After spending 7 years at Deloitte and a lengthy tenure at Khazanah Nasional, this Institute of Enterprise Risk Practitioners (IERP®) alumna is currently the Director of Governance, Risk, and Compliance at Edotco Group.
Key Insights
- Effective enterprise risk management is a specialised discipline that demands dedicated professionals rather than serving as a corporate holding area for retiring staff.
- Navigating modern compounding crises requires rapid capability building and the strategic transfer of proven practices to strengthen a company’s line of defence.
- A resilient risk culture stems directly from the top, driven by leaders who actively embody the organisation’s values and act as a strong moral compass.
Modern risk requires more than just identifying threats; it demands resilience to survive compounding crises.
Few practitioners understand this better than Datin Azzahraa. As the Director of Governance, Risk, and Compliance at EDOTCO Group, her daily routine reflects the weight of her title.
“EDOTCO Group is the largest telecommunication infrastructure company in Malaysia and is owned by GLCs. I work to ensure the business can run smoothly and responsibly,” she shared.
Datin Azzahraa built this expertise across two distinct eras. She spent seven years with Deloitte in London, navigating a challenging career shift from words to numbers. Another transformative era followed at Khazanah Nasional, where she climbed the corporate ladder and completed her MBA at an Ivy League while raising four children.
When the time came to leave Khazanah, she initially rejected all five job offers she received. However, the fifth company, EDOTCO, persisted and eventually won her over. Now in her fifth year, she takes immense pride in protecting a company that carries a massive responsibility to the nation.
From Numbers to Enterprise Risk Management
Shouldering that weight requires more than raw experience; it requires a definitive framework.
For Datin Azzahraa, finding it took time. She grew up intending to become a lawyer, a natural path given her background as a national-level orator. Instead, her professional life took a sharp turn when she moved into accounting at Deloitte.
Though highly capable at managing contracts and numbers, she realised further down the line that she didn’t want to be an accountant.
Her Chief People Officer recognised her leadership potential and offered a traditional CEO track. She declined. She needed a discipline that actively aligned with her unique strengths.
The turning point arrived during her early years at Khazanah.
While pregnant with her first child, she completed her formal Enterprise Risk Management (ERM®) certification with the IERP®. This rigorous training gave her the exact technical foundation she needed to chart her own course.
“Finally I found my forte, which is risk management,” she noted.
Armed with this specialised expertise, she successfully bypassed the expected corporate ladder in favour of a purpose-driven career in risk.
Navigating Polycrisis Scenarios Through Rapid Capability Building
That certified expertise is now tested daily. Core business risks remain largely unchanged, but modern scenarios require an entirely new level of readiness.
“What changes are the intensity and our ability to deal with polycrisis scenarios,” Datin Azzahraa observed.
Surviving these compounding crises demands a robust combination of physical health, mental resilience, and technical adaptability. Today, she channels that resilience into guiding Edotco’s first line of defence.
Her portfolio spans Sustainability, Cybersecurity, and Health & Safety. “My department is involved beyond setting the strategy, but also the execution at both cloud and ground levels,” she explained.
Recognising that no single individual can manage this scope alone, she focuses heavily on capability building.
She anchors her GRC team in the same rigorous standards she mastered through the IERP®. This ensures EDOTCO possesses the collective technical strength required to elevate its risk management and secure sufficient commercial rewards.
She accelerates this process by applying a practical methodology, systematically transferring proven practices between her past and present roles.
“I took all the good practices from Deloitte and brought them to Khazanah. I then took all the good practices from Khazanah and brought them to EDOTCO Group,” she shared.
Applying this accumulated experience effectively halves the time required for institution building. “If it took 10 years for me to do certain change in Khazanah, I should be able to halve it to 5 years for EDOTCO with my knowledge and experience!”
Balancing Strategy and Values in Governance, Risk, and Compliance
Driving rapid institutional change, however, requires earning the complete trust of the organisation. Navigating this relationship means risk practitioners face a constant tension: they must act as strategic partners while remaining objective challengers.
Datin Azzahraa views adding value as her primary duty. “I have a lot to prove to the business,” she noted.
Because a company can technically run without a second line of defence, she believes it is her job to show stakeholders exactly what she brings to the table. It is a philosophy that echoes her training with the IERP®, moving risk from a basic requirement to a role that actively supports business goals.
Yet, she carefully manages this drive to prove her worth. “I have to control myself to be objective, independent and compliant,” she explained.
She anchors this balance in two lifelong pillars: knowledge and faith. A dedicated reader since childhood, she continually sharpens her technical edge.
“To me, it is about your knowledge and your faith. Both must be strong,” she insisted.
Together, these elements form a clear moral compass that directs her daily GRC decisions. “For as long as I have both, my moral compass should be on the right path and I can sleep peacefully at night with every decision I make.”
Building a Resilient Risk Culture Across Different Mandates
A strong risk culture never happens by accident. It stems directly from leadership.
Embedding this culture requires strategies tailored to vastly different mandates. At Khazanah Nasional, Datin Azzahraa navigated a highly institutionalised environment where issues remained strictly strategic and portfolio-driven, with decisions centred entirely on the Rakyat.
In stark contrast, EDOTCO operates with a highly operational footprint spanning both undeveloped and developing markets.
Across both settings, her core philosophy holds firm: leaders fundamentally set the tone for an organisation’s culture. “People look up to the leaders,” she noted. “Whenever I see a negative culture that is against my values, I either remove that negative culture or I walk away.”
For her, the bottom line remains absolute. Leaders do not just shape the workplace. They fundamentally are the culture of an organisation.
The Case for Qualified Risk Management Leadership
Organisations must fundamentally rethink how they staff their second line of defence.
For too long, companies have treated risk and compliance departments as holding areas for retiring staff or employees with no clear placement. Datin Azzahraa offers a blunt directive: this practice has to stop.
Instead, businesses need professionals with dedicated, proven skills. She argues that effective Risk Management Leadership demands the same hiring rigour applied when recruiting qualified accountants for finance or lawyers for legal teams.
Her own journey reflects this reality. Having found her forte through formal enterprise risk certification with the IERP®, her career serves as living proof that risk management is a highly specialised discipline.
