Chief Audit Executive

Position Summary

The Chief Audit Executive ("CAE") serves as the senior executive responsible for the Bank's independent Internal Audit function and is accountable for providing the Audit Committee and executive management with objective assurance regarding the effectiveness of internal control, including governance, risk management, regulatory compliance, and key strategic initiatives.

The Chief Audit Executive ("CAE") serves as the senior executive responsible for the Bank's independent Internal Audit function and is accountable for providing the Audit Committee and executive management with objective assurance regarding the effectiveness of internal control, including governance, risk management, regulatory compliance, and key strategic initiatives.

Consistent with Federal Reserve Supervisory Letter SR 13-1, the CAE is responsible for establishing and maintaining an Internal Audit function that possesses sufficient authority, stature, independence, resources, technology, and expertise to effectively evaluate and improve the organization's governance, risk management, and internal control framework. The CAE reports functionally to the Audit Committee of the Board of Directors and administratively to the Chief Executive Officer.

The CAE leads a scalable, risk-focused audit function that evolves with the Bank's acquisition-driven growth strategy and supports a more enterprise-wide, risk-based model capable of assessing common processes, strategic initiatives, technology transformation, emerging risks, and market-level risk considerations across the organization.

The CAE serves as a trusted advisor to the Audit Committee, executive management, regulators, and external auditors while preserving the independence and objectivity of the Internal Audit function, including by maintaining clear advisory guardrails and avoiding management decision-making responsibilities.

• Provide independent assurance to the Audit Committee regarding the effectiveness of governance, risk management, regulatory compliance, and internal control processes.
• Maintain an Internal Audit function that is independent of business line management and free from interference in determining audit scope, performing audit procedures, communicating results, and evaluating risk.
• Ensure Internal Audit possesses sufficient organizational stature, staffing, specialized expertise, technology capabilities, and budgetary resources to effectively fulfill its responsibilities.
• Establish and maintain clear advisory guardrails and triggers for early Internal Audit involvement in strategic initiatives, key operational projects, technology transformation, and acquisition-related activities while preserving independence.
• Clarify the roles and responsibilities of Internal Audit in relation to Enterprise Risk Management, SOX/FDICIA readiness, Compliance, and the broader Three Lines model.
• Provide regular executive-session reporting to the Audit Committee regarding significant risks, control issues, audit results, emerging risk trends, thematic observations, and the overall condition of the internal control environment.
• As the Bank grows through acquisitions, ensure changes to the Internal Audit operating model, resources, coverage, and integration activities are appropriately reported to and approved by the Audit Committee.

• Direct a comprehensive enterprise-wide risk assessment process and develop a dynamic, risk-based audit plan that addresses the organization's most significant risks, control activities, strategic initiatives, regulatory expectations, and emerging risk themes.
• Modernize and maintain the audit universe to support enterprise-wide, horizontal, and integrated reviews across common processes, systems, products, markets, and acquired entities.
• Align Internal Audit's risk assessment framework to common industry risk categories and the Bank's evolving risk taxonomy, including credit, market, operational, compliance, technology, cybersecurity, BSA/AML, third-party, model, financial reporting, and strategic risks.
• Evaluate the maturity of Enterprise Risk Management and use ERM outputs, when sufficiently mature, as inputs into audit universe, engagement risk assessment, and thematic risk analysis.
• Periodically reassess audit priorities based on changes in the Bank's risk profile, business strategy, acquisitions, technology, regulatory expectations, remediation trends, and emerging risks.

• Maintain documented audit methodologies, reporting standards, workpaper expectations, issue rating definitions, validation procedures, and professional practices aligned with regulatory guidance and Institute of Internal Auditors standards.
• Standardize issue rating, management action plan, validation, closure evidence, and remediation expectations to promote consistency, transparency, and stakeholder understanding.
• Ensure audit recommendations and management action…