Specialist III Business Risk & Controls

Category/Area of Expertise: Audit

Job Requisition: 497898

Address: USA-MA-Quincy-1385 Hancock Street

Store Code: Strategy - Office of CEO (5144165)

The Risk & Controls Manager is a core member of the Business Transformation Program Operations team and serves as the business authority for risk, controls, and segregation-of-duties (SoD) requirements across the ERP implementation.

This role is responsible for defining, governing, and maintaining enterprise-aligned business process controls, SoD rulesets, and end-to-end process-level risk management. A critical element of this position is ensuring that existing business processes, control frameworks, and operational guardrails are fully understood, reconciled, and integrated into future-state solution design. The Risk & Controls Manager partners closely with process owners to identify required control capabilities, challenge gaps in future-state design, and ensure the transformed processes preserve or improve control effectiveness.

The role works across Technology, Internal Audit, External Audit, and the System Integrator to ensure that transaction integrity, approvals, reconciliations, and reporting safeguards are embedded in business design—not dependent on underlying system configuration alone. The position evaluates unacceptable control conflicts, validates SoD principles, and ensures risk mitigation strategies are consistent with enterprise standards and the broader Risk & Controls organization.

The Risk & Controls Manager ensures the ERP program is audit-ready by delivering clear, sustainable, and auditable business process controls that align to enterprise policy, reduce operational risk, and support a scalable, well-governed ERP environment.

This is a full-time, dedicated role for the duration of the transformation program (estimated 5-7 years).

Our flexible/hybrid work schedule includes 3 in-person days at one of our core locations and 2 remote days. Our core office locations include Salisbury, NC, Quincy, MA, Scarborough ME.

• Lead the definition, documentation, and governance of business process controls across all in-scope ERP processes; ensuring controls reflect key business risks and align with ADUSA Risk & Controls frameworks and standards.
• Contribute to the design criteria and requirements for business process controls during process design, ensuring appropriate risk and control considerations are embedded.
• Own the design and maintenance of SoD rulesets from a business risk perspective, defining unacceptable conflicts, required mitigating controls, and process driven access principles.
• Drive end-to-end mapping of controls to business process definitions, flows, and global templates, ensuring the control logic follows the process and is consistent across banners and functions.

• Develop and maintain business-owned components of the ERP control documentation, including RACMs, control narratives, process flows, test scripts, and evidence standards; ensuring alignment with ADUSA Risk & Controls documentation standards.
• Identify and communicate control gaps, redundancies, and optimization opportunities; support business owners and ADUSA R&C in developing practical remediation actions with clear timelines and risk prioritization.
• Govern the documentation and design of mitigating controls (including those supporting SoD conflicts) in accordance with ADUSA R&C guidance and business operating realities.

• Serve as the authoritative source of business control requirements for Tech, SAP Security, and GRC teams to translate into system-enforced controls, role design, and access governance processes.
• Review system role designs and access models to ensure alignment to business-defined SoD and control expectations.

• Coordinate with ADUSA Risk & Controls to understand enterprise audit expectations and ensure business-owned control documentation supports effective audit readiness.
• Engage Internal Audit and External Audit as needed—via ADUSA R&C—to clarify expectations, understand upcoming assurance needs, and support pre-validation activities of business-owned control documentation and evidence.
• Support the planning and execution of business control testing during SIT/UAT in partnership with program testing teams and ADUSA R&C.

• Represent Business Controls in ERP design sessions, fit-gap workshops, and Business Transformation governance forums, ensuring risk and control requirements are intentionally embedded.
• Provide oversight and challenge to the System Integrator regarding control design completeness and process risk considerations.
• Provide program leadership with transparent reporting on business control readiness, risk exposure, and required decision-making.

• Maintain formal, ongoing alignment with central Risk & Controls team to ensure consistency in frameworks, methodologies, and enterprise audit…