Government and Infrastructure - Risk Consulting-Enterprise Risk, Controls and Resilience - Senior

EY•McLean, VA

5d•$87,800 - $182,800

About The Position

Ernst & Young LLP’s Government & Infrastructure (G&I) practice provides consulting and audit services to federal, state, local and education clients. The Enterprise Risk, Controls & Resilience team helps government organizations govern risk, strengthen controls and resilience, and support mission outcomes through work in internal controls, internal audit, enterprise risk management, third-party risk management, ethics and regulatory compliance. The team designs, transforms and operates these programs, using AI, data analytics and Governance, Risk, and Compliance platforms to automate control testing and monitoring and support clean audit opinions and risk-informed decisions. As a Risk Consulting Senior, you will lead day-to-day engagement workstreams, supervise and coach Staff and Service Delivery Center team members, and serve as a client stakeholder contact. You will also contribute to practice growth by developing reusable solutions, supporting proposals and helping build client relationships. The role requires flexibility to travel based on client and project needs; for federal roles, travel of up to approximately 30% is preferred, while state, local and education roles may require more.

Requirements

Bachelor’s degree in Accounting, Finance, Business Administration, Economics, Risk Management, Public Administration or a related discipline.
At least 3 years of relevant experience in internal audit, internal controls, OMB Circular A-123, financial statement audit, audit readiness and control remediation, enterprise risk management, third-party or vendor risk management, compliance or resilience.
Experience leading a workstream or significant engagement tasks and reviewing others’ work.
U.S. citizenship and ability to obtain and maintain a Secret clearance or higher.
Flexibility to travel based on client and project needs.
Understanding of internal control and risk frameworks such as the GAO Green Book, COSO Internal Control, COSO ERM and OMB Circular A-123, including control testing and risk and control self-assessment.
Understanding of enterprise risk concepts, including risk identification, risk appetite and tolerance, key risk indicators, scenario analysis, third-party risk and business continuity planning.
Knowledge of federal business processes or comparable state, local and education processes.
Knowledge of working-paper documentation and internal audit standards such as IIA Global Internal Audit Standards and GAGAS.
Working knowledge of third-party risk practices, vendor tiering, due diligence, ongoing monitoring and interpretation of SOC 1 and SOC 2 reports.
Strong report-writing skills and excellent communication skills, including the ability to discuss observations and negotiate access to data for testing and reporting.
Ability to work independently with clients and project teams, lead a workstream, supervise and develop team members, and understand how scope, budget and staffing affect client value and engagement economics.
Ability to research regulatory guidance, industry standards and trends, legislation and requirements.
Ability to use firm-approved AI tools effectively and exercise sound judgment about AI-related risks; ability to assess and articulate evolving client risks across domains, including AI embedded in vendor products and services.

Nice To Haves

Master’s degree.
Experience with OMB Circular A-123 assessments, financial statement audit, attestation, audit readiness and remediation.
Working knowledge of the US Standard General Ledger and Statements of Federal Financial Accounting Standards.
Experience building or operating enterprise risk, third-party or vendor risk management, or continuity and resilience programs, including use of ISO 22301, ISO 31000 or NIST SP 800-34.
Familiarity with state internal control and internal audit statutes, including Massachusetts Chapter 647, New York State Governmental Accountability, Audit and Internal Control Act, Florida Statutes Section 215.86, Texas Internal Auditing Act and California State Leadership Accountability Act.
Hands-on experience with GRC platforms such as Archer, Optro (formerly AuditBoard) or ServiceNow; third-party risk platforms such as ServiceNow Vendor Risk Management, Archer Third Party Governance, OneTrust or ProcessUnity; vendor risk intelligence tools such as BitSight or SecurityScorecard; and analytics tools such as Power BI, Tableau or Alteryx.
A relevant certification held or in progress, such as CPA, CIA, CGFM, CDFM, RIMS-CRMP, CTPRP or CBCP.
Experience delivering project plans on large, complex engagements from analysis through implementation.
Contributions to proposals, reusable tools or methods, coaching others and growing client relationships.

Responsibilities

Lead workstreams for internal controls, internal audit, enterprise risk management, third-party risk, compliance or resilience engagements; plan work, set priorities and manage deadlines.
Lead process walkthroughs and working sessions, evaluate process and control design, and develop risk and control matrices and control test plans in accordance with applicable federal and state requirements.
Lead internal audit fieldwork and draft audit reports and findings consistent with IIA Global Internal Audit Standards or GAGAS, as applicable.
Conduct root cause analysis, help process owners design remediation and corrective action plans, and validate remediation effectiveness.
Facilitate risk identification and assessment workshops and build and maintain risk registers, risk profiles, risk appetite statements and key risk indicators.
Lead third-party risk assessments across the vendor lifecycle, including risk tiering, due diligence, review of SOC reports and assurance evidence, contract compliance, ongoing monitoring, fourth-party and concentration risk analysis, and offboarding.
Assess and design ethics, regulatory compliance and resilience programs, including compliance risk assessments, policy updates, business impact analyses, dependency mapping, scenario analysis, continuity plans, crisis management, tabletop exercises and recovery testing.
Delegate, supervise and review Staff work, and provide timely feedback and on-the-job coaching.
Direct and quality-review work delivered by Service Delivery Center teams, setting requirements and acceptance criteria.
Monitor workstream scope, schedule and budget, and escalate risks, issues and change requests early.
Build reusable practice resources such as test-procedure libraries, risk taxonomies, key risk indicator libraries, vendor due diligence questionnaires, tiering models, templates and points of view.
Help train and onboard team members and share knowledge across the practice.
Contribute to proposals through technical approach sections, staffing and level-of-effort input, qualifications and oral presentations.
Build client relationships, identify follow-on needs and communicate them to engagement leadership.