Director of Internal Audit Services

Tompkins Community Bank

About The Position

The Director of Internal Audit Services (IAS) leads the Bank’s internal audit function, providing independent assurance on the effectiveness of internal controls, risk management, and governance. Reporting functionally to the Audit Committee Chair and administratively to the Chief Risk Officer, the Director develops and executes a risk‑based annual audit plan aligned with regulatory expectations and organizational priorities. The role oversees audit planning, fieldwork quality, staff development, and the use of co‑sourced or outsourced audit resources. The Director also manages Sarbanes‑Oxley Section 404 testing, supports state and federal examinations, and delivers clear, timely reporting to the Audit Committee and senior leadership. This position ensures a strong control environment and promotes continuous improvement across the Bank.

Requirements

Bachelor’s degree in Accounting, Finance, Business Administration, or a related field required.
Advanced certification strongly preferred (CIA, CPA, CISA, or similar), reflecting industry expectations for audit leaders in financial services.
Minimum of eight (8) years of progressive internal audit or financial services audit experience, with substantial exposure to banking operations, risk management, compliance, and regulatory expectations.
At least three (3) years of direct management or leadership experience within an internal audit function, ideally within the banking or financial services industry.
Demonstrated experience developing and executing risk‑based audit plans in accordance with IIA Standards and FFIEC guidance.
Experience coordinating or overseeing outsourced/co‑sourced audit engagements (e.g., IT audit, cybersecurity, loan review).
Strong experience supporting state and federal regulatory examinations and working directly with regulators, including OCC, FDIC, FRB, or state banking agencies.
Proven experience managing SOX 404 testing, internal control evaluations, and audit-quality requirements.
Advanced knowledge of internal auditing standards, including the IIA International Professional Practices Framework (IPPF).
Strong understanding of banking operations, risk management frameworks (e.g., COSO), and key regulatory requirements applicable to financial institutions.
Knowledge of Sarbanes‑Oxley (SOX 404), model risk management expectations, information security controls, and financial reporting requirements.
Experience with audit technologies, analytics, and Computer-Assisted Auditing Techniques (CAATs).
Strong leadership, coaching, and team‑development skills, with an ability to influence and collaborate across all levels of the organization.
Exceptional written and verbal communication skills, including experience presenting to Board or Board‑level committees.
Ability to manage multiple priorities, lead complex initiatives, and make sound, data‑informed decisions.
High degree of professional judgment, integrity, and independence.
Ability to work in a fast‑paced, highly regulated environment with evolving expectations.
Commitment to continuous improvement, innovation, and best practices within the internal audit function.

Nice To Haves

Master’s degree in Business, Accounting, Finance, or related field preferred.

Responsibilities

Develop and maintain an annual risk‑based Internal Audit Plan using a formal risk assessment and aligned with IIA Standards, FFIEC guidance, SOX 404 requirements, and the Bank’s enterprise risk profile.
Ensure timely execution of audits across operational, financial, technology, credit, and compliance functions.
Update Internal Audit policies and procedures to reflect industry standards and regulatory expectations.
Oversee audit planning, fieldwork, documentation, and reporting to ensure compliance with the Institute of Internal Auditors (IIA) International Professional Practices Framework (IPPF) and internal quality standards.
Review audit workpapers, testing results, and identified issues, providing coaching and direction to ensure high‑quality deliverables.
Implement continuous‑improvement initiatives, including the use of Computer‑Assisted Auditing Techniques (CAATs) and enhancements to testing methodologies.
Oversee and perform periodic quality assurance and self‑assessment activities.
Issue Requests for Proposals (RFPs) for outsourced or co‑sourced audits (e.g., IT, cybersecurity, loan review) and evaluate vendor qualifications, cost‑effectiveness, and alignment with audit scope.
Manage contracts, schedules, deliverables, and communication with external audit service providers.
Ensure effective integration of outsourced audit results into the overall audit plan and reporting.
Manage and oversee internal control testing activities performed under Sarbanes‑Oxley Section 404, ensuring full coordination with external auditors and management.
Evaluate internal control effectiveness, identify control gaps, and ensure management develops timely and sustainable corrective actions.
Track and report on all audit findings and corrective action plans to ensure timely remediation.
Serve as a key liaison to state and federal regulators during safety‑and‑soundness exams and other supervisory reviews.
Provide audit documentation, respond to examiner inquiries, and support management in addressing examination findings.
Ensure Internal Audit maintains regulatory readiness and strong working relationships with supervisory agencies.
Oversee department staffing, performance, skill development, and succession planning.
Provide coaching, mentoring, and leadership to ensure staff meet professional and regulatory competency expectations.
Monitor department budget and expenditures, ensuring effective resource allocation and cost‑efficiency.
Conduct year‑end alternative audit procedures for non‑responsive customers and other required checks.
Provide advisory services as appropriate while maintaining independence and objectivity.
Perform additional tasks as requested by executive leadership or the Audit & Risk Committee.