SAP GRC and Controls Lead

GRC and Controls Lead Remote         Key roles and responsibilities •      Assess the SoD ruleset design (risk definitions; critical, high and medium ratings) and validate the ruleset against the design and build of the roles. •      Review the controls design: ECC to S/4 control mapping, ITacross access, change management and operations, and mitigating and compensating controls, including ownership and evidence. •      Author the Pillar B assessment report, linking each gap to the related control objective or SOX ITarea and to best practices. Skills •      SAP GRC Access Control ruleset design: business risks, functions, actions and permissions •      SOX 404 and ITframeworks; control design principles (COSO) •      Mitigating and compensating control design and evidence standards •      Reviewing and challenging Big 4 audit and controls deliverables Minimum experience 10+ years in IT audit, SOX or GRC, including 5+ years on SAP GRC Access Control ruleset and SAP controls design. Big 4 or equivalent background preferred. CISA or CRISC preferred. Key result areas (KRAs) •      Ruleset assessment: Clear view of ruleset completeness and risk ratings •      Ruleset-to-role validation: Confirmed alignment between the ruleset and the roles as designed and built •      Controls design assessment: ECC to S/4 mapping, ITand mitigating controls assessed for design •      Pillar B report: Complete, prioritized report ready for the final readout