Continuous Auditing Operating Model Director

The mandate

This project will design and pilot a continuous-auditing operating model that converts selected risk indicators into independent audit attention. It is not a monitoring implementation for management and not a promise that automated exceptions constitute audit evidence. The commission must establish purpose, rule governance, investigative workflow, documentation and a limited pilot.

Six artifacts define delivery: eligibility and independence charter, risk-and-data lineage map, analytic-rule specification, alert triage protocol, two-use-case pilot report, and operating-and-transfer handbook. Every rule must connect to an audit objective and state what additional evidence is necessary before any conclusion.

Milestones occur at weeks four, nine, fifteen, twenty-one, twenty-seven and thirty-two. The Audit Transformation Sponsor accepts charter and map; the Internal Audit Quality Head accepts rules and triage; the Audit Committee delegate accepts pilot and transfer. Acceptance requires approved lineage, reproducible alerts, documented false positives, complete workpapers and internal operation.

Client inputs include approved extracts, control descriptions, named data owners, historical exceptions, access decisions and audit staff for the pilot. The consultant will not repair source systems, operate management controls or make disciplinary findings. Missing evidence narrows the pilot and enters written dependency control.

What you will own

• Define which risks and audit objectives suit continuous techniques and which require periodic human-led examination.
• Map approved data from source through transformation, rule, alert, triage, investigation and retained audit evidence.
• Specify analytic rules with rationale, threshold, population, expected false-positive behavior, owner and change approval.
• Establish independent triage that prevents management from suppressing alerts while preserving fair contextual evaluation.
• Pilot two use cases across at least three complete runs and reconcile alert populations to approved source totals.
• Document investigation steps, contradictory evidence, disposition, supervisory review and limits on conclusion.
• Measure precision, coverage, timeliness, investigator effort and risk relevance without treating alert volume as success.
• Transfer rule maintenance and audit workflow through an internal team-led run and change request.

Candidate qualifications

• At least 15 years in internal audit, audit analytics or assurance transformation, including Director-level consulting delivery.
• Current CPA Canada, CA, ACA, ACCA or comparable accounting designation, alongside CIA, CISA or equivalent analytics-assurance credentials.
• Evidence of a continuous-audit programme where an alert led to defensible audit work rather than automated accusation.
• Expertise in audit objectives, data lineage, population completeness, rule precision, workpapers, supervision and evidence limits.
• A case where you retired or revised a rule because false positives distorted audit attention.
• Experience preserving internal-audit independence when management owned the source data and operational response.
• Demonstrated transfer through internal execution of both a production run and governed rule change.

Working terms and boundaries

• The eight-month commission is delivered four days weekly through six milestones with named acceptors.
• Deliverables cover design, two-use-case pilot and transfer; production deployment, source remediation and management monitoring are excluded.
• The consultant may propose rule dispositions but cannot issue audit findings without the internal function's evidence and approval process.
• Approved extracts, data ownership, historical exceptions, access and pilot staff are required client inputs.
• Final acceptance requires reproducible alert populations, complete audit files, understood limitations and an internal team-led run.

Application

Applications for this mandate are received in one way only: through the India Board Terminal's application process. It is automated end to end. Your Executive Passport travels to the mandate holder in its confidential form, your answers to the three questions below are read before anything else in your file, and every stage that follows is recorded on your applications page.

There is no address to write to and no intermediary to call. The mandate holder reads what the Terminal delivers and nothing else, which is what keeps the process the same for every applicant and keeps your name out of it until you release it. Applications close on 8 October 2026. Mandate reference AUD-CON-2026-TOR-21.