Master test plan – translate the RCM into an executable ITGC test plan, jointly with the outsourcing firm. Liaise with Risk – stay aligned on RCM and scoping updates. Co-lead testing – work fieldwork side-by-side with the outsourcing firm across all systems, ITGC layers, and ITAC configuration/logic. Evidence coordination – bridge control owners and testers; keep evidence on schedule. Remediation advice – track gaps to closure and recommend practical fixes. Quality oversight – real-time QC since testing is co-led, not delegated. External audit alignment – share results early with the external auditor to avoid 404(b) surprises. Audit Committee reporting – support the Head of Internal Audit's reporting to the Committee.
5+ years in external audit (Big 4 preferred), hands-on U. S. SOX 404 ITGC and ITAC configuration/logic testing. Proven ability to build or translate an RCM into an executable test plan. Technical depth across all four ITGC layers (App, DB, OS, Network) – access, change, computer operations, privileged access, batch job controls. Experience working alongside external auditors. CISA required; CIA or other audit certifications a plus. Comfortable co-leading fieldwork with a vendor team as a peer; strong stakeholder management; genuine interest in building long-term in-house capability.
