IT Audit Manager

UGI Corporation•Upper Merion Township, PA

About The Position

UGI Corporation’s Internal Audit function provides the Audit Committee and management with objective assurance, advice and insight on the company’s risks, controls and governance, in conformance with The IIA’s Global Internal Audit Standards. The IT Audit Manager leads Internal Audit’s SOX IT controls testing and review, including the use of AI and agentic AI tools to execute and document control testing. The role also leads assurance over major system implementations and enhancements, as well as risk-based IT, cybersecurity and operational technology (OT/ICS) audits across the UGI enterprise. The manager coordinates SOX testing with IT and Business Process audit managers, the SOX management team (ICC) and the external auditor, and works closely with IT and OT leadership, the CISO and co-sourcing partners. The position leads and develops auditors and co-sourced resources, manages engagement quality and budgets, and communicates risk-rated findings and practical remediation recommendations. It also contributes to the annual audit plan, maintains the IT audit universe, and supports the department’s Quality Assurance and Improvement Program.

Requirements

Bachelor’s degree in Information Systems/MIS, Computer Science, Cybersecurity, Computer or Electrical Engineering, or Accounting with an Information Systems concentration.
At least 8 years of progressive IT audit, IT risk or technology assurance experience.
At least 5 years performing and reviewing SOX ITGC and application control testing for SEC registrants.
At least 3 years in a supervisory or manager capacity, including scoping engagements, reviewing work papers and leading staff and/or co-source teams.
Lead or significant role on at least two assurance reviews of ERP or other major financial system implementations or upgrades, including pre- and post-implementation work.
Active CISA certification and at least one additional active credential: CPA, CIA, CISSP, CISM, CRISC, CCSP or GICSP.
Experience performing risk-based audits of core IT functions, including infrastructure, applications, databases, information security and cloud.
Expert practical application of The IIA’s Global Internal Audit Standards, including Topical Requirements, and COSO Internal Control – Integrated Framework (2013); working command of COBIT 2019, NIST CSF 2.0, NIST SP 800-53, ISO/IEC 27001:2022 and CIS Controls.
Deep expertise in testing ITGCs, automated application controls, IPE/key reports, interface controls and segregation of duties/sensitive access, including sound judgment on sampling, evidence sufficiency and work-paper review.
Understanding of SOX scoping and deficiency evaluation and external auditor reliance requirements, including PCAOB AS 2201 and AS 2605.
Ability to read and evaluate configurations, security parameters and role/access designs across Windows and Linux, Active Directory/Entra ID, Oracle and SQL Server databases, ERP and financial applications, and AWS/Azure cloud.
Ability to evaluate change management in Git-based, CI/CD and SaaS release environments and interpret vulnerability scanning, SIEM and identity governance outputs.
Working knowledge of job scheduling, backup and recovery, and network security architecture.
Hands-on ability to design, configure and validate AI- and agent-assisted test procedures and document their accuracy, completeness and audit trail; working knowledge of LLMs, retrieval-augmented generation, tool/API use and agent orchestration, as well as limitations such as hallucination, incomplete extraction, inconsistency and data leakage.
Familiarity with The IIA’s AI Auditing Framework and the NIST AI RMF.
Ability to describe and assess OT architecture, including Purdue levels, IT/OT DMZ and remote access paths; knowledge of common ICS components and protocols, principal cyber and operational risks, OT safety- and availability-first priorities, and relevant standards and regulation.
Knowledge of project governance, agile and waterfall delivery, ERP implementation lifecycles and relevant controls at each phase.
Hands-on SQL and experience with at least one analytics tool or language, such as Python, ACL, Alteryx or IDEA, and visualization with Power BI or Tableau; ability to independently analyze system-generated data, test its completeness and accuracy, and perform testing and continuous monitoring.
Ability to translate complex technical issues into business risk and write and present concise, persuasive conclusions to senior management.
Proven ability to lead teams and co-source partners, manage multiple concurrent engagements on time and within budget, and build credible relationships with technical and non-technical stakeholders.
Ability to travel approximately 5% domestically and internationally and commute to Reading locations on occasion.
Required credentials must be maintained in active status with required CPE.
Successful completion of a background check and drug screen, subject to applicable laws and regulations.

Nice To Haves

Big 4 or national public accounting firm experience.
Master’s degree, such as MSIS, Cybersecurity, Data Science or MBA.
AI audit/governance credential such as ISACA AAIA (Advanced in AI Audit) or IAPP AIGP.
OT/ICS credential such as GIAC GICSP or GRID, or ISA/IEC 62443 Cybersecurity certificate.
Cloud security credential from AWS or Microsoft Azure, or CSA CCSK/CCSP.
Project credential such as PMP or Agile certification (e.g., PMI-ACP or Certified ScrumMaster).

Responsibilities

Lead and review testing of SOX IT general controls and automated application controls, ensuring work meets IIA Standards and SEC requirements and supports external auditor reliance.
Plan and schedule SOX IT testing based on scope and risk; coordinate timing and integrated testing with IT and Business Process audit managers.
Review test plans and work papers for ITGCs, automated application controls, key reports/IPE, interfaces, sampling, evidence sufficiency and conclusions.
Direct the use of AI and agentic AI tools in SOX testing and review AI-generated results with the rigor applied to manually performed work.
Test management’s controls over service organizations, including SOC 1/SOC 2 reports, bridge letters and complementary user entity controls.
Validate test exceptions with control owners, communicate results to ICC and support deficiency evaluation.
Provide independent assurance over major system implementations, upgrades and enhancements from design through stabilization.
Review project governance, requirements, security and role design, segregation of duties, testing, cutover and hyper-care before, during and after implementation.
Assess data migration completeness and accuracy, interface controls and changes to SOX in-scope systems; coordinate scope implications with ICC.
Advise project teams on control design while preserving Internal Audit’s independence and objectivity.
Plan and lead risk-based audits of infrastructure, cybersecurity, cloud, data and OT environments across UGI’s utility, midstream and energy distribution businesses.
Audit cybersecurity program areas including identity and privileged access, vulnerability management, logging and monitoring, incident response, and resilience and recovery.
Audit OT/ICS environments, including SCADA, gas control, DCS/PLCs, historians, remote access, IT/OT segmentation and asset inventory.
Lead, coach and develop IT senior auditors, staff and co-sourced resources; set expectations, review work papers and provide timely performance feedback.
Serve as an Internal Audit liaison to IT and OT leadership and the CISO on audit scope, timing and results.
Manage co-source provider work quality, budget and knowledge transfer, and upskill the IT audit team in ITGC testing, data analytics and AI-enabled testing.
Issue clear, risk-rated audit reports that explain technical issues in business terms; validate root causes and agree practical, cost-effective remediation with management.
Design, validate and govern AI- and agentic-AI-enabled test procedures, data analytics and automation used by Internal Audit.
Define AI test tasks, inputs and expected outputs; check accuracy and completeness against manually performed results.
Ensure AI-assisted testing is reviewable and reproducible through retained evidence, documented prompts, configurations, tool versions, agent-action logs, review and auditor sign-off.
Manage risks of audit AI tools, including data confidentiality, agent access permissions, errors and hallucinations, in line with IIA Standards, UGI AI policy and external auditor expectations.
Contribute IT, cyber and OT risk assessments and audit coverage to the annual audit plan; maintain the IT audit universe, manage engagement budgets and documentation in the audit management system, and contribute to QAIP.
Travel approximately 5% domestically and internationally, including visits to operational sites to observe OT environments, and commute to Reading locations on occasion.