• Assess the SoD ruleset design (risk definitions; critical, high and medium ratings) and validate the ruleset against the design and build of the roles.
• Review the controls design: ECC to S/4 control mapping, ITacross access, change management and operations, and mitigating and compensating controls, including ownership and evidence.
• Author the Pillar B assessment report, linking each gap to the related control objective or SOX ITarea and to best practices.
• SAP GRC Access Control ruleset design: business risks, functions, actions and permissions
• SOX 404 and ITframeworks; control design principles (COSO)
• Mitigating and compensating control design and evidence standards
• Reviewing and challenging Big 4 audit and controls deliverables
10+ years in IT audit, SOX or GRC, including 5+ years on SAP GRC Access Control ruleset and SAP controls design. Big 4 or equivalent background preferred. CISA or CRISC preferred.
• Ruleset assessment: Clear view of ruleset completeness and risk ratings
• Ruleset-to-role validation: Confirmed alignment between the ruleset and the roles as designed and built
• Controls design assessment: ECC to S/4 mapping, ITand mitigating controls assessed for design
• Pillar B report: Complete, prioritized report ready for the final readout
