SAP GRC Consultant/Architect || Remote

GRC and Controls Lead

Key roles and responsibilities

•      Assess the SoD ruleset design (risk definitions; critical, high and medium ratings) and validate the ruleset against the design and build of the roles.

•      Review the controls design: ECC to S/4 control mapping, ITacross access, change management and operations, and mitigating and compensating controls, including ownership and evidence.

•      Author the Pillar B assessment report, linking each gap to the related control objective or SOX ITarea and to best practices.

Skills

•      SAP GRC Access Control ruleset design: business risks, functions, actions and permissions

•      SOX 404 and ITframeworks; control design principles (COSO)

•      Mitigating and compensating control design and evidence standards

•      Reviewing and challenging Big 4 audit and controls deliverables

Minimum experience

10+ years in IT audit, SOX or GRC, including 5+ years on SAP GRC Access Control ruleset and SAP controls design. Big 4 or equivalent background preferred. CISA or CRISC preferred.

Key result areas (KRAs)

•      Ruleset assessment: Clear view of ruleset completeness and risk ratings

•      Ruleset-to-role validation: Confirmed alignment between the ruleset and the roles as designed and built

•      Controls design assessment: ECC to S/4 mapping, ITand mitigating controls assessed for design

•      Pillar B report: Complete, prioritized report ready for the final readout