Risk and Compliance / Risk & Controls Governance Analyst

About the role

EY's Enterprise Technology Risk & Compliance (ETRC) team, within its Finance Governance function, is looking for a Supervising Associate to lead the operational governance of the Finance risk and control matrix. Reporting to the Risk & Controls Governance Lead, the role maintains the Finance control inventory, leads control design and impact assessments, coordinates control changes and provides risk and control input to Finance technology transformation initiatives.

Key responsibilities

• Maintain the Finance risk and control matrix and control inventory, aligned with the ETRC RACM methodology, taxonomy and governance requirements.
• Maintain Finance risk-to-control mappings covering applications, processes, risks, controls, ownership, access, vendors and technology dependencies.
• Coordinate control additions, updates and removals with control owners, Operations & Reporting and Assurance & Compliance stakeholders.
• Prepare RACM and ISQM updates reflecting approved control design activities.
• Assess application, process and technology changes for new or updated controls, including IT general controls, SDLC controls, interfaces, access and segregation of duties.
• Lead control rationalization and impact assessments, and manage the design and readiness of new or updated controls.
• Support the annual ET controls certification cycle, review exceptions and track remediation.
• Provide control gap analysis and governance input to strategic Finance technology initiatives.
• Monitor control ownership changes, identify recurring control themes and work with the Non-Finance RACM role and other ETRC pillars.

Required profile

• Bachelor's degree in Information Technology, Business, Accounting, Finance, Risk Management or a related discipline, or equivalent experience.
• Minimum 6 years of experience in technology risk, internal controls, IT audit, compliance, risk and control matrix management or a related field.
• Demonstrated experience maintaining RACMs, performing control design or impact assessments and documenting control activities.
• Experience coordinating control owners and senior stakeholders across technology, risk, audit, information security and business functions.

Required skills

• Strong understanding of IT general controls, SDLC, access management, interfaces and segregation of duties.
• Preferred: experience with Finance technology platforms, SAP environments, ERP transformation and large-scale technology programs.
• Preferred: proficiency with Microsoft 365, SharePoint, Power BI and collaboration platforms; GRC or RACM tool experience preferred.
• Certifications such as CISA, CRISC, CISM, CIA, CPA, ACCA or similar are a plus.