated NACSA jurisdiction CCP Partner 100% ORP2b subsidiary
NACSA Direction No. 8
Active bid
Cybersecurity Audit — NCII Entities

NACSA Direction No. 8 requires all National Critical Information Infrastructure (NCII) entities in Malaysia to undergo an independent cybersecurity audit at least every two years under the Cyber Security Act 2024 (Act 854), with reports submitted to NACSA within 30 days of completion. Enforceable from 17 July 2025.

ORP2b audit capability
Compliance-based audit against Act 854, NACSA Directives, and sector-specific codes of practice
Risk-based audit covering threat modelling, vulnerability assessment, and control effectiveness
Technical testing: VAPT, SOC review, identity and access management, cloud security
Audit reporting to NACSA Chief Executive within the mandated 30-day completion window
An NCII-designated client has invited ORP2b to bid for Direction 8 audit delivery. NACSA auditor approval will be pursued upon engagement award, with client sponsorship.
NACSA Direction No. 9
Capability ready
Post-Quantum Cryptography Migration

Direction No. 9 mandates that NCII entities provide data to support Malaysia’s national post-quantum cryptography migration programme — covering cryptographic inventory, migration readiness, and quantum risk exposure.

ORP2b capability
Cryptographic inventory assessment and classification of quantum-vulnerable systems
Quantum risk exposure assessment and crypto-agility roadmap development
NCII entity data submissions aligned to NACSA Direction 9 reporting requirements
Governance framework for post-quantum migration programme oversight
Methodology developed through an active post-quantum cryptography readiness engagement with a Gulf central bank. Directly applicable to NACSA Direction 9 requirements.
AI Risk & Governance
Capability ready
AI Governance Validation & Assurance

BNM’s Responsible AI and NACSA’s emerging AI security requirements create convergent obligations for Malaysian regulated institutions. AI risk sits inside NFRM and technology risk — not outside them.

ORP2b capability
AI model inventory, classification, and governance framework validation
Independent validation of AI risk frameworks against BNM Responsible AI and FEAT principles
Board and senior management examinability assessment — can your AI governance withstand regulatory challenge?
AI risk integrated into NFRM, operational resilience, and technology risk frameworks
Active engagements across MAS, CBUAE, and BNM-regulated institutions. AI governance validation is the fastest-growing area of supervisory expectation across ASEAN and GCC.
Contact

Start a Conversation — Independent Risk Assurance Enquiries

If you have a risk assurance, resilience, cyber, or transformation challenge — or if you are responding to a supervisory expectation and need an independent view — we would like to hear what it is.

Email
ask@orp2b.com · rajitpunshi@orp2b.com
Headquarters
Singapore · ORP2b Pte. Ltd.
Operations
Singapore · Malaysia · UAE
Operating presence
APAC · India · Middle East · EU-UK

Perspectives — add entry

Add each perspective below. Use the editorial headline and core argument — not the LinkedIn opener. The entry stands alone on the site as an ORP2b position.