Internal Audit Manager (ITGC & SOX Compliance)

Key Responsibilities

• Lead SOX 404 compliance activities, including application control testing and key report testing to evaluate the design and operating effectiveness of internal controls over financial reporting.
• Prepare and present audit findings, risk assessments, and recommendations to Executive Management and the Audit Committee.
• Develop risk-based audit plans, define audit scope, create test plans, execute fieldwork, document findings, and present audit reports to senior leadership and the Audit Committee.
• Perform IT General Controls (ITGC) audits designing test grid, covering access management, change management, backup and recovery, segregation of duties, and system development lifecycle controls.
• Collect and evaluate audit evidence through walkthroughs, inspection of logs, restoration testing, configuration reviews, and risk-based sampling techniques.
• Drive remediation of control gaps and provide practical risk mitigation recommendations to IT and business stakeholders.
• Partner with management to strengthen internal controls, governance, compliance, and operational effectiveness.
• Interface with IT, business functions, external auditors, and audit leadership to ensure audit findings are understood, tracked, and resolved.
• Assess automated controls, application controls, interfaces, and key reports supporting financial reporting processes.
• Monitor remediation efforts and validate corrective actions for identified deficiencies.

1. User Access Management

• Review and monitor user access to applications and systems.
• Ensure proper user provisioning and deprovisioning processes.
• Conduct periodic access reviews and certifications.
• Verify segregation of duties (SoD) compliance.
• Monitor privileged and emergency access on a frequent basis.

2. Change Management Controls

• Ensure all system changes follow approved change management procedures.
• Review change requests, approvals, testing evidence, and migration documentation.
• Support audit reviews of system changes.

3. IT Operations Controls

• Monitor batch jobs, system interfaces, and scheduled processes.
• Review backup and recovery procedures.
• Validate disaster recovery and business continuity controls.

4. Compliance and Audit Support

• Coordinate SOX ITGC testing activities.
• Gather and provide evidence to auditors.
• Support internal and external audit requests.
• Track remediation of audit findings.
• Prepare control documentation and compliance reports.

5. Risk Management

• Identify control gaps and process risks.
• Perform risk assessments.

6. Documentation and Governance

• Maintain control narratives, process flows, and control matrices.
• Update policies and procedures.
• Ensure controls are documented and executed consistently.

7. Security Controls Monitoring

• Review privileged access activities.
• Support cybersecurity compliance requirements.
• Ensure adherence to corporate security policies.

8. SAP-Specific ITGC Responsibilities (if supporting SAP)

• SAP user access reviews.
• SAP role design and SoD analysis.
• Firefighter/Emergency Access Management reviews.
• Transport management reviews.
• SAP Basis and security control monitoring.
• Audit support for SAP systems.
• Review Business Process Controls
• Track ownership on exceptions
• Review exceptions on a periodic basis

Required Experience & Qualifications

• Bachelor's degree in Accounting, Finance, Information Systems, Computer Science, or a related field.
• Minimum 7+ years of experience in Internal Audit, External Audit, SOX Compliance, IT Audit, Risk Management, or a combination thereof.
• Minimum 3+ years of leadership, supervisory, or people management experience.
• Strong experience with SOX 404 compliance and IT General Controls testing.
• Hands-on experience auditing ADP, SAP S/4HANA, SAP TM, Workday, and SAP Business Objects, SAP security and role-based access controls (RBAC) environments.
• Experience evaluating application controls, automated controls, key reports, and system interfaces.
• Identity and Access Management (IAM)
• Risk and Compliance Reporting
• Experience working with internal and external auditors in a public company SOX compliance environment.
• Public accounting experience preferred, with Big Four experience strongly preferred.
• Certifications such as CIA, CPA, CISA, CISSP, or CFE are preferred.
   

Preferred Skills

• Strong understanding of COSO, SOX 404, IIA Standards, and risk-based auditing methodologies.
• Excellent executive presentation and communication skills.
• Ability to translate technical IT risks into business-focused recommendations.
• Strong project management, stakeholder management, and problem-solving capabilities.
   

Soft Skills

•     Audit coordination

•     Attention to detail

•     Problem-solving

•     Strong analytical skills

•     Documentation and reporting

•      Stakeholder management