SOX & Internal Controls Analyst

Location: South Africa

Department: Merchant Division - Finance

Reports to: Senior Manager: SOX & Internal Controls

• Purpose of the Role

The SOX & Internal Controls Analyst will support the documentation, monitoring, management testing and remediation of the Lesaka Merchant SOX and internal controls framework.

The role works closely with the Senior Manager: SOX & Internal Controls, Finance teams, business process and control owners, Group SOX, Internal Audit and external audit. The Analyst will understand how processes operate, obtain and assess evidence, perform walkthroughs and management testing, identify and escalate exceptions, maintain control documentation and monitor remediation through to closure.

The role is a development position intended to build Merchant's internal controls capability over time. The Analyst will take increasing responsibility for assigned SOX workstreams while business management retains ownership of the underlying processes and controls.

• Scope

• The role supports the South African operations of the Lesaka Merchant Division.
• Scope extends to common, centralised and divisional controls that also operate over the Division's international operations, including shared entity-level controls, common ITGCs and application controls, centralised close, consolidation and reporting controls, and shared master data and user access processes.
• Scope extends to businesses acquired into or transferred within the Division, including support for control documentation and integration into the Merchant SOX programme.
• The role operates as a first-line function. It supports control documentation, monitoring, testing and remediation but does not perform, approve or own business controls.

• SOX Documentation

• Prepare and maintain risk and control matrices, process narratives, process flowcharts and control descriptions under the direction of the Senior Manager.
• Maintain control-owner registers, walkthrough and testing documentation, remediation trackers and evidence repositories.
• Perform quality checks to confirm that documentation is accurate, current and reflects actual business processes, and escalate identified gaps.

• Walkthroughs

• Support and document process walkthroughs with control owners, including how transactions originate, the systems used, relevant financial reporting risks, key controls and supporting evidence.
• Document control ownership, performance, review and exception-management arrangements, and identify where documented processes differ from actual practice.
• Escalate control gaps, inconsistencies and potential changes in financial reporting risk identified during walkthroughs.

• Control Testing

• Perform risk-based management testing of control design, implementation and operating effectiveness under the direction of the Senior Manager.
• Perform assigned testing procedures, including population and sample validation, evidence inspection, re-performance, inquiry, observation and exception identification.
• Assess management review controls, including their level of precision, and evaluate relevant completeness and accuracy controls over information used in control performance.
• Perform testing allocated through the approved testing plan and maintain appropriate objectivity where the Merchant SOX team has assisted with control design or remediation.
• Promptly disclose any involvement in the design or remediation of an assigned control so that testing can be appropriately evaluated or reallocated.
• Prepare clear, accurate and appropriately supported testing workpapers for Senior Manager review and potential use by Group SOX, Internal Audit or external audit.02

• Remediation Support

• Maintain the SOX remediation tracker and obtain regular progress updates from accountable business owners.
• Collect and assess implementation evidence and flag actions that are not supported by evidence that the revised process or control has been implemented.
• Identify overdue actions, perform timely follow-ups, escalate delays to the Senior Manager and support risk-based post-remediation monitoring.
• Prepare remediation evidence and preliminary validation results for Senior Manager review and the applicable closure process.

• Evidence Management

• Coordinate evidence collection across Merchant and check that evidence is complete, appropriately dated, clearly linked to the relevant control and retained in the designated repository.
• Perform evidence quality checks and escalate deficiencies before submission for further review or testing.
• Identify weak or incomplete evidence early and support control owners in understanding the evidence requirements without preparing or performing the control on their behalf.

• Audit Coordination

• Support the coordination and timely resolution of Group SOX, Internal Audit and external audit requests.
• Maintain information-request trackers, including accountable owners, deadlines, submission status, outstanding queries and closure status.
• Coordinate meetings and walkthroughs and follow up on requested information before agreed deadlines.

• SOX Reporting

• Maintain complete and accurate data supporting the Merchant SOX dashboard and status reporting.
• Track open and overdue findings, management testing, control failures, remediation progress, outstanding information requests and recurring matters.
• Prepare periodic status reporting and analysis for review by the Senior Manager.

• Process Improvement

• Identify potential control gaps, inefficient manual activities, duplicate controls, missing approvals, segregation-of-duties concerns, weak evidence and inconsistent practices.
• Identify opportunities for system-enabled controls, standardisation and more efficient and sustainable control execution.
• Support the analysis and resolution of control problems while ensuring that accountable business owners approve and implement process and control changes.

• Control Owner Support

• Support control owners in understanding control requirements, performance frequency, review responsibilities and escalation expectations.
• Provide guidance on evidence retention and exception-documentation requirements.
• Provide approved templates, examples and guidance to support consistent control execution without assuming ownership of the control.

• Candidate Profile

• BCom Accounting, BCom Internal Audit, BCom Finance or an equivalent relevant degree.
• Progress toward a relevant professional qualification such as CA(SA), CIA or CISA will be advantageous.
• Approximately two to three years of relevant experience in external audit, internal audit, SOX, risk, internal controls, finance controls or related assurance work.
• Big Four or large audit firm experience is advantageous but not required.
• Exposure to financial services, fintech, payments or high-volume transaction environments is advantageous.

• Technical Skills

• Understanding of financial statement assertions, financial reporting risks, risk and control matrices, process walkthroughs, control design, implementation and operating effectiveness.
• Working knowledge of risk-based testing, population and sample validation, reconciliations, management review controls, segregation of duties, ITGC concepts, information used in controls and audit evidence.
• Strong Excel skills are required. Power BI, Visio or process mapping tools, and GRC or SOX platform experience are advantageous.

• Personal Characteristics

• Highly organised and disciplined in completing follow-ups and maintaining accurate records.
• Comfortable with detail while able to understand the underlying process and risk.
• Analytically strong, curious and willing to raise appropriate challenge.
• Confident working across Finance, Operations and Technology and able to engage stakeholders professionally.
• Able to distinguish evidence from explanation and focused on supporting practical, sustainable improvement.

• Development Path

The role is intended to build Merchant's future internal controls capability. Potential progression may include Senior Analyst, Specialist or Manager-level opportunities, subject to organisational requirements, performance and demonstrated capability. Progression will involve increasing responsibility for assigned SOX workstreams; ownership of business processes and controls remains with accountable management.