C-SOX Auditor

Job Overview:
The C-SOX Auditor reports to the Lead Auditor, Internal Audit, who reports to the Director, Internal Audit. The Director, Internal Audit reports functionally to the Audit Committee of the Board and administratively to the Vice-President, Finance and Compliance. This reporting structure helps ensure the independence and objectivity of the Internal Audit function.

The C-SOX Auditor provides independent, risk-based, and objective assurance over the organization's Internal Controls Over Financial Reporting (ICFR) as part of its annual C-SOX audit, with a focus on business controls and non-IT controls.

Must Haves:

Professional CPA or CIA certification is required.

Post secondary education within Business or IT discipline.

8+ years of experience in internal audit or related governance
, risk, and control roles with focus on non-IT controls.

SOC, SOX, C-SOX or similar experience.

Strong knowledge and application of IIA Standards
; ability to conduct peer reviews.

Strong verbal and written communications skills.

Proven ability to resolve challenges proactively and prevent unnecessary escalation.

Proven ability to resolve challenges proactively, preventing unnecessary escalation.

Proficiency with technology to enhance audit efficiency e.g. data analysis

Nice to Haves:

CISA would be an asset.

Electricity Industry experience

Experience with Workday, Service Now

Accountabilities include but are not limited to:

Assess and document the design, implementation, and operating effectiveness of C-SOX controls for the 2026 audit period, including entity-level controls, expenditures, capital, payroll, operating reserves, revenue and settlements, credit, treasury, financial close and reporting, and relevant automated controls.

For each control, prepare complete design assessment documentation that clearly

identifies:
The financial reporting risk and relevant financial statement assertion. The control objective and how the control addresses the identified risk. The control owner and individuals responsible for performing and reviewing the control. Whether the control is preventive or detective, and manual, automated or IT dependent. The control frequency, timing, precision, thresholds and level of aggregation. The reports, data, systems and other information used in performing the control.

The evidence retained to demonstrate performance and review. The criteria used to conclude whether the control is appropriately designed. Any control-design gaps, recommendations and management responses.

Confirm that each control has been implemented through inquiry, observation, inspection of supporting evidence and walkthroughs. Document the transaction selected for the walkthrough from initiation through processing, recording and financial reporting.

Develop and document an operating-effectiveness testing plan for each control, including:
Defined population and audit period. Population completeness and accuracy procedures. Sampling methodology and sample-size rationale. Items selected and selection method. Attributes and criteria tested. Evidence inspected. Test results and exceptions identified. Additional or extended testing performed. Final conclusion on operating effectiveness.

Coordinate with the IT auditor on IT change testing to ensure significant changes during the test period impacting business control design are included in the IT change testing. If exceptions are noted in the completeness, accuracy and validity of information produced, coordinate recommendation(s) with the IT auditor to address control deficiencies

Prepare workpapers that meet internal audit methodology and applicable IIA Standards and contain sufficient, reliable, relevant, and useful evidence so that an experienced auditor with no previous connection to the work can understand and reperform the procedures and reach the same conclusion.

Cross-reference all risks, controls, procedures, samples, supporting evidence, exceptions and conclusions to the C-SOX risk and control matrix and supporting workpapers.

Identify and document all exceptions, including the nature, cause, frequency, affected population, financial reporting risk, and potential magnitude. Assess…