A former lawyer, Noraina Mustapha is currently the Head of Risk, Governance & Compliance at a national government-owned company.
Key Insights
- Drawing on her legal background, Noraina Mustapha shifts the focus from defending legal disputes to anticipating and preventing operational failures before they happen.
- Effective enterprise risk management embeds sustainability, operational realities, and clear decision rights directly into business strategy so leaders can act with speed and confidence rather than being slowed down by excessive approval layers.
- A mature risk culture treats risk management as an everyday leadership discipline owned by the business, where the goal is not to avoid risk altogether, but to take the right risks intelligently.
Starting her career as a lawyer at a law firm, Noraina Mustapha has come a long way. Today, as the Head of Risk, Governance & Compliance at a national government-owned company, she recognises how her legal background shaped her approach to risk more than she realised at the time.
“Legal practice trains you to look beyond what is presented on the surface. You learn to establish facts, test evidence, identify weaknesses in an argument, anticipate what could go wrong and understand the consequences of a decision. Those are essentially the same disciplines I use in risk and governance today,” she explained.
The difference is that as a lawyer, Noraina often dealt with issues after they had already happened. Moving into risk and governance shifted her perspective towards prevention. Instead of asking, “How do we defend this position?”, she increasingly found herself asking, “What could lead us here in the first place, and what can we do now to prevent or reduce the impact?”
When asked whether her early focus on corporate cases was deliberate, Noraina noted that the transition happened organically.
“I started in general litigation, but naturally became more involved in corporate and commercial matters. What interested me was not only the legal issue itself, but what had happened within the organisation that allowed the dispute to arise,” she said.
Litigation gave her a unique retrospective view of governance. She saw firsthand the consequences of unclear decision-making, poor documentation, weak controls, contractual ambiguity and, at times, people simply failing to ask the right questions early enough.
The result? Three things stayed with her: evidence, accountability and consequence.
Now, when Noraina assesses a risk or governance issue, she still applies that legal discipline: establishing the facts, testing the supporting evidence, identifying who holds decision-making authority, and weighing what could reasonably happen if they get it wrong.
“But I have also had to unlearn something from legal practice. Risk management cannot operate like litigation. The objective is not to win an argument. The objective is to help the organisation make a better decision,” she shared.
Overseeing Enterprise Risk Management at a National Government-Owned Company
In the company she currently works at, a wholly-owned government entity, they drive the transformation of the country’s public transportation systems and services. It is the owner-operator of the country’s rail services, including the LRT networks, National Monorail, and MRT lines, as well as stage bus services across certain regions within the country.
With such wide coverage, managing enterprise risk at scale naturally comes with hurdles. Given their critical role in Malaysia’s green mobility goals, Noraina shared several challenges in integrating climate and Environmental, Social, and Governance (ESG) risks into a traditional enterprise risk framework.
One challenge is treating sustainability as a separate category of risk rather than recognising how it amplifies risks the company already manages. Traditional enterprise risk management tends to be strongest when assessing risks against immediate business objectives; climate risks, however, develop over much longer periods and carry greater uncertainty.
Another challenge lies in translating broad ESG commitments into measurable risk decisions. From Noraina’s perspective, sustainability risk should not sit beside enterprise risk management as a separate reporting exercise. Instead, it needs to be embedded into investment decisions, asset planning, business continuity, procurement, and operational risk assessments.
She added: “For public transport specifically, there is also an important balance. We contribute to greener mobility, but the system itself must remain resilient to the physical and transition risks associated with climate change.”
Having led crisis response and recovery for disruptive events, one key lesson Noraina has taken away is that a live crisis exposes the quality of an organisation’s governance very quickly.
“When something serious happens, information will be incomplete, circumstances will change, and management will be under pressure to act quickly. You cannot eliminate that uncertainty,” she said.
“I have also learned that speed does not mean bypassing governance. In fact, good governance enables speed because people already understand their decision rights and escalation thresholds.”
What’s more, in a complex public transport organisation, risk decisions often require alignment across the Board, senior management, and operational teams. Noraina translates risk insights into practical decisions that secure stakeholder buy-in without compromising service delivery, specifically by avoiding presenting risk as a reason why something cannot be done.
“In an operational organisation, particularly public transport, management has to keep services running. Simply identifying risks without understanding that operational reality does not add much value,” she noted.
Rather than saying, “This is high risk, therefore do not proceed,” the discussion becomes, “If we proceed, these are the exposures, these controls are already in place, these are the gaps, and these are the additional measures required.”
The Case For Being A Certified Enterprise Risk Manager
Noraina earned her Enterprise Risk Manager (ERM™), Sustainability Risk Manager (SRM™), and Operational Risk Manager (ORM™) certifications from the Institute of Enterprise Risk Practitioners® (IERP®), granting her different but complementary lenses to help put structure around what she had already encountered through years of working across legal, governance, compliance, and risk.
“The Enterprise Risk Manager (ERM™) programme reinforced the connection between risk, organisational objectives and decision-making,” she shared.
“The Operational Risk Manager (ORM™) programme was particularly relevant to a complex operating environment, where risks are dynamic and can escalate quickly, while the Sustainability Risk Manager (SRM™) programme broadened that perspective by integrating longer-term sustainability and ESG considerations.”
What Noraina found particularly useful was the structured way of thinking about risk beyond conventional risk registers and scoring. While identifying and rating a risk is relatively straightforward, the more important questions are: what does the risk mean to the organisation, how quickly could it materialise, how effective are the controls, what are the interdependencies, and is the response proportionate to the exposure?
This is relevant to Noraina’s role because risks rarely exist in isolation. A technology or operational issue, for example, can quickly have safety, financial, regulatory, business continuity, and reputational implications. Understanding those interdependencies is therefore critical.
“The programmes reinforced an objective-centric and forward-looking approach to risk. Rather than simply asking, ‘What is the risk?’, I focus on what we are trying to achieve, what could materially affect that objective, and at what point management needs to intervene,” she said.
Beyond any single methodology, the IERP® programmes helped Noraina hone a structured approach to risk thinking. One area where this becomes particularly useful is governance over decision-making and delegated authority.
“When reviewing governance arrangements, it is tempting to think that stronger governance simply means adding more approvals. But additional approval layers can also create risk. They can slow decisions, blur accountability and encourage people to treat approval as a substitute for ownership,” she explained.
“We therefore look at the issue through a risk lens: What is the value and exposure of the decision? Who is best placed to understand the risk? What controls need to exist? What decisions genuinely require escalation?”
Noraina argues that this allows governance to become more risk-based. After all, the objective is not maximum control; it is appropriate control with clear accountability.
“That principle has influenced how I approach governance generally. Good governance should allow an organisation to move confidently within clearly defined boundaries, rather than simply making it harder to make decisions,” she noted.
Lessons For Future Risk Professionals
With over 15 years of experience spanning risk, compliance, and governance, Noraina noted that the most striking shift in how large organisations build and sustain a strong risk culture today is that risk management is moving away from being something owned by the risk department.
“Earlier in my career, risk management could become quite process-driven: risk registers, periodic reporting, heat maps and compliance exercises. Those tools remain useful, but completing a risk register does not mean you have a strong risk culture,” she shared.
A genuine risk culture is visible in everyday decisions, particularly when the risk team is not in the room. For Noraina, the real test is whether people recognise risk, raise concerns early, understand the boundaries within which they can make decisions, and take accountability for the consequences.
That is why Noraina strongly believes that risk ownership must sit with the business. The risk function provides the framework, challenge, and oversight, but it cannot own every operational risk. The shift, therefore, is from “risk management as a function” to “risk management as a management discipline.”
For young professionals who aspire to pivot into risk leadership, especially those with legal backgrounds, Noraina’s advice is simple: do not confuse knowing the rules with understanding the business.
“Legal training gives you excellent analytical skills, but risk leadership requires much more. You need to understand operations, finance, technology, people and increasingly areas such as cybersecurity, data and AI,” she shared.
“You also need to become comfortable with uncertainty. Lawyers are trained to look for legal certainty and defensible positions. Risk professionals often have to advise management where there is no perfect answer.”
Another core quality to develop is the ability to challenge constructively. If every risk conversation ends with “no”, leaders will eventually stop inviting risk professionals to the table.
All in all, the best risk leaders are not the people who identify the most risks; they are the people who help organisations take the right risks intelligently.
Outside of navigating complex enterprise risks, Noraina also makes time to unwind and tap into her creative side.
“I enjoy anything that allows me to switch off from work and use a completely different part of my brain. I like exploring ideas around interior design and transforming spaces, and I can spend far too much time looking at furniture, colours and different design concepts,” she shared.
“I also enjoy experimenting with small ideas and projects outside work. I think there is something refreshing about starting with a simple idea and figuring out whether you can actually make it work. And, like everyone else, sometimes doing absolutely nothing is also a very good plan.”
