Executive Director, Emerging Risk Assurance

CVS Health•Woonsocket, RI

3d•Onsite

About The Position

We’re building a world of health around every individual — shaping a more connected, convenient and compassionate health experience. At CVS Health®, you’ll be surrounded by passionate colleagues who care deeply, innovate with purpose, hold ourselves accountable and prioritize safety and quality in everything we do. Join us and be part of something bigger – helping to simplify health care one person, one family and one community at a time. Position Summary The Executive Director, Emerging Risk Assurance leads CVS Health’s third-line assurance function over AI, machine learning, intelligent automation, and other emerging risk areas that introduce algorithmic or autonomous decision-making into business processes. Operating within Internal Audit, this role applies rigorous audit methodology to independently assess whether governance and risk management controls over these areas are designed effectively and operating as intended, providing objective assurance to senior leadership and the Audit Committee. This role is distinct from and complementary to Internal Audit’s Digital, Data, Analytics, and Technology (DDAT) Risk-Based Audit function, which provides assurance over established technology domains including cloud infrastructure, cybersecurity, and core IT operations. Where emerging risk extends into those domains, the two teams coordinate to ensure consistent coverage without duplication. This position does not set strategy or govern how AI and emerging solutions are built and deployed. Instead, it provides structured, independent evaluation of those activities, partnering closely with technology, digital, data, compliance, cybersecurity, finance, and risk functions to surface gaps and drive accountability. In addition to formal assurance engagements, this role provides advisory support during the design and implementation of AI governance structures, helping the organization get it right early without Internal Audit assuming management responsibility. While this role does not own management’s AI strategy or first- and second-line execution, it does define Internal Audit’s emerging risk assurance strategy, evidence standards, testing expectations, and reporting approach for AI and emerging risk. The Executive Director also supports the modernization of CVS Health’s IA function by coordinating with the team on the adoption of AI-enabled testing, advanced analytics, and automation into SOX and risk-based audit programs, helping increase coverage, scalability, and the early identification of risk. The ideal candidate is a seasoned audit professional with deep expertise in technology risk and a strong command of AI, machine learning, intelligent automation, and data-driven assurance methods.

Requirements

8+ years prior experience in a relevant technology, accounting or auditing role, including technical business report writing.
Ability to travel up to 10%

Responsibilities

Provide independent assurance over enterprise AI governance activities, validating that AI policies, standards, and procedures are being followed consistently across the organization.
Assess governance structures, risk management frameworks, and accountability mechanisms surrounding the adoption of emerging solutions that introduce autonomous or algorithmic decision-making at scale.
Assess how business process owners validate and rely on AI outputs, review data governance and responsible AI practices including fairness, bias, transparency, safety, robustness, explainability, privacy and security, and human oversight across AI deployments.
Assess controls over third-party AI risk, including named model providers, embedded AI capabilities within SaaS and enterprise platforms, open-source models and library dependencies, and broader AI supply-chain risk.
Build continuous assurance capabilities across AI and emerging risk, establishing repeatable evidence collection across model lifecycle, change management, monitoring, logging, and post-deployment oversight to enable ongoing rather than point-in-time coverage.
Work across enterprise segments and partner with first- and second-line teams to drive consistency in evidence readiness, control documentation, and remediation accountability.
Provide advisory support to the AI Governance Council and technology teams during the design and implementation of new use cases and governance structures, ensuring Internal Audit adds value early without assuming management responsibility.
Serve as Internal Audit’s subject matter resource on emerging risk, providing technical context and risk framing to audit teams across the function.
Coordinate with the DDAT Risk-Based Audit team when emerging risk findings extend into established technology domains such as cloud, cybersecurity, or core IT operations, ensuring aligned coverage without duplication.
Report audit findings, risk themes, control gaps, and remediation status to the VP of Internal Audit, Chief Audit Executive, and Audit Committee through structured reporting cadences.
Partner with internal technology teams on the integration of AI-enabled testing, continuous monitoring, and advanced analytics into SOX and risk-based audit programs.
Provide subject matter input on emerging risk considerations as new AI tools and automation are adopted within IA, including model risk, change management, and human-in-the-loop oversight.
Lead audits of high-risk AI models and enterprise AI tools that have direct implications for financial reporting, operational controls, or regulatory compliance.
Assess AI-related changes to the SOX control environment across two workstreams: one-time SDLC controls governing the design, development, and deployment of AI solutions, and ongoing operating controls governing post-deployment monitoring, model drift, change management, and human-in-the-loop oversight.
Coordinate with IA leadership to ensure Internal Audit’s own use of AI is subject to appropriate governance and documentation standards, preserving audit independence.
Track remediation efforts for emerging risk audit findings, confirming timely and effective completion of corrective actions.
Lead, develop, and inspire the Emerging Risk Assurance team, building a high-performance culture grounded in technical rigor, intellectual curiosity, and continuous learning.
Attract and develop talent that combines strong depth in AI, machine learning, and intelligent automation with disciplined audit methodology and sound professional judgment.
Communicate audit results clearly and credibly to both technical and non-technical stakeholders, translating complex risk into actionable business insights.
Build trusted working relationships with the AI Governance Council, technology leadership, the IT Risk-Based Audit team, compliance, and business partners while preserving audit independence.
Uphold Internal Audit standards and operational requirements, ensuring quality, consistency, and integrity across all assurance activities.