IT Risk and Controls Testing Analyst

The Risk and Controls Testing Analyst will be assisting with planning, and reporting on our compliance requirements across IT and ongoing work to ensure the organization can provide timely certification of compliance. The core focus will be the testing of IT General Controls (ITGC), Key Reports for SOx Compliance and other audit requirements. The role will require a clear testing timeline to be met, ensuring that any documentation is complete and accurate in order to satisfy external auditing from external parties.

The Office of the CIO is involved in numerous initiatives within the IT function. The main function of this role will be to undertake control testing of ITGC’s with a particular focus on the planning and execution of SOx control testing. Involvement in other initiatives will be as determined by the line manager.

• Internal control testing (ITGCs) - Perform the execution of the IT SOx annual plan, ensuring efficient and timely execution of all stages of the IT SOx program - Planning, Execution, Delivery & Reporting.
• Create and maintain all documentation relevant to IT SOx program such as walkthroughs, testing and controls evaluation.
• Participate and drive detailed control walkthroughs from an internal audit testing front.
• Review internal controls documentation and understand the key ITGC controls. Establish, plan, coordinate and deliver controls testing.
• Prepare and maintain detailed, high-quality working papers that document the testing strategy, samples selected, test results, and conclusions.
• Coordinate and implement testing of key IT controls (ITGCs and few application controls, Report Testing
  -as required), track completion, monitor status and continuous follow up with the process/system owners.
• Develop and maintain close working relationships with the IT management teams as well as external auditor, ensuring a deep understanding of key risks and processes of the organization.
• Understanding of SSAE 18 (SOC1 Reports).
• Demonstrated awareness of key regulations and how they interface with SOx compliance activities and data handling practices.
• Ensure any internal control deficiencies are identified, reported, track remediation progress and re-tested.
• Ensure any control improvements are identified and shared.
• Support quarterly controls self-assessment process.
• Support the maintenance and upkeep of internal logs/trackers to ensure tracking and reporting.

• Identify, assess, and manage risks and issues.
• Escalation to stakeholders for support and decisions where appropriate.

• Work closely with external auditors to align on testing timelines and requirements.
• Facilitate and accelerate the testing process wherever possible.
• Address auditor queries and provide and ensure that the evidence documentation is provided in a timely manner.

• Communicate effectively with Control Owners, Operators, IT Directors and other senior stakeholders.
• Ensure all stakeholders are informed about progress, risks, and issues.
• Promote awareness and understanding of ITGC and SOx requirements across the organisation.

• Have proven experience in a recent position as an IT Auditor (preferably any Big Four or other accounting firms) or equivalent experience in SOx IT program in a public company environment.
• Strong interpersonal skills, communication, and analytical skills.
• Any experience in GRC Tools or SOx compliance software preferred.
• Continuously focus on self-development by attending training, seminars and acquiring relevant certifications.

• Detail-oriented with a strong focus on accuracy.
• Proactive and results-driven.
• Strong organisational and time-management skills.
• Ability to influence and collaborate with cross-functional teams.
• High level of integrity and confidentiality.
• Ability to clearly articulate findings and communicate results to the management.

• Works under general direction within a clear framework of accountability. Exercises substantial personal responsibility and autonomy. Plans own work to meet given objectives and processes.

• Communicates fluently, orally and in writing, and can present complex information to both technical and non-technical audiences.
• Plans, schedules and monitors work to meet time and quality targets.
• Facilitates collaboration between stakeholders who share common objectives.
• Fully understands the importance of security to own work and the operation of the organisation.
• Understands and uses appropriate methods, tools and applications.
• Demonstrates a rational and organised approach to work.
• Is aware of health and safety issues.
• Identifies and negotiates own development opportunities.
• Has communication skills for effective dialogue with key stakeholders, customers, suppliers and partners.
• Is able to work in a team.
• Is able to plan, schedule and monitor own work within short time horizons.
• Displays a responsible attitude to following procedures, keeping records, and caring for…