Senior IT Internal Controls Analyst

Title:

Senior IT Internal Controls Analyst

Job Summary

The Senior IT Internal Controls Analyst serves as Information Technology’s primary liaison and coordination point for internal audit, external audit, Finance, controller, risk, compliance, cybersecurity, application owners, infrastructure teams, and third-party service providers. The role supports the design, documentation, testing, monitoring, and continuous improvement of IT controls that enable reliable financial reporting and effective technology governance, with particular emphasis on Sarbanes-Oxley (SOX) systems and business-process support.

This position coordinates audit requests and evidence, evaluates IT general controls and automated/application controls, supports remediation of deficiencies, and embeds control requirements into key system implementations and significant changes. The analyst provides control-focused oversight across the systems development lifecycle (SDLC), including requirements, design, security, data conversion, interfaces, testing, segregation of duties, deployment, and post-implementation stabilization. Experience with ServiceNow and Microsoft Dynamics 365 Finance and Operations (FinOps) and Project Operations (Proj Ops) is preferred.

Key Responsibilities

Audit Liaison & Assurance Support

· Serve as IT’s central liaison for internal audits, external audits, SOX testing, and other assurance reviews involving enterprise applications, infrastructure, cybersecurity, IT operations, and technology-enabled business processes.

· Coordinate audit planning, walkthroughs, interviews, evidence requests, sample selections, demonstrations, and follow-up activities with control owners and subject-matter experts.

· Maintain an organized audit request inventory, ownership matrix, due dates, evidence status, open questions, and escalation path to support accurate and timely responses.

· Perform quality reviews of evidence before submission to confirm completeness, accuracy, relevance, appropriate period coverage, and alignment to the control description and test request.

· Help translate audit observations into clear technology, process, risk, and business-impact language for IT leaders and control owners.

· Build productive working relationships with auditors while protecting data confidentiality, maintaining document control, and ensuring responses are factual and appropriately approved.

Sarbanes-Oxley & IT Control Program Support

· Support the IT SOX program covering financially relevant systems, supporting technologies, interfaces, reports, data, and business processes.

· Coordinate and evaluate IT general controls, including security provisioning, privileged access, user access reviews, segregation of duties, change management, computer operations, backup and recovery, inter-system interface monitoring, and incident management.

· Support computerized controls, configurable application controls, interface controls, key reports, spreadsheet-dependent controls, and information produced by the entity (IPE) used in financial reporting processes.

· Facilitate control-owner walkthroughs; maintain process narratives, flow diagrams, risk and control matrices, control procedures, evidence standards, and testing support documentation.

· Assess control design and operating evidence, identify gaps or inconsistent execution, and work with owners to strengthen sustainable controls without creating unnecessary operational burden.

· Monitor control performance, exceptions, deficiencies, compensating controls, remediation plans, and management actions; escalate overdue or high-risk matters through established governance channels.

· Support annual scoping and change-impact assessments for new systems, significant enhancements, integrations, organizational changes, vendor transitions, and evolving financial processes.

System Implementation & SDLC Audit Readiness

· Provide risk and control support for major system implementations, upgrades, migrations, integrations, and transformation programs from initiation through post-go-live stabilization.

· Participate in project governance and SDLC quality gates to confirm that financial reporting, security, access, privacy, data, auditability, records retention, and control requirements are identified and traceable.

· Review control-relevant project artifacts, including business and technical requirements, solution designs, role designs, segregation-of-duties analyses, interface specifications, data migration, conversion plans, user acceptance testing, test documentation, defect disposition, deployment approvals, and support-transition documentation.

· Assess whether implementation controls address configuration, master data, opening balances, data conversion completeness and accuracy, interfaces, workflow approvals, key reports, reconciliations, and cutover activities.

· Coordinate audit participation in projects and maintain an implementation assurance plan that identifies key risks, required evidence, decision points, owners, and readiness criteria.

· Support post-implementation reviews and stabilization monitoring to confirm control operation, evidence retention, ownership transfer, and closure of implementation-related risks.

Control Monitoring, Deficiency Management & Continuous Improvement

· Maintain a consolidated view of control issues, audit findings, management action plans, risk acceptance decisions, target dates, dependencies, and validation evidence.

· Facilitate root-cause analysis and development of practical remediation plans that address both the immediate exception and the underlying process or technology weakness.

· Independently validate remediation evidence and readiness for auditor retesting; document residual risks and unresolved conditions accurately.

· Develop dashboards and concise leadership reporting covering audit readiness, evidence timeliness, control execution, exception trends, remediation aging, project assurance status, and emerging risks.

· Identify opportunities to standardize evidence, automate recurring control activities, improve preventive controls, reduce manual effort, and increase traceability across platforms and processes.

· Promote a control-conscious culture through practical guidance, templates, training, office hours, and coaching for control owners and project teams.

Platform & Business Process Support

· Support control design and audit evidence for ServiceNow workflows and records used in change, incident, problem, request, configuration, access, security, asset, risk, compliance, and audit-support processes, as applicable.

· Support control design and audit readiness for Microsoft Dynamics 365 Finance and Operations and Project Operations, including security roles, segregation of duties, workflows, financial configuration, interfaces, data conversion, reports, batch processing, and project accounting processes.

· Partner with Finance, Accounting, project controls, application teams, cybersecurity, identity and access management, infrastructure, data, integration, and service-management teams to connect technology controls to end-to-end business processes.

· Coordinate with third-party application and service providers to obtain relevant assurance reports, control evidence, complementary user entity control support, and remediation updates.

Required Skills & Competencies

Audit, Risk & Control Expertise

· Strong working knowledge of SOX requirements, IT general controls, automated and application controls, key reports, IPE, and technology risks affecting financial reporting.

· Ability to interpret control objectives, assess design, evaluate evidence, recognize exceptions, and communicate deficiencies with precision and sound judgment.

· Knowledge of common control and governance frameworks such as COSO, COBIT, NIST, ISO 27001, ITIL, or equivalent practices.

· Understanding of third-party assurance reports and complementary user entity controls, including thei