IT Internal Auditor

Overview

This role leads and executes technology risk, internal audit, and SOX initiatives with a focus on IT General Controls (ITGCs), IT Application/Automated Controls (ITACs), and technology controls supporting internal control over financial reporting (ICFR).

Work is limited to internal audit activities and does not involve direct access to Protected Health Information (PHI), Personally Identifiable Information (PII), or any secured or confidential client data.

Responsibilities

• Perform end-to-end SOX testing, including:
  • Walkthroughs, risk assessment
  • Test of Design (TOD) and Test of Operating Effectiveness (TOE)
  • Evaluation of evidence, documentation of testing results
  • Assessment of control deficiencies
• Evaluate and test ITGCs including:
  • User access management and privileged access
  • User access reviews
  • Segregation of duties
  • Change management
  • Computer operations
  • Security configurations and SDLC
• Evaluate and test ITACs/automated controls, including:
  • Configurable controls
  • System-generated reports/IPE
  • Interfaces
  • Other technology-dependent controls supporting ICFR
• Perform IT risk assessments across financially relevant applications and supporting technology environments, including applications, databases, operating systems, cloud solutions, and relevant integrations
• Support SOX readiness by developing and enhancing IT risk and control matrices, control descriptions, testing procedures, documentation, and evidence standards
• Identify control design or operational deficiencies, conduct root-cause and risk assessments, and partner with control owners to implement remediation or compensating controls
• Perform control benchmarking and rationalization to identify control gaps, redundant controls, and opportunities to strengthen or streamline the IT control environment
• Coordinate with IT, Information Security, Finance, Accounting, application owners, and business process owners on control design, testing, remediation, and implementation of new or enhanced controls
• Coordinate with internal and external auditors on ITGC/ITAC testing, audit evidence, identified deficiencies, remediation, and SOX-related deliverables
• Independently manage multiple audit and controls assignments from planning and scoping through testing, reporting, remediation, and closure

Requirements

• Bachelor’s degree in Accounting, Finance, Management Information Systems, Computer Science, Information Technology, or a related field, or equivalent relevant education and work experience
• 8+ years of relevant experience in IT Audit, Internal Audit, External Audit, Technology Risk, Risk Advisory, SOX Advisory, or a related assurance function
• Prior experience at a Big 4 public accounting firm
• Significant hands-on experience with SOX compliance, SOX readiness, ITGCs, ITACs, and technology controls supporting ICFR
• Strong understanding of the COSO Internal Control Framework and its practical application to technology risks, business processes, and financial reporting
• Strong experience performing technology risk assessments and evaluating controls across applications and supporting IT environments
• Hands-on experience evaluating design and operating effectiveness of ITGCs (Change Management, Access, Security, Computer Operations, SDLC), including Test of design (TOD) and test of operating effectiveness (TOE)
• Experience evaluating ITGC authentication and security configurations
• Hands-on experience evaluating IT automated/application controls (ITACs), including automated and configurable controls within ERP environments such as SAP ECC and SAP S/4HANA (3 way match, duplicate invoices, copy controls etc.)
• Experience evaluating system-generated reports, information used in control execution (IPE), interfaces, automated data transfers, and other technology-dependent controls relevant to financial reporting
• Experience evaluating technology risks and controls associated with applications and supporting IT platforms (including operating systems and databases, as applicable to the SOX environment)
• Experience developing and reviewing IT process narratives, flowcharts, risk and control matrices, control descriptions, walkthrough documentation, test procedures, workpapers, and supporting evidence
• Strong understanding of the relationship between ITGCs, ITACs, business process controls, financial reporting risks, and financial statement assertions, including how IT control deficiencies may affect reliance on automated controls and system-generated information

Preferred Qualifications

• Professional certification such as CISA, CIA, CPA, CA, CISSP, or equivalent

Compensation & Benefits

• Not specified

Location

• Remote opportunity
• Work timing: 1 PM to 11 PM IST