SOX Control Transformation Director

The mandate

This nine-month project will transform a selected portfolio of internal controls over financial reporting from inherited activity into risk-linked, operable evidence. No client identity, filing circumstance, deficiency status or auditor detail is disclosed. The director must redesign and pilot controls while management and external assurance parties retain their formal conclusions.

Month one establishes risk, process, assertion and evidence baselines. Months two and three challenge control purpose, precision, ownership and dependency. Months four through six redesign and pilot priority controls. Months seven and eight run operating-evidence cycles and independent challenge. Month nine finalises the control book, residual items and owner handover.

Nine milestones govern acceptance: scoped risk map, control-purpose assessment, redundancy and gap decisions, redesigned control narratives, evidence standards, pilot wave one, pilot wave two, independent challenge, and final handover book. Fewer controls is not automatically better; every removal, combination or automation must preserve coverage and create evidence that an informed reviewer can evaluate.

Management provides authorised process evidence, risk and control records, issue history and access to control owners. The consulting director can recommend redesign, coordinate pilots and withhold project completion. The role cannot certify management effectiveness, determine external-audit reliance, make accounting policy, administer access or alter production configurations.

The Chief Accounting Officer accepts the project when designated management owners approve the designs and two operating cycles support use. Audit acceptance is not guaranteed or sold as an outcome. Implementation beyond selected controls, formal testing on management's behalf and remediation of newly identified out-of-scope matters require separate decisions.

What you will own

• Link selected controls to risks, assertions, process points, dependencies, evidence and accountable owners.
• Identify redundant activity, uncovered risk and controls whose precision or reviewer evidence is insufficient.
• Redesign priority controls with population completeness, thresholds, review criteria, exception disposition and retention requirements.
• Assess automation opportunities only after process and control purpose are stable.
• Pilot redesigned controls across two operating cycles and record exceptions, owner response and design changes.
• Provide independent project challenge without replacing management testing or external assurance judgement.
• Recommend retirement, combination or redesign; designated management owners retain formal approval and effectiveness conclusions.
• Hand over a traceable control book, residual-risk record and 90-day owner assurance plan.

Candidate qualifications

• Demonstrate senior SOX or equivalent control transformation with risk and assertion depth, not documentation volume alone.
• Show a control removed or combined only after coverage and evidence were proven.
• Provide an example where reviewer sign-off existed but precision or population completeness was inadequate.
• Bring practical command of control design, evidence, exceptions, testing boundaries and management ownership.
• Evidence two-cycle pilots and willingness to change an initially preferred design.
• Describe collaboration with assurance parties without promising reliance or assuming their judgement.
• Show fixed-project discipline when new deficiencies or implementation work emerged outside scope.

Working terms and boundaries

• Nine milestones over nine months at five days a week cover baseline, redesign, pilots, challenge and handover.
• The Chief Accounting Officer accepts project artifacts; management and assurance parties retain formal effectiveness and reliance decisions.
• Management supplies authorised records, issue history, owners and review responses.
• Certification, external-audit reliance, accounting policy, access administration and production configuration are excluded.
• New controls or deficiencies require written scope, acceptance, schedule and fee treatment.

Application

Applications for this mandate are received in one way only: through the India Board Terminal's application process. It is automated end to end. Your Executive Passport travels to the mandate holder in its confidential form, your answers to the three questions below are read before anything else in your file, and every stage that follows is recorded on your applications page.

There is no address to write to and no intermediary to call. The mandate holder reads what the Terminal delivers and nothing else, which is what keeps the process the same for every applicant and keeps your name out of it until you release it. Applications close on 6 October 2026. Mandate reference FNA-CON-2026-HOU-45.