Key roles and responsibilities
Assess the SoD ruleset design (risk definitions; critical, high and medium ratings) and validate the ruleset against the design and build of the roles.
Review the controls design: ECC to S/4 control mapping, ITacross access, change management and operations, and mitigating and compensating controls, including ownership and evidence.
Author the Pillar B assessment report, linking each gap to the related control objective or SOX ITarea and to best practices.
Skills
SAP GRC Access Control ruleset design: business risks, functions, actions and permissions
SOX 404 and ITframeworks; control design principles (COSO)
Mitigating and compensating control design and evidence standards
Reviewing and challenging Big 4 audit and controls deliverables
Minimum experience
10+ years in IT audit, SOX or GRC, including 5+ years on SAP GRC Access Control ruleset and SAP controls design. Big 4 or equivalent background preferred. CISA or CRISC preferred.
Key result areas (KRAs)
Ruleset assessment: Clear view of ruleset completeness and risk ratings
Ruleset-to-role validation: Confirmed alignment between the ruleset and the roles as designed and built
Controls design assessment: ECC to S/4 mapping, ITand mitigating controls assessed for design
Pillar B report: Complete, prioritized report ready for the final readout