SOX Compliance Manager
SOX Compliance Manager
| India | Controls & Assurance
Purpose of the Role
The SOX Compliance Manager is responsible for managing the effective execution and day-to-day delivery of Rio Tinto’s global Sarbanes-Oxley (SOX) compliance programme, ensuring activities are completed on time, to the required quality standards and in line with the agreed SOX methodology.
The role reports directly to the SOX Director and will have internal and external SOX testing teams to manage alongside working closely with SOX Compliance Managers, control owners, Finance, technology teams, and external auditors to coordinate risk assessments, control testing, evidence collection, deficiency evaluation, and remediation activities.
The role oversees the different phases of the SOX testing lifecycle, including design, interim, update, year-end, and remediation testing, ensuring appropriate planning, resource allocation, quality review, and timely resolution of issues.
The SOX Compliance Manager is responsible for monitoring programme progress, maintaining consistent and reliable SOX documentation, addressing operational challenges, and escalating significant risks or matters requiring management attention.
The role also supports the implementation of programme improvements, standardised processes, and automation initiatives to improve the efficiency, quality, and effectiveness of SOX delivery across Rio Tinto.
Key Accountabilities
1. Leadership and Team Management
- Lead, coach and support internal SOX testing teams and external service providers to ensure high-quality and timely delivery.
- Manage day-to-day team activities, workload, priorities, and resource allocation across the SOX testing lifecycle.
- Set clear expectations for testing quality, documentation, accountability, and timely completion of assigned activities.
- Review team performance, provide regular feedback and support technical development and continuous learning.
- Promote collaboration, teamwork, and consistent ways of working across internal teams, Protiviti and Regional SOX Compliance Managers.
- Champion Rio Tinto's values, employee wellbeing, and expected standards of conduct.
2. SOX Programme Planning and Delivery
- Manage the day-to-day execution of the global SOX programme in line with the approved scope, methodology and annual plan.
- Lead planning and delivery across design, interim, update, year-end, and remediation testing phases.
- Develop and maintain testing schedules, milestones, resource plans, and deliverables, ensuring activities are completed on time and to the required quality.
- Coordinate closely with Regional SOX Compliance Managers, internal testing teams, and external service providers to ensure consistent delivery.
- Monitor testing progress, identify delays or dependencies and take timely action to resolve operational challenges.
- Provide regular programme status updates, highlighting key achievements, outstanding activities, risks, and matters requiring escalation.
- Support the implementation of programme changes and priorities established by the SOX Director.
3. Risk Assessment, Scoping and Control Documentation
- Prepare the annual SOX scoping and risk assessment by coordinating required information, analysis, and documentation.
- Review control coverage and identify potential gaps, duplication or controls that may not adequately address the relevant risks of material misstatement.
- Provide recommendations for control rationalisation, standardisation and improvements based on testing outcomes and practical experience.
- Ensure Risk and Control Matrices, control descriptions, process documentation, and ownership details are accurate and maintained in the GRC platform.
- Coordinate updates to SOX documentation arising from changes in business processes, systems, control design, or testing requirements.
·Escalate significant scoping, risk assessment, or control design matters to the SOX Director for review and decision.
4. Control Testing and Quality Assurance
- Oversee the execution of walkthroughs, design effectiveness, and operating effectiveness testing across the agreed SOX scope.
- Review testing workpapers, supporting evidence and conclusions to ensure compliance with the SOX methodology and quality expectations.
- Ensure appropriate testing coverage, sample selection, documentation, and timely completion across all testing phases.
- Coordinate with KPMG and internal testing teams to align sample requirements, minimise duplicate requests and reduce the workload on control owners.
- Ensure testing evidence is complete, dependable, and appropriately retained within the GRC platform.
- Identify and resolve testing issues, evidence gaps, and quality concerns, escalating significant matters where required.
- Manage testing review comments and ensure timely resolution before completion of each testing phase.
5. Certifications, Deficiencies and Remediation
- Coordinate periodic control design certifications and follow up with control owners to ensure timely completion.
- Review certification responses and identify changes or issues that may require further assessment or testing.
- Manage the tracking and assessment of control deficiencies, including supporting root-cause analysis, impact assessments, and proposed remediation.
- Work with control owners and Regional SOX Compliance Managers to agree practical remediation plans, responsibilities, and target dates.
- Monitor remediation progress and follow up on overdue actions to minimise unresolved deficiencies at year-end.
- Coordinate remediation testing and review supporting evidence before recommending closure.
- Escalate significant, recurring or potentially material deficiencies to the SOX Director with clear supporting analysis and recommendations.
6. External Audit and Stakeholder Coordination
- Function as the primary operational contact for KPMG on SOX testing, sample selection, evidence requests, findings, and outstanding actions.
- Coordinate external audit requirements with Finance, Technology, business units, control owners, Regional SOX Compliance Managers, and service providers.
- Manage the preparation and tracking of PBC requests, ensuring timely responses and appropriate supporting documentation.
- Support KPMG's assessment of management testing team competence, objectivity, and testing quality, including preparation of required documentation.
- Identify opportunities to align management and external audit testing to reduce duplication and improve efficiency.
- Resolve day-to-day audit queries and escalate significant disagreements, technical matters, or delivery risks to the SOX Director.
- Maintain effective working relationships with stakeholders and ensure clear communication of SOX requirements, timelines, and responsibilities.
7. Process Improvement and Technology
- Identify and implement opportunities to improve testing efficiency, documentation quality, and consistency across the SOX programme.
- Support control standardisation, rationalisation, and automation initiatives in line with the SOX improvement strategy.
- Work with Technology and control owners to address operational control gaps and improve the reliability of evidence and reporting.
- Support enhancements to GRC workflows, dashboards, testing templates, issue tracking, and reporting.
- Identify opportunities to use data analytics, automated testing, and Continuous Control Monitoring to improve assurance activities.
- Share lessons learned from testing, audit findings, and remediation to support ongoing programme improvements.
8. Training and SOX Awareness
- Coordinate and deliver periodic SOX training and communications to control owners, operators, and relevant stakeholders.
- Ensure control owners understand SOX requirements, control responsibilities, evidence expectations, and certification processes.
- Provide guidance and training on the use of the GRC platform, including control documentation, evidence submission, and certifications.
- Support Regional SOX Compliance Managers in addressing common control issues and improving the consistency of SOX practices.
- Identify training needs arising from testing findings, control deficiencies, and changes to the SOX methodology.
9. Reporting and Documentation
- Maintain accurate and up-to-date programme trackers, testing results, deficiency records, and remediation status within the GRC platform.
- Prepare regular SOX delivery reports, dashboards and status updates for the SOX Director and relevant stakeholders.
- Ensure reporting clearly identifies progress against milestones, outstanding activities, testing outcomes, and key delivery risks.
- Prepare supporting analysis, documentation and materials for management reviews, external auditor discussions, and governance reporting.
- Ensure SOX records and testing documentation are complete, consistent, and readily available for management and external audit review.
10. Resource and Delivery Management
- Lead and manage the internal SOX testing team, including allocation of responsibilities, workload management, performance oversight, coaching, and development, while overseeing and managing external service providers to ensure effective coordination, quality, and timely delivery of SOX testing activities.
- Monitor delivery against agreed plans, timelines, and resource requirements, identifying capacity constraints early.
- Coordinate work allocation across testing teams to balance workloads and meet programme priorities.
- Monitor external provider deliverables, quality, and performance against agreed expectations.
- Identify opportunities to improve resource efficiency and reduce unnecessary effort or costs.
- Provide resource and delivery updates to the SOX Director, including recommendations to address capacity or performance challenges.
Experience, Skills and Qualifications
- Bachelor's or master's degree in accounting, finance, business administration, or a...