Manager, IT Audit & IT General Controls (ITGC)

About the Role

PKF-CAP LLP is seekingan experienced Manager, IT Audit & IT General Controls (ITGC) tosupport our Audit & Assurance practice in the assessment of technologyrisks and controls relevant to financial-statement audits.

This is a hands-onmanager role with two key responsibilities:

1. Lead and deliver IT audit and ITGC work supporting financial-statement audits, working closely with audit engagement teams and clients; and
2. Help develop PKF-CAP’s IT audit capability, including methodologies, standardised audit programmes, templates, training and technology-enabled ways of working.

The successful candidateshould be able to go beyond identifying IT control exceptions. You should becapable of assessing what an IT deficiency means for the financial-statementaudit, including its impact on reliance, relevant business processes,financial-statement risks and the audit team's response.

The role reportsdirectly to the Audit Partners and provides an opportunity to play a meaningfulpart in the continued development of PKF-CAP's audit and technology assurancecapabilities.

Key Responsibilities

1. ITGC andFinancial-Statement Audit Support

Lead IT audit workacross financial-statement audit engagements, including:

• Plan the IT audit approach and determine an appropriate scope based on the client's technology environment and the financial-statement audit strategy.
• Understand clients' business processes, IT architecture, applications, databases, infrastructure and relevant technology risks.
• Perform and supervise ITGC walkthroughs, risk assessments and testing.
• Evaluate the design, implementation and operating effectiveness of IT controls relevant to financial reporting.
• Identify IT risks and control deficiencies and assess their implications for the financial-statement audit.
• Work closely with financial audit teams in determining the appropriate audit response where IT controls cannot be relied upon.
• Prepare clear, complete and review-ready IT audit documentation.
• Review work performed by junior team members and provide coaching and technical guidance.
• Communicate IT control observations, deficiencies and recommendations to client management and engagement teams.
• Support Audit Partners and engagement managers on complex IT audit matters.

2. ITGC TechnicalCoverage

The Manager is expectedto be comfortable assessing key ITGC and technology-control areas, including:

Access Management

• User access provisioning, modification and termination
• Periodic user access reviews
• Authentication controls
• Segregation of duties considerations
• Privileged and administrative access
• Service and system accounts, where relevant

Program and ChangeManagement

• Application and system changes
• Development, testing and approval controls
• Deployment and migration controls
• Emergency changes
• Developer access to production environments

IT Operations

• Job scheduling and batch processing
• Incident and problem management
• Backup, restoration and recovery controls
• Monitoring and operational controls

Application andFinancial Reporting Controls

• Application controls
• Automated controls
• System interfaces
• IT-dependent manual controls
• System-generated reports and Information Produced by the Entity (IPE)
• Data completeness and accuracy considerations

Technology Environment

• Major enterprise applications and ERP environments
• Cloud environments and related controls
• Cybersecurity controls relevant to financial reporting and audit risk
• Third-party technology and outsourced service providers
• SOC 1 and SOC 2 reports and relevant complementary controls

3. Enterprise Systems

The role should becomfortable working across a variety of technology environments and shouldideally have practical experience with major enterprise systems such as:

• SAP
• Oracle
• Microsoft Dynamics 365
• NetSuite
• Workday
• Other widely used ERP, financial reporting and business applications
• Major cloud environments such as Microsoft Azure and AWS

Deep expertise in everyplatform is not required. More important is the ability to understanddifferent architectures and identify the IT risks and controls relevant to thefinancial-statement audit.

4. Audit Integration andProfessional Judgement

A critical aspect of therole is the ability to connect technology findings to the widerfinancial-statement audit.

The Manager will beexpected to:

• Determine which IT systems, applications and technology processes are relevant to the audit.
• Understand the relationship between IT controls, business-process controls and financial reporting.
• Assess the significance of identified IT control deficiencies.
• Determine the implications of ITGC deficiencies on reliance on automated controls, system-generated information and other technology-dependent audit evidence.
• Work with the financial audit team to determine appropriate alternative or additional audit procedures where necessary.
• Clearly articulate IT audit conclusions in a manner understandable to financial audit professionals and Audit Partners.
• Escalate significant risks and unresolved matters promptly.

The successful candidatetherefore needs to be both an IT auditor and an auditor's IT specialist,rather than approaching ITGC as a stand-alone compliance exercise.

Building PKF-CAP's ITAudit Capability

Beyond individualengagements, the Manager will play an important role in strengthening andscaling PKF-CAP's IT audit capability.

Responsibilities willinclude:

• Develop and enhance standardised ITGC audit programmes and working-paper templates.
• Develop risk assessment, scoping and testing methodologies for common IT environments.
• Establish efficient approaches for recurring ITGC and application-control testing.
• Improve consistency and quality of IT audit documentation across engagements.
• Develop practical guidance for financial audit teams on when and how to involve IT audit specialists.
• Train audit managers, seniors and associates on IT risks and fundamental ITGC concepts.
• Develop reusable knowledge and guidance for common ERP and cloud environments.
• Identify opportunities to use technology, data analytics and automation to improve IT audit efficiency.
• Participate in technical discussions relating to emerging technology risks affecting financial reporting and external audits.
• Contribute to the longer-term development of PKF-CAP's technology assurance and related advisory capabilities.

Candidate Requirements

Essential

• Minimum 5 years of relevant IT audit / ITGC experience, with meaningful experience supporting external financial-statement audits.
• Bachelor's degree in Information Technology, Information Systems, Computer Science, or another relevant discipline.
• CISA qualification.
• Strong practical experience in ITGC risk assessment, walkthroughs, controls testing and evaluation of control deficiencies.
• Experience assessing IT controls over financial reporting and explaining their implications to financial audit teams.
• Practical knowledge of access management, privileged access, change management, IT operations and application controls.
• Experience with system-generated reports/IPE, automated controls and IT-dependent manual controls.
• Good understanding of recognised IT control frameworks such as COBIT.
• Strong understanding of auditing principles relevant to the use and assessment of technology controls in a financial-statement audit.
• Ability to prepare high-quality audit documentation that clearly supports the procedures performed and conclusions reached.
• Ability to manage multiple audit engagements and deadlines.
• Strong analytical and problem-solving capability.
• Strong written and verbal communication skills.
• Ability to communicate technical technology matters clearly to auditors and non-technical client stakeholders.
• Ability to supervise, review and develop junior team members.

Preferred Experience

Candidates will have anadvantage if they have experience in several of the following:

• External audit IT specialist / IT audit experience within an accounting or professional services firm
• SAP, Oracle, Microsoft Dynamics 365, NetSuite or Workday
• Microsoft Azure or AWS environments
• SOC 1 and SOC 2 reporting
• ERP implementations or migrations
• Automated and application controls
• Cybersecurity risks relevant to financial reporting
• Data analytics or technology-enabled auditing
• Developing IT audit methodologies, templates or internal training programmes
• Technology assurance or related advisory engagements

What We Are Looking For

We are particularlyinterested in someone who is:

• Technically credible: Comfortable challenging complex IT environments and client explanations.
• Audit-minded: Understands that the objective is not simply to find an IT exception, but to determine what that exception means for the financial-statement audit.
• Hands-on: Willing and able to perform technical work rather than operating only as a reviewer.
• Commercial: Able to deliver work efficiently while maintaining audit quality.
• A builder: Interested in establishing methodologies, templates, training and efficient ways of working rather than simply inheriting an existing process.
• A communicator: Able to translate highly technical findings into clear audit risks, consequences and actions.
• A leader: Capable of developing junior staff and working effectively with audit partners, managers, engagement teams and clients.
• Curious about technology: Able to keep pace with evolving ERP, cloud, cybersecurity, automation and emerging technology risks.

Why Join PKF-CAP?

This role provides anopportunity to do more than execute ITGC testing.

The successful candidatewill have the opportunity to work directly with Audit Partners, support a broadportfolio of financial-statement audits, and play an active role in shaping howPKF-CAP approaches IT audit.

For someone who enjoysbuilding as well as auditing, the role offers scope to influence methodology,people development, technology adoption, audit efficiency and the futuredevelopment of technology assurance services.