Data Governance & Controls Assurance Consultant

Role Purpose

The Data Governance & Controls Assurance Consultant provides advisory and independent-assurance services over client data governance, security, controls and implementation evidence. The role evaluates whether policies, accountabilities, processes and controls are appropriately designed, implemented and supported by evidence, and whether identified issues are being remediated effectively.

The consultant uses a risk-based and evidence-led approach, working with governance, data, security, technology, risk and audit stakeholders. It reports factual findings, root causes, implications and practical recommendations while preserving independence and confidentiality. The role does not own the controls being assessed, approve client risk or act as the client's internal auditor unless that responsibility is formally contracted and independence safeguards are established.

The expected outcome is clear assurance that helps client leaders strengthen governance and control effectiveness.

• Define risk-based assurance scope, objectives, criteria, evidence needs, sampling approach and reporting protocols.
• Review governance frameworks, policies, standards, RACI matrices, committee evidence, registers and performance reporting.
• Assess control design and operating evidence across data quality, metadata, sharing, security, retention, platforms and analytics.
• Conduct interviews, walkthroughs, document reviews, sample testing and evidence validation.
• Distinguish control design gaps, implementation gaps, evidence gaps and isolated exceptions.
• Document findings with condition, criteria, cause, consequence, risk and practical recommendation.
• Validate management responses, owners, target dates, dependencies and planned closure evidence.
• Track remediation and perform follow-up testing before recommending closure.
• Identify systemic themes, control dependencies and recurring weaknesses across domains or entities.
• Prepare concise assurance reports and facilitate factual-clearance discussions with stakeholders.
• Maintain independence, confidentiality, working papers, evidence traceability and quality review.
• Escalate matters requiring formal audit, legal, regulatory or executive attention through authorised channels.

• Bachelor's degree in audit, accounting, information systems, cybersecurity or a related field.
• An equivalent combination of relevant education and directly applicable consulting or implementation experience may be considered.

• Typically 4-8 years in internal audit, technology audit, risk or assurance.
• Experience in internal audit, technology audit, data governance, controls assurance, risk or compliance.
• Experience evaluating design and operating effectiveness and retaining defensible working papers.
• Experience writing findings and facilitating factual-clearance and remediation discussions.
• Exposure to data platforms, governance frameworks, information security or regulated environments is preferred.

• Risk-based assurance and control assessment methods.
• Data-governance, policy, accountability and committee controls.
• Technology, data-quality, metadata, sharing and security-control concepts.
• Evidence sampling, walkthroughs, testing and working-paper standards.
• Finding development, root-cause analysis and risk articulation.
• Remediation planning, follow-up testing and closure evidence.
• Independence, confidentiality and conflict-of-interest safeguards.
• Executive assurance reporting and thematic analysis.

• Risk-based auditing.
• Control testing.
• Evidence evaluation.
• Report writing.
• Technology and data risk.
• Professional independence.
• Professional scepticism.
• Evidence judgement.
• Integrity.
• Conducting structured interviews and evidence-based challenge.
• Writing precise, balanced and defensible findings.
• Facilitating factual-clearance without diluting valid issues.
• Maintaining independence while supporting practical remediation.
• Communicating control risk to technical and executive audiences.
• Managing sensitive information and complete working papers.
• Recognising when specialist legal, security or audit escalation is required.

• Certified Internal Auditor (CIA)
• CISA preferred for technology-focused roles

Risk-based auditing

Control testing

Evidence evaluation