Internal Controls and Audit Analyst for insurance domain

Position Overview
The Internal Controls & Audit Analyst is an independent control resource who maps, documents, and independently tests Client's operational processes and vendor performance. The role exists to close the accountability gaps identified in Client's operational review: undocumented processes, work products released without a peer reviewer of record, institutional knowledge concentrated in single individuals, and vendor commitments tracked without dated verification.

This is a control and assurance role, not an operational-execution role. The analyst does not perform, own, or unblock the operational work they audit; they independently verify it, surface findings with owners and dates, and track remediation to closure. Because Client's BPO partners also prepare certain work products under audit (for example, plan documents, Schedules of Benefits, and consolidated KPIs), the analyst reports functionally into Client's operations governance rather than into the delivery teams whose output they test, and is segregated from any work product they helped prepare.

Primary Responsibilities
1. Process Mapping & Documentation

● Document current-state and future-state workflows for critical operational processes that today rely on a single, unreviewed owner.

● Establish a peer-review-of-record for each critical process; identify and help close single-point-of-failure risks where knowledge or data sits with one individual.

● Confirm process artifacts and source data reside in approved systems (SharePoint), not on individual or non-client devices; flag any off-system custody for remediation.

● Maintain a living process register: process, how it is handled today, how it will be handled going forward, owner, reviewer, and date.

2. Process & Controls Audit

● Run benefit and plan-document audits against source of record and document configuration discrepancies for correction.

● Verify accuracy and completeness of Summary of Benefits and Coverage (SBC) and plan documents for compliance and clarity, including alignment with RIA state-mandate requirements as they arrive.

● Establish and run a recurring claims-audit cadence (e.g., percentage-of-claims sampling, census/variance checks) with documented methodology; support the VIE file audit regime as a defined.

● Support FWA processes

● Design and test operational controls; document control gaps, root cause, and recommended corrective action.

3. Vendor Audit & Performance Assurance

● Independently verify vendor performance against contractual SLAs and KPIs across several stakeholders, and other operational vendors.

● Build and maintain vendor scorecards (service-level metrics, claims timeliness, error rates) to support performance conversations with leadership and partners.

● Perform contract-compliance checks (effective dates, peer reviewer of record, deliverable commitments) and confirm executed vendor commitments were implemented as agreed.

4. Findings, Reporting & Remediation

● Produce dated audit findings and a findings log; every finding carries an owner, a required outcome, an action, and a due date, and is tracked to closure rather than carried across reporting cycles.

● Provide inputs to the MOR and other operating meetings so audit items close with named owners, actions, and dates on record.

● Report control status, KPIs, learnings, and open remediation on a regular, dated cadence to operations leadership.

5. Independence, Compliance & Data Governance

● Maintain independence from the operational work and work products under audit; escalate any assignment that would create a self-review conflict.

● Apply auditing methodology and compliance checks appropriate to US healthcare operations; coordinate with, but remain distinct from, any FWA function.

● Support data-governance objectives: single source of truth, approved-system custody, and reduction of institutional-knowledge concentration.

Scope Boundary — What This Role Is Not
To preserve independence and to keep this position distinct from the separate operational-support hire, the following are explicitly out of scope for this role:

● Operational execution — performing group implementation, client document intake, or…