Manager, Internal Audit

SOX 404 Compliance, Control Design and Testing (approximately 60–70%)

Plan and execute assigned activities within the Company’s SOX 404 compliance program, ensuring work is completed accurately, on time, and in alignment with internal methodology and external-auditor expectations.

Risk and Control Matrices (RCMs): Maintain and update RCMs for relevant business processes and IT applications.

Confirm that risks are appropriately addressed, control descriptions are clear and complete, and changes in processes, systems, ownership, or risk are reflected promptly.

Walkthroughs and scoping: Conduct process and control walkthroughs, assess annual scope and key-control coverage, document process flows, and identify changes that may affect control design or testing strategy.

Business-process controls: Evaluate the design, implementation, and operating effectiveness of controls across key cycles, including Procure-to-Pay, Order-to-Cash, Financial Close and Consolidation, Human Resources and Payroll, Property, Plant and Equipment, Treasury, Inventory, and other in-scope processes.

IT application controls (ITACs): Identify and test automated and semi-automated controls within enterprise applications, including automated calculations, workflow approvals, three-way matching, system configurations, and interfaces between internal systems and external service providers.

Key reports and information produced by the entity (IPE): Identify reports, queries, spreadsheets, and other information used in control performance.

Test completeness and accuracy through report logic, parameters, configuration, source-to-output reconciliation, access, change management, and, where applicable, SQL or code review.

Testing and documentation: Prepare clear, complete, and reproducible workpapers that document procedures performed, evidence examined, samples selected, conclusions reached, and reviewer follow-up.

Record testing results and findings in the designated audit and SOX management system.

Deficiency evaluation and remediation: Identify control gaps, perform root-cause analysis with stakeholders, assess deficiency severity in accordance with the Company’s framework, agree practical remediation actions, monitor milestones, and retest completed remediation.

External-auditor coordination: Act as a primary point of coordination for assigned SOX areas, facilitate walkthroughs and evidence requests, resolve questions, and maintain alignment on scope, testing status, deficiencies, and remediation.

Control-owner training: Provide onboarding and periodic refresher training to control owners and performers on control objectives, evidence standards, documentation requirements, and changes to the SOX program.