Manager, Business Process Risk & Controls

CVS Health•Cumberland, RI

About The Position

The Manager, Business Process Risk & Controls supports second-line oversight of business process controls across CVS Health’s Internal Control over Financial Reporting (ICFR) environment. Reporting to the Lead Director, Business Process Risk & Controls, this individual contributor helps execute the governance framework, oversight activities, and continuous improvement initiatives that strengthen the effectiveness, consistency, and sustainability of business process controls across business segments and functional organizations. The role operates independently, makes recommendations, influences decisions, and partners with business process control owners, Internal Audit, External Audit, and cross-functional leadership teams as part of the SOX Compliance Hub. The position helps establish a proactive, scalable, and efficient control environment. It conducts independent assessments of control design and execution; provides objective challenge to management; supports deficiency remediation, audits, and annual SOX 404 assessments; and contributes to control optimization, standardization, GRC technology enablement, and data-driven monitoring. The role also prepares governance and leadership reporting and may provide informal guidance, coaching, and work direction to junior team members and cross-functional partners. This is a full-time position with 40 anticipated weekly hours. The role may require travel up to 10%, including by plane. The typical pay range is $66,330–$145,860, with eligibility for a CVS Health bonus, commission, or short-term incentive program. The role is eligible for a benefits package that includes medical, dental, and vision coverage, paid time off, retirement savings options, wellness programs, and other resources, based on eligibility.

Requirements

At least 5 years of experience in one or more of the following: SOX Compliance, Internal Audit, Risk Management, Controllership, or Public Accounting.
Demonstrated knowledge of the COSO Framework, SOX 404, Internal Control over Financial Reporting (ICFR), and business process risks and controls.
Experience working in complex, matrixed organizations.
Strong analytical, problem-solving, and communication skills.
Ability to work independently with limited direction and influence decision-making through recommendations.
Ability to travel up to 10%, including by plane.
Bachelor’s degree in Accounting, Finance, Business, or a related field; equivalent years of work experience may substitute.
High school diploma or GED required.

Nice To Haves

Big Four public accounting experience.
Fortune 100 or large public company experience.
Experience supporting SOX transformation initiatives.
Experience with GRC technologies and control automation initiatives.
Healthcare, insurance, PBM, retail, or consumer products industry experience.
Experience supporting end-to-end process mapping and control optimization initiatives.
CPA, CIA, CISA, or equivalent certification.

Responsibilities

Execute enterprise governance standards and methodologies for business process controls.
Support development and implementation of control oversight strategies and operating procedures.
Evaluate business process control environments and identify opportunities to improve control effectiveness and consistency.
Perform independent assessments of control design and execution across business segments and functional organizations.
Recommend ways to improve control sustainability and reduce operational complexity.
Support implementation of standardized control practices across the enterprise.
Provide objective challenge to management regarding business process control design, operation, and remediation activities.
Review risk assessments, control frameworks, and control documentation to identify potential gaps or emerging risks.
Monitor control environment performance and identify trends requiring escalation or additional oversight.
Support issue identification, root-cause analysis, and remediation planning; escalate significant risks and observations to SOX Compliance Hub leadership as appropriate.
Support governance activities related to business process control deficiencies; evaluate remediation plans, monitor progress, and validate corrective-action effectiveness.
Assist in developing reporting and dashboards that provide visibility into control performance and remediation status.
Serve as a liaison with Internal Audit and External Audit for assigned business process areas.
Support management’s annual SOX 404 assessment activities and coordinate information requests, walkthroughs, testing activities, and remediation efforts.
Assist with enterprise audit readiness activities and control environment assessments.
Support control optimization and rationalization, process standardization, GRC technology enablement, data-driven monitoring and reporting, and continuous control improvement initiatives.
Partner with Finance, Operations, Technology, and business leaders to modernize and simplify the control environment and improve efficiency while maintaining appropriate risk coverage.
Prepare materials and reporting for Control Champion Forums, senior leadership updates, Internal Audit and External Audit meetings, deficiency governance discussions, and quarterly risk and control reporting.
Assist in developing metrics and KPIs that provide insight into control performance and emerging risks.
Influence stakeholders across the organization and provide informal guidance, coaching, and work direction to junior team members and cross-functional partners as needed.