Director, Internal Audit (Information Technology)

Purpose of the Job

The Director, Internal Audit IT will be responsible for leading the risk assessment, control identification, documentation, testing, findings and recommendation process for various Information Technology audits across the Bank, with a focus on Cyber Security and Artificial Intelligence. The incumbent will also be responsible for developing and implementing audit coverage for new technology systems/applications in line with the Bank’s strategic initiatives. This may involve auditing of certain Bank projects. Notably, the role is expected to be provide expert-level knowledge of current financial services information technology control expectations with respect to the Bank’s IT Operations and Cyber Security practices for a mainly Digital Banking cloud-based environment.

The core parts of your role would be to:

Independently develops and implements audit coverage of IT Technology processes and develops effective coverage of new technology implemented by the Bank - 60 %

• Taking into account the Bank’s IT policies, established technology control frameworks (ITIL and NIST), and applicable regulatory expectations, the incumbent will create audit programs for the Bank’s technology processes which include:
• Technology applications which support the bank’s business lines including: retail and commercial lending, credit cards, Trust and Digital Banking deposit products.
• Technology infrastructure
• Cyber Security
• Cloud Technology
• Artificial Intelligence
• • Responsible for executing the end-to-end audit engagement process: commences with the development of an audit plan, followed by identification of risks, assessment/testing of the adequacy of associated internal controls, and development of conclusions based on audit testing.
  • Draft audit reports at the conclusion of each audit for submission to the Chief Auditor
  • Maintain ongoing awareness of applicable regulatory requirements, and the Bank’s strategic initiatives and industry developments in order to ensure audit work is relevant and value-added. This may include monitoring or auditing large-scale technology projects.
  • Follow-up and report on adequacy of management actions to resolve audit findings and report progress to the Chief Auditor on an ongoing basis.

Risk Assessment -25%

• Maintain up-to-date knowledge of regulatory expectations, the Bank’s strategic initiatives, significant technology process changes, and industry developments related to the Bank’s technology practices. Incorporate into audit coverage as required.
• Provide consulting advice on Bank policies/projects related to Technology controls.
• Develop a Risk and Control assessment for each individual audit engagement to guide the development of each audit program.
• The position will be required to take into consideration the size and complexity of the Bank when conducting risk assessments and in developing audit observations as a result of audit testing.
• Maintains an awareness of key strategic technology projects initiated by management and identifies potential change management risks which may be associated with management initiatives.
• Effectively communicates risks to all levels, including Senior Management across the Bank, both verbally and orally, in a concise manner tailored to the audience level.

Relationship Management/Communication - 15%

• Maintain positive working relationships with Senior Management of Information Technology units and IT control functions to ensure effective communication flow throughout the audit engagement process; maintain ongoing awareness of Senior Management’s concerns and any emerging risks.
• Able to influence senior management with respect to acceptance of key findings and/recommendations.
• Keep the Chief Auditor informed of the status of key risks or findings identified during the audit.
• Commit to ongoing professional development by completing 40 training hours per year.
• Share knowledge of areas of expertise with other members of the Internal Audit team in order to provide cross-training.

Let’s Talk About You!

• Post-secondary degree with a specialised IT designation is required (e.g. CISA, CISSP)
• 10+ years’ proven experience in a financial institution information technology audit role (senior manager or above).
• Knowledge of Data Analytics, and Artificial Intelligence practices and controls is an asset.
• Expert knowledge of ITIL and NIST control frameworks.
• Proven experience of independently auditing IT infrastructure, cyber and application environments.
• Expert knowledge of applicable regulatory requirements; including OSFI Cybersecurity expectations.
• Strong level of previous experience auditing technology projects/strategic initiatives.
• Proven excellent written and verbal communication skills, ability to communicate with both a technical and non-technical audience. Ability to break down complex subject matter into concise points for purposes of communicating audit findings.
• Ability to influence and impact Senior Management with respect to accepting/implementing recommendations related to identified control issues.
• Excellent effective organizational, time management and project management abilities; including the ability to manage multiple priorities (and potentially other staff resources) within deadlines.
• Ability to work independently and perform under pressure and within tight time constraints.
• Consistently continues to develop/maintain broad knowledge and awareness of the financial industry, risk management practices and regulatory and/or policy changes.