Senior IT Internal Controls Analyst

Title:

Senior IT Internal Controls Analyst

Job Summary

The Senior IT Internal Controls Analyst serves as Information Technology’s primary liaison and coordination point for internal audit, external audit, Finance, controller, risk, compliance, cybersecurity, application owners, infrastructure teams, and third-party service providers. The role supports the design, documentation, testing, monitoring, and continuous improvement of IT controls that enable reliable financial reporting and effective technology governance, with particular emphasis on Sarbanes-Oxley (SOX) systems and business-process support.

This position coordinates audit requests and evidence, evaluates IT general controls and automated/application controls, supports remediation of deficiencies, and embeds control requirements into key system implementations and significant changes. The analyst provides control-focused oversight across the systems development lifecycle (SDLC), including requirements, design, security, data conversion, interfaces, testing, segregation of duties, deployment, and post-implementation stabilization. Experience with ServiceNow and Microsoft Dynamics 365 Finance and Operations (FinOps) and Project Operations (Proj Ops) is preferred.

Key Responsibilities

Audit Liaison & Assurance Support

·   Serve as IT’s central liaison for internal audits, external audits, SOX testing, and other assurance reviews involving enterprise applications, infrastructure, cybersecurity, IT operations, and technology-enabled business processes.

·   Coordinate audit planning, walkthroughs, interviews, evidence requests, sample selections, demonstrations, and follow-up activities with control owners and subject-matter experts.

·   Maintain an organized audit request inventory, ownership matrix, due dates, evidence status, open questions, and escalation path to support accurate and timely responses.

·   Perform quality reviews of evidence before submission to confirm completeness, accuracy, relevance, appropriate period coverage, and alignment to the control description and test request.

·   Help translate audit observations into clear technology, process, risk, and business-impact language for IT leaders and control owners.

·   Build productive working relationships with auditors while protecting data confidentiality, maintaining document control, and ensuring responses are factual and appropriately approved.

Sarbanes-Oxley & IT Control Program Support

·   Support the IT SOX program covering financially relevant systems, supporting technologies, interfaces, reports, data, and business processes.

·   Coordinate and evaluate IT general controls, including security provisioning, privileged access, user access reviews, segregation of duties, change management, computer operations, backup and recovery, inter-system interface monitoring, and incident management.

·   Support computerized controls, configurable application controls, interface controls, key reports, spreadsheet-dependent controls, and information produced by the entity (IPE) used in financial reporting processes.

·   Facilitate control-owner walkthroughs; maintain process narratives, flow diagrams, risk and control matrices, control procedures, evidence standards, and testing support documentation.

·   Assess control design and operating evidence, identify gaps or inconsistent execution, and work with owners to strengthen sustainable controls without creating unnecessary operational burden.

·   Monitor control performance, exceptions, deficiencies, compensating controls, remediation plans, and management actions; escalate overdue or high-risk matters through established governance channels.

·   Support annual scoping and change-impact assessments for new systems, significant enhancements, integrations, organizational changes, vendor transitions, and evolving financial processes.

System Implementation & SDLC Audit Readiness

·   Provide risk and control support for major system implementations, upgrades, migrations, integrations, and transformation programs from initiation through post-go-live stabilization.

·   Participate in project governance and SDLC quality gates to confirm that financial reporting, security, access, privacy, data, auditability, records retention, and control requirements are identified and traceable.

·   Review control-relevant project artifacts, including business and technical requirements, solution designs, role designs, segregation-of-duties analyses, interface specifications, data migration, conversion plans, user acceptance testing, test documentation, defect disposition, deployment approvals, and support-transition documentation.

·   Assess whether implementation controls address configuration, master data, opening balances, data conversion completeness and accuracy, interfaces, workflow approvals, key reports, reconciliations, and cutover activities.

·   Coordinate audit participation in projects and maintain an implementation assurance plan that identifies key risks, required evidence, decision points, owners, and readiness criteria.

·   Support post-implementation reviews and stabilization monitoring to confirm control operation, evidence retention, ownership transfer, and closure of implementation-related risks.

Control Monitoring, Deficiency Management & Continuous Improvement

·   Maintain a consolidated view of control issues, audit findings, management action plans, risk acceptance decisions, target dates, dependencies, and validation evidence.

·   Facilitate root-cause analysis and development of practical remediation plans that address both the immediate exception and the underlying process or technology weakness.

·   Independently validate remediation evidence and readiness for auditor retesting; document residual risks and unresolved conditions accurately.

·   Develop dashboards and concise leadership reporting covering audit readiness, evidence timeliness, control execution, exception trends, remediation aging, project assurance status, and emerging risks.

·   Identify opportunities to standardize evidence, automate recurring control activities, improve preventive controls, reduce manual effort, and increase traceability across platforms and processes.

·   Promote a control-conscious culture through practical guidance, templates, training, office hours, and coaching for control owners and project teams.

Platform & Business Process Support

·   Support control design and audit evidence for ServiceNow workflows and records used in change, incident, problem, request, configuration, access, security, asset, risk, compliance, and audit-support processes, as applicable.

·   Support control design and audit readiness for Microsoft Dynamics 365 Finance and Operations and Project Operations, including security roles, segregation of duties, workflows, financial configuration, interfaces, data conversion, reports, batch processing, and project accounting processes.

·   Partner with Finance, Accounting, project controls, application teams, cybersecurity, identity and access management, infrastructure, data, integration, and service-management teams to connect technology controls to end-to-end business processes.

·   Coordinate with third-party application and service providers to obtain relevant assurance reports, control evidence, complementary user entity control support, and remediation updates.

Required Skills & Competencies

Audit, Risk & Control Expertise

·   Strong working knowledge of SOX requirements, IT general controls, automated and application controls, key reports, IPE, and technology risks affecting financial reporting.

·   Ability to interpret control objectives, assess design, evaluate evidence, recognize exceptions, and communicate deficiencies with precision and sound judgment.

·   Knowledge of common control and governance frameworks such as COSO, COBIT, NIST, ISO 27001, ITIL, or equivalent practices.

·   Understanding of third-party assurance reports and complementary user entity controls, including their relevance to enterprise control environments.

Technology, ERP & SDLC Knowledge

·   Practical understanding of enterprise applications, identity and access management, databases, operating systems, cloud services, integrations, batch processing, interfaces, reporting, and IT operations.

·   Strong understanding of SDLC, project governance, testing, release and change management, data migration, cutover, and post-implementation support.

·   Ability to evaluate role design, privileged access, segregation of duties, approval workflows, configuration controls, audit trails, and control dependencies.

·   Experience with ServiceNow and Microsoft Dynamics 365 Finance and Operations and Project Operations is preferred; experience with other large ERP, GRC, ITSM, or audit platforms is valuable.

Analysis, Communication & Collaboration

·   Exceptional organization and follow-through across multiple audits, projects, deadlines, request lists, and stakeholders.

·   Clear, concise written and verbal communication, including the ability to explain technical risks and controls to business stakeholders and financial-process impacts to technical teams.

·   Strong facilitation, interviewing, documentation, critical-thinking, and problem-solving skills.

·   Ability to influence without direct authority, challenge constructively, manage sensitive information, and maintain effective relationships in a complex global and matrixed environment.

·   Detail-oriented and evidence-driven, with the judgment to distinguish material control concerns from documentation or process-improvement opportunities.

Qualifications & Experience

Education

·   Bachelor’s degree in information systems, Accounting, Finance, Computer Science, Audit and Assurance, or a related discipline.

·   Equivalent relevant professional experience demonstrating the required knowledge, skills, and abilities may be considered.

Experience

·   5+ years of progressive experience in IT audit, IT internal controls, technology risk, SOX compliance, ERP controls or a related field.

·   Demonstrated experience supporting internal and external audits and coordinating evidence across technical and business stakeholders.

·   Hands-on experience with ITGCs, application controls, risk and control documentation, walkthroughs, testing support, deficiency assessment, and remediation validation.

·   Experience supporting major system implementations, ERP transformations, integrations, cloud migrations, or significant application changes using structured SDLC or project-governance practices.

·   Experience in a large, global, regulated, matrixed, professional-services, engineering, or multi-provider environment is preferred.

Certifications Preferred

·   Certified Information Systems Auditor (CISA).

·   Certified Public Accountant (CPA), Certified Internal Auditor (CIA), Certified Information Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC), or equivalent.

·   COBIT, COSO, ITIL, ServiceNow, Microsoft Dynamics 365, project management, or security-related credentials are advantageous.

Key Collaborators

·   IT Financial Controls, IT Governance, Enterprise Risk, Internal Audit, External Audit, Finance, Accounting, and Controllership.

·   Application owners, business process owners, Cybersecurity, Identity and Access Management, Infrastructure, Service Management, Data and Integration teams.

·   PMO, project managers, solution architects, developers, testers, Organizational Change Management, and implementation partners.

·   Third-party service providers, software vendors, and managed-service partners.

Measures of Success

·   Audit requests and evidence are coordinated accurately, completely, and within agreed timelines.

·   Control owners understand expectations and consistently retain evidence that demonstrates effective execution.

·   Control deficiencies and audit findings have clear ownership, sustainable remediation plans, transparent status, and timely validation.

·   Key projects identify and address control requirements early, with complete traceability through design, testing, deployment, and stabilization.

·   Leadership receives concise, reliable visibility into audit readiness, control health, remediation risk, and implementation assurance.

·   Control activities become more standardized, preventive, automated, and efficient while maintaining appropriate rigor.