SOX Compliance Test Assurance Lead

Role Description

Role Purpose

The SOX Compliance Test Assurance Lead is responsible for providing independent assurance over the design, implementation, testing, and operation of technology controls supporting Sarbanes-Oxley (SOX) compliance requirements.

The role acts as the primary oversight function for work delivered by System Integrator (SI) and project teams, ensuring that technology solutions are implemented proportionately, effectively, and in line with regulatory expectations, organisational control frameworks, and audit requirements.

The position focuses on IT General Controls (ITGCs), IT Application Controls (ITACs), automated controls, security controls, and ERP-related compliance requirements, rather than business process controls.

The role provides constructive challenge and assurance throughout project life cycles to ensure compliant-by-design implementations and sustainable operational controls.

Key Responsibilities

SOX Compliance Assurance

Provide independent assurance over technology controls implemented as part of transformation, ERP, cloud, and digital programmes.

Review and challenge the design of SOX-relevant technology controls to ensure alignment with regulatory requirements and internal control standards.

Assess the effectiveness of IT General Controls (ITGCs), including:

User Access Management

Privileged Access Management

Segregation of Duties (SoD)

Change Management

System Development Lifecycle (SDLC)

Computer Operations

Interface and Batch Processing Controls

Review Automated Application Controls (ITACs) and system-enforced controls within enterprise applications.

Ensure evidence generated by implemented controls will withstand internal and external audit scrutiny.

System Integrator Oversight

Act as the independent assurance representative overseeing system integrator compliance activities.

Review deliverables produced by implementation partners, ensuring controls are appropriately designed, documented, tested, and Embedded.

Challenge implementation approaches that introduce unnecessary complexity, compliance risks, or control weaknesses.

Validate that control designs are proportionate to the identified risks and support efficient ongoing operations.

Monitor delivery quality against agreed compliance, risk management, and governance standards.

Testing and Validation

Review control testing strategies, methodologies, and execution plans.

Assess the adequacy of testing performed by system integrators and project teams.

Validate test results and supporting evidence.

Identify deficiencies, control gaps, and remediation requirements.

Provide assurance sign-off for technology control readiness before deployment and key project milestones.

Support management assessments required for SOX certification processes.

Risk and Controls Governance

Maintain alignment with SOX, internal audit, external audit, information security, and enterprise risk management requirements.

Participate in design authority, architecture review boards, and governance forums to provide compliance oversight.

Ensure control requirements are incorporated early in project life cycles.

Escalate significant control deficiencies and implementation risks to programme leadership.

Support the development and maintenance of technology control frameworks, standards, and assurance methodologies.

Stakeholder Management

Act as the primary liaison between technology teams, compliance functions, internal audit, external auditors, and system integrators.

Provide expert guidance on SOX technology control requirements.

Influence project decision-making through credible and evidence-based assurance assessments.

Prepare and present assurance findings, recommendations, and executive-level status reports.

Key Deliverables

• Technology Control Assurance Assessments
• SOX Readiness Reviews
• Control Design Reviews
• Test Assurance Reports
• Deficiency and Remediation Assessments
• Go-Live Compliance Readiness Sign-Offs
• Audit Support Documentation
• Risk and Controls Dashboards
• Executive Assurance Reporting

Required Experience

Essential

Significant experience in SOX compliance, IT audit, risk assurance, or technology controls.

Experience providing independent assurance over large-scale technology transformation programmes.

Hands-on knowledge of IT General Controls (ITGCs) and Automated Application Controls (ITACs).

Experience reviewing and challenging deliverables from System Integrators and third-party implementation providers.

Understanding of ERP platforms such as SAP and Oracle or similar enterprise systems.

Experience supporting internal and external audit activities.

Strong understanding of risk-based control design and testing methodologies.

Desirable

Experience in cloud environments (Azure, AWS, Google Cloud).

Experience within financial reporting and regulated environments.

Experience with GRC tools and compliance monitoring platforms.

Understanding of cybersecurity controls and identity management solutions.

Experience supporting ERP transformations or finance modernization programmes.

Technical Knowledge

• Sarbanes-Oxley (SOX) compliance requirements
• IT General Controls (ITGCs)
• IT Application Controls (ITACs)
• Segregation of Duties (SoD)
• Access Management and Privileged Access Controls
• Change Management and SDLC Controls
• ERP Security and Configuration Controls
• Risk and Control Frameworks
• Technology Governance and Assurance
• Control Testing Methodologies
• Internal and External Audit Practices

Key Skills

• Independent assurance and challenge
• Risk assessment and control evaluation
• Stakeholder management
• Audit and compliance expertise
• Analytical and investigative thinking
• Report writing and executive communication
• Problem-solving and decision-making
• Influencing without direct authority
• Attention to detail
• Programme governance experience

Success Measures

The role will be successful when:

Technology controls are implemented in compliance with SOX requirements.

System integrator deliverables meet agreed control and quality standards.

Control deficiencies are identified and remediated before audit or go-live activities.

External and internal auditors can place reliance on implemented controls and testing evidence.

Technology implementations achieve a proportionate balance between compliance, risk mitigation, operational effectiveness, and delivery efficiency.

Regulatory, audit, and management assurance expectations are consistently met.