Danny van der Ploeg has over 24 years of experience providing risk management services and ensuring risk management adds value without adding bureaucracy. He specializes in enterprise risk management, operational risk management, and information security policy implementation. Notable achievements include implementing a GRC solution at ING Bank to serve as a single source of risk information, defining information security policies for several organizations, and assisting with SOX compliance. He has worked with many Dutch companies and speaks Dutch, English, German and French.

1. Page 1
Ing. Danny van der Ploeg RE CISA
Danny van der Ploeg During the past 24 years I have been working in
complex environments, providing services to
organizations to better manage their (information)
risks and achieving their objectives. In my jobs and
assignments I have always been focused on ensur-
ing that risk management adds value t o the organ-
ization, is well understood and is as much as pos-
sible integrated with daily business, without adding
bureaucracy. This stimulated me in building up or
seeking collaboration with high quality teams with
organization sensitivity that deliver professional,
qualified services, use clear communication and are able to influence posi-
tively. Where possible, I always used technology (software) to structure my
activities, to enable organization wide approaches and consistent and easily
available management information. My drive is to achieve an increase of the
risk management maturity of an organization with a risk profile that fits the
risk appetite.
Phone: +31 6 4136 1222
Address: Vinkenweg 21b
City: 2231 NP, Rijnsburg
e-mail: dvanderploeg@gripconsultancy.nl
Birthdate: 25 December 1965
Nationality:Dutch
CORE COMPETENCES  Excellent communication skills to engage across all levels of leadership
in- and externally and to influence across a complex (matrix)
organization
 Manager with excellent people management skills
 Build and manage a high quality team that delivers the timely, pragmatic
and expert guidance necessary to increase the maturity level of Risk
Management in the business
 Deliver results against tight and complex timelines and in a fast
changing environment
 Develop and evangelise a Risk Management strategy and governance
frameworks that is aligned to the strategic needs of the business
 Standardise Information Security Governance, Risk & Compliance
processes
 Excellent command of Dutch and English, spoken and written
PROFESSIONAL EXPERTISE  Enterprise Risk Management
 Operational Risk Management
 Contract Management
 IT Auditing
 (GRC) Software selection
 Information Security Policy definition and implementation
 Certification & compliance support for regulations, according to
standards (ISO27001, ISO31000, Sarbanes Oxley Act, ISAE3402, SAS70,
SOC2, Basel II/III)
MAIN INDUSTRY KNOWLEDGE  Banking (Retail, Private, Commercial)
 Insurance (Mortgages, Casualties, Income)
 Retail
 Leisure / Entertainment
 Manufacturing
EDUCATION 1993  Post graduate education IT Auditing - EUR, Rotterdam
1989  Information Technology – HTS Haarlem
1996  Certified Information Systems Auditor

2. Page 2
Ing. Danny van der Ploeg RE CISA
CAREER SUMMARY Director and owner of consultancy B.V.
04/2005 – today Self employed Operational Risk Manager and Project Manager for enterprise
risk management and information security related projects.
11/1995 – 03/2005 Senior Manager at Deloitte Enterprise Risk Services Amstelveen
11/1990 – 11/1995 IT auditor at ING Group (Nationale-Nederlanden)
RELEVANT ACHIEVEMENTS Main achievements and activities of the past 10 years
11/2008 – 31/12/2014 Senior Officer Non Financial Risk (NFR) Management with a focus on the
implementation of NFR processes and a GRC solution (based on OpenPages,
comprising ORM, Compliance, Key Risk Indicators, Key Control Testing and
Audit) supporting those processes at ING Bank. The solution supports the
administration of NFR information to serve as the “single source of truth” for
operational, management and regulatory reporting.
Key Achievements:
 Identified the NFR Profile of departments and divisions
 Provided Risk Officers with a thorough understanding of NFR methodol-
ogy and technology
 Made transparent to management of the NFR department what the cur-
rent Risk Profile and the quality of NFR activities was
 Increased the quality of Management Information
 Migrated OpenPages from version 5.5 to 6.2 and further to 7.0,
including data migration, data cleansing, data conversion and version
management
 Aligned and structured, where possible, all information requirements
 Streamlined and partly automated the Capital calculation processes.
09/2013 – 05/2014 Managed the project for the implementation of BWise at Global Collect. This
project has stopped due to the fact that Global Collect decided to discontin-
ue working with BWise.
04/2014 – 08/2014 Advised Delta Lloyd in the process of upgrading to OpenPages version 6.2
and in the platform migration process.
07/2012 – running Conducted Risk Assessments on IT (security) projects at a governmental or-
ganisation with highly confidential information.
07/2010 – 12/2010 Supported the selection of a suitable GRC tool for a financial services com-
pany’s (Achmea) Group Risk Management.
09/2009 – 08/2010 Defined the Information Security Policy top down and in a broad sense for
The Rijksmuseum
07/2008 – 02/2011 Developed and rolled out the (ISO 27002 based) information security policy
for Holland Casino to realise the required level of information security. In
this project, I managed a group of project managers who were responsible
for the realisation of the elements the policy and guidelines comprises. I re-
ported directly to the board of Holland Casino on project quality & progress.
05/2009 – 11/2009 Supported ING Insurance in achieving SOx compliance for IT General Con-
trols.

3. Page 3
Ing. Danny van der Ploeg RE CISA
RELEVANT ACHIEVEMENTS Continued
03/2006 – 04/2009 Audited local municipalities to assess whether they complied with privacy &
information security legislation.
12/2007 – 07/2009 Led the project to select a financial/logistics and HR system for The Rijks-
museum. This had led – before the end of 2009 – to a very successful im-
plementation of the selected software, within scope, time and budget.
05/2006 – 12/2008 Led the Information Risk team as interim manager at ING Insurance achiev-
ing SOX Compliance and a lowered Risk level for IT General Controls and
Application controls. Coached the team and increased quality of delivery.
09/2005 – 06/2006 Introduced a Business Impact Analysis approach to translate business re-
quirements into IT infrastructure controls for Philips. This achievement was
part of a bigger programme to implement ISO 27001/2
06/2005 – 12/2006 Defined and implemented Key Risk Indicators and respective dashboards for
SNS REAAL as part of the Basel II programme.
05/2005 – 09/2005 SOX implementation- and QA manager for a US based global organisation in
production of packaging materials for food industry. Focus on assessment
and remediation of controls in business processes and IT supporting pro-
cesses.
12/1995 – 04/2005 Many different clients in different Industries during 10 years of
career. (Information) Risk Management & Audit services delivered to:
• General Motors (Opel, Saab)
• Royal Ahold / Albert Heijn (Retail, 7 years of audit and risk management)
• Schuitema (Retail), Amsterdam Airport Schiphol
• Yamaha motors, Unilever (Food)
• Akzo Nobel, Shell
• TNT Mail / Logistics / Express
11/1990 – 11/1995 IT risk management and IT audit in Dutch and foreign ING companies
SUMMARY OF REFERENCES ING Bank, ING Insurance, SNS Reaal, Holland Casino, Rijksmuseum, Philips,
De Rechtspraak, Global Collect, Hewitt, IWI, Adams,
General Motors (Opel, Saab), Royal Ahold / Albert Heijn (Retail, 7 years of
audit and risk management), Schuitema (Retail), Amsterdam Airport
Schiphol, Yamaha motors, Unilever (Food), Akzo Nobel, Shell, TNT Mail /
Logistics / Express
LANGUAGE SKILLS  Dutch: Fluent (written and spoken)
 English: Fluent (written and spoken)
 German: Good (written and spoken)
 French: Moderate (written and spoken)
SOFTWARE KNOWLEDGE  Microsoft Office Suite Incl. Visio, highly specialised Excel knowledge
 Option Finder (tool to support facilitation of workshops)
 Mind Mapper (tool to structure brain storm sessions)
 Mavim (process documentation tool)
 Tools for process modelling & controls documentation
 OpenPages

4. Page 4
Ing. Danny van der Ploeg RE CISA
PERSONAL CHARACTERISTICS  Consistent
 Convincing
 Demanding
 Dynamic
 Flexible
 Good-humoured
 Helpful
 Loyal
 Persistent
 Respectful
 Responsive
 Self-Assured
 Thoughtful
 Tolerant
 Trusting
 Understanding
PERSONAL LIFE Married and father of 2 children, a girl and a boy.
My favourite hobby is running. Until 2014, I ran 26 Marathons all over the
world. Marathon running requires persistence and discipline, not only during
the race, but also during the year while following the training schedules.
I consider this not only as physical training, but also as mental training that
helps me performing in my professional life.