Government and Infrastructure-Risk Consulting-Enterprise Risk. Controls & Resilience Manager

EY•Huntsville, AL

9d•$111,600 - $232,700•Hybrid

About The Position

Ernst & Young LLP’s Government & Infrastructure Risk Consulting practice supports Federal, State, Local and Education clients in managing risks that affect mission outcomes, financial performance, operations and public trust. The Enterprise Risk, Controls & Resilience team helps government organizations govern risk, strengthen controls and maintain resilience. Its work includes internal controls management, internal audit, integrated and enterprise risk management, enterprise resilience, third-party risk management, and ethics and regulatory compliance. The team uses AI, data analytics and Governance, Risk, and Compliance platforms to improve risk identification, assessment, monitoring and management. As a Risk Consulting Manager, you may serve one or more government agencies as primary clients. You will lead engagements or major workstreams, own engagement quality and economics, develop staff, and help grow the practice by shaping offerings, building client relationships and leading pursuits. The role may involve work at client, EY and/or contractor sites. EY aims to assign professionals to projects within a commutable distance of their work-location office; travel may be required based on client and project needs, averaging 25% to 30% or more. The position is hybrid.

Requirements

Bachelor’s or master’s degree in Accounting, Finance, Business Administration, Economics, Risk Management, Public Administration or a related discipline.
At least 5 years of relevant experience in internal audit, internal controls, OMB Circular A-123, financial statement audit, audit readiness and control remediation, enterprise risk management, third-party or vendor risk management, compliance or resilience.
Demonstrated experience managing engagements or workstreams, including budgets and teams, and contributing to proposals or business development.
A U.S. certification in at least one of the following: CPA, CIA, CGFM, CDFM, CA, CMA, RIMS-CRMP, FRM, CTPRP or CBCP.
U.S. citizenship and ability to obtain and maintain a Secret clearance or higher.
Willingness to travel on average 25% to 30% or more in a hybrid environment, with travel determined by client and project needs.
Understanding of internal control and risk frameworks such as the GAO Green Book, COSO Internal Control, COSO ERM and OMB Circular A-123, including control testing and risk and control self-assessment.
Understanding of enterprise risk concepts, including risk identification, risk appetite and tolerance, key risk indicators, scenario analysis, third-party risk and business continuity planning.
Knowledge of federal business processes or comparable state, local and education processes.
Knowledge of working paper documentation and internal audit standards, such as IIA Global Internal Audit Standards and GAGAS.
Deep knowledge of third-party risk management practices and ability to design operating models and maturity roadmaps.
Experience conducting resilience activities such as business impact analyses, critical process identification, dependency mapping, scenario analysis, tabletop exercises, recovery testing, and resilience assessments and roadmaps.
Strong report-writing skills to communicate findings and recommendations.
Excellent communication skills, including discussing observations and negotiating acquisition of data for testing and internal controls reporting.
Project and people management skills, including experience leading blended teams that use onshore delivery centers.
Ability and willingness to supervise and develop team members.
Ability to research regulatory guidance, industry standards and trends, legislation and requirements.
Knowledge of effectively leveraging firm-approved AI tools to improve problem-solving and productivity, with sound judgment about AI-related risks and considerations.
Ability to assess and articulate evolving AI risks to clients across multiple risk domains, including risks from AI embedded in vendor products and services.

Nice To Haves

Working knowledge of the US Standard General Ledger (USSGL) and Statements of Federal Financial Accounting Standards (SFFAS).
Experience designing or leading ERM, third-party or vendor risk management, compliance, enterprise resilience, business continuity or operational resilience programs, or managed-service controls monitoring.
Experience implementing or configuring third-party risk platforms such as ServiceNow Vendor Risk Management, Archer Third Party Governance, OneTrust or ProcessUnity, and integrating vendor risk intelligence sources such as BitSight or SecurityScorecard.
Familiarity with state internal control and internal audit statutes, including Massachusetts Chapter 647, the New York State Governmental Accountability, Audit and Internal Control Act, Section 215.86 of the Florida Statutes, the Texas Internal Auditing Act and the California State Leadership Accountability Act.
Existing relationships with federal or state agencies and experience pursuing work on government contract vehicles.
PMP or similar project management certification.
Experience delivering large, complex engagements from analysis through implementation, particularly with federal or state agencies.
Experience gained at a Big Four global management consulting firm or a blue-chip company focused on government and the public sector.
Track record of building offerings, leading proposals and expanding client relationships.

Responsibilities

Lead internal controls, internal audit, integrated and enterprise risk management, third-party risk, ethics and regulatory compliance, or enterprise resilience engagements and major workstreams from planning through closure.
Serve as a direct contact for agency leaders, including CFOs, Chief Risk Officers, internal audit leaders and program leaders; report status, manage expectations and resolve issues.
Advise clients on control and risk program design, governance, risk appetite, A-123 and state internal control assessment strategy, audit-readiness roadmaps, internal audit transformation, operating models, compliance programs and resilience programs.
Lead the design, build and operation of third-party risk management programs, including governance, policy, risk appetite, inherent risk tiering, due diligence, contract requirements, ongoing monitoring and offboarding; advise on vendor concentration and fourth-party dependencies.
Manage engagement economics, including budget-to-actuals, contract terms, burn rates, staffing mix, change requests and margin.
Design delivery approaches, including work assigned to the Service Delivery Center, and establish requirements, quality standards and acceptance criteria.
Review and approve deliverables to ensure compliance with EY quality, risk management and working paper documentation standards.
Address difficult conversations with team members and clients professionally and promptly.
Shape offerings, methodologies and accelerators across internal controls, internal audit, ERM, third-party risk, compliance and resilience, including AI-enabled testing, controls monitoring and managed-service assessments; contribute to thought leadership.
Delegate, supervise and review the work of Staff and Seniors, provide timely feedback and career advice, and serve as a formal counselor through coaching and performance reviews.
Recruit, interview and onboard talent.
Identify, shape and qualify opportunities with existing and new clients.
Lead proposal and oral-presentation development with Senior Managers and Partners, including solutions, staffing models, pricing inputs and win themes.
Build account knowledge, including client mission priorities, audit and risk posture, budget cycles, contract vehicles and upcoming needs.