ITGC (IT General Controls) SME

About Us

We are part of International Airlines Group (IAG), one of the world’s leading airline groups and owner of some of the biggest brands in the sky.

IAG Transform provides creative and innovative solutions to drive sustainable transformation by delivering procurement and airline services, as well as group-wide systems across IAG. Each operating company benefits from the Transform centralised model, driving efficiencies, automation, and economies of scale.

 

 

Role Purpose

Role can be based in the UK or Spain.

This role is the subject matter expert (SME) for IT general controls (ITGC) in Controls and Process Assurance, the second line of defence for Group AI and Technology, IAG Transform’s AI and technology organisation. The ITGC SME sets the standard for how access, change, system development and IT operations are controlled on the platforms and applications that support the Group’s financial reporting and critical business processes. Working in strong partnership with control owners, the role makes sure controls are performed and documented consistently, uses proactive monitoring and proportionate independent testing to confirm they work, and keeps the organisation ready for Group Internal Audit’s annual audit and for external audit.

Scope
• Part of the Controls and Process Assurance team in the AI and Tech Business Strategy and Governance area, reporting to the Head of Controls and Process Assurance
• Focuses entirely on IT controls and processes, with ITGC at the core
• As the second line, the team sets the IT control framework and standards, makes sure control owners perform and document their controls, carries out proportionate independent testing, and gives oversight and challenge. Technology teams in the directorates (the first line) own and operate the controls.
• This isn’t an internal audit role. Group Internal Audit (the third line) carries out the annual audit and provides independent assurance, and the team’s testing complements that work rather than repeating it.
• Works in close partnership with control owners and technology leaders across the directorates, with a shared, live view of control health through the control monitoring dashboard
• Covers the systems that Group AI and Technology runs or relies on, including enterprise applications such as SAP, infrastructure and cloud platforms, identity and access services, data platforms, and AI and automation products, as well as controls operated by third-party IT service providers

 

 

Your responsibilities

Key Responsibilities

IT control framework and standards

·   Own the second-line ITGC framework and control library for Group AI and Technology, covering access to programmes and data, program change, program development and computer operations

·   Set clear, proportionate control standards and evidence requirements, for example for user provisioning and removal, periodic access reviews, privileged access, change approval and segregation of duties, in line with the COSO and COBIT frameworks

·   Maintain the risk and control matrix (RCM) and the list of in-scope systems, interfaces and key reports, working with Finance and control owners

·   Keep the framework up to date as the technology estate changes, including cloud services, DevOps pipelines, automation and AI

Control performance and oversight

·   Make sure control owners perform their controls on time and document them to the agreed evidence standard

·   Provide independent oversight and challenge of how the first line designs, operates and evidences IT controls

·   Advise system owners and delivery teams on control design, so controls are built into new systems, migrations and changes rather than added later

·   Review segregation of duties rule sets and role designs for key applications such as SAP, and challenge conflicts that aren’t resolved or mitigated

·   Assess the control impact of organisational, process and technology changes, including the move to the new Group AI and Technology structure

·   Protect the second line’s independence by advising on controls without owning or operating the first-line controls the team assesses

Independent testing and audit readiness

·   Plan and lead a proportionate, risk-based programme of independent checks on key ITGCs, confirming that controls are performed, documented and working as intended

·   Carry out the more complex checks, and review the checks done by the Senior Controls Analyst

·   Review service organisation reports (for example SOC 1 and ISAE 3402) for third-party IT providers, assess exceptions and map the complementary user entity controls the Group must operate

·   Help control owners prepare for Group Internal Audit’s annual audit and for external audit, and coordinate evidence requests and responses to findings

·   Share monitoring and testing results with Group Internal Audit and external auditors, so second-line checks complement their work rather than repeat it

Proactive monitoring and remediation oversight

·   Design and own a control monitoring dashboard that shows, for each key control, its performance, upcoming and overdue activities, test results, open deficiencies and key risk indicators against agreed thresholds

·   Use the dashboard to drive proactive action: agree thresholds and escalation routes with control owners, and follow up before issues become control failures or audit findings

·   Automate the dashboard’s data feeds and extend continuous control monitoring, using the governance, risk and compliance (GRC) tool, data analytics and source systems such as ServiceNow and SAP

·   Oversee the remediation of ITGC deficiencies: agree root causes and action plans with control owners, track progress and confirm that fixes work

·   Report control health, trends and emerging risks to the Head of Controls and Process Assurance and governance forums, and escalate significant weaknesses promptly

Stakeholder management and control owner engagement

·   Build strong, trusted relationships with control owners, system owners and technology leaders across the directorates, so controls are seen as part of running technology well rather than an audit exercise

·   Make sure every key control has a named owner who understands what is expected, how to evidence it and when it is due

·   Run regular control owner forums and check-ins to review the dashboard, upcoming control activities, open actions and emerging risks

·   Influence senior stakeholders to agree realistic remediation plans and priorities, and escalate through governance when commitments slip

·   Explain control requirements and findings in clear, practical terms that technology teams can act on, and build control awareness through guidance and training

·   Represent Controls and Process Assurance with Group Internal Audit, external auditors and other second-line functions, giving a clear and consistent view of the IT control environment

·   Coach and guide the Senior Controls Analyst and other colleagues in the team

Key Interfaces: Head of Controls and Process Assurance and the Controls and Process Assurance team; Directorate leadership teams and heads of technology functions; Control owners and system owners across Group AI and Technology (the first line), particularly in Group IT and Platform; Enterprise applications, infrastructure and service operations teams; Identity and access management teams; Group CISO teams, including cyber governance and assurance; Other second-line functions in the Group, such as risk management and compliance; Group Finance and financial control teams; Group Internal Audit (the third line); External auditors; Third-party IT service providers

Key Performance Indicators: Share of key controls performed on time and documented to the agreed evidence standard; Trend in overdue control activities and actions; Control monitoring dashboard live, current and used by control owners and governance forums; Planned independent checks completed, with results shared with Group Internal Audit; Number and severity of ITGC findings from Group Internal Audit’s annual audit and from external audit; Remediation actions closed on time, and repeat findings; Service organisation reports reviewed, with complementary controls mapped, for all in-scope providers; Share of controls that are automated or continuously monitored; Share of in-scope systems with documented ITGCs and named control owners; Feedback from control owners, technology leaders and auditors

 

 

Skills & Experience

Essential

·   Significant experience in IT controls, IT risk or IT audit, in-house or in a professional services firm

·   Deep knowledge of IT general controls across access to programmes and data, program change, program development and computer operations

·   Good understanding of the three lines model, of the second line’s role in setting standards, monitoring and challenging the first line, and of how this differs from internal audit

·   Experience of testing whether controls are designed and working effectively, and of setting practical evidence standards for control owners

·   Excellent stakeholder management and influencing skills, with a track record of building trusted relationships with technology teams and senior leaders, challenging constructively and securing action without direct authority

·   Experience of designing control monitoring, key risk indicator or performance dashboards that drive action

·   Good understanding of enterprise resource planning (ERP) security and segregation of duties, ideally in SAP

·   Experience of assessing controls in cloud, software as a service (SaaS) and outsourced environments, including reviewing service organisation reports

·   Working knowledge of control frameworks such as COSO, COBIT and ISO/IEC 27001, and of internal control over financial reporting (ICFR), for example Sarbanes-Oxley (SOX) or equivalent regimes

·   Experience of preparing control owners for internal and external audit, and of taking findings through to remediation

·   Strong analytical skills and attention to detail, with clear written reporting

·   A relevant professional qualification, such as Certified in Risk and Information Systems Control (CRISC) or Certified Information Systems Auditor (CISA)

Desirable

·   IT risk or controls advisory experience with a Big 4 or other large professional services firm

·   Experience with GRC and identity governance tools (for example ServiceNow, SAP GRC or SailPoint)

·   Experience of control automation, data analytics or continuous control monitoring

·   Knowledge of controls for DevOps, continuous integration and delivery (CI/CD) pipelines and AI systems

·   Further qualifications such as Certified Information Security Manager (CISM), or ISO/IEC 27001 Lead Implementer or Lead Auditor

·   Experience in aviation, travel or another complex, regulated industry

Personal Attributes

Behaviours and Attitude: I make controls practical and proportionate, not bureaucratic; I protect my independence and act with integrity; I give constructive challenge and back it with evidence, even when it isn’t welcome; I build trusted partnerships with control owners and help them get their controls right, rather than trying to catch them out; I act early, before issues grow, and look for ways to simplify and automate

Core Traits: Rigorous and detail-oriented; Independent-minded; Proactive; Pragmatic; Analytical; Influential; Clear communicator; Trusted and discreet; Collaborative; Curious about technology

What This Role Offers

·   A central role in building the second line of defence for IT controls in the newly combined Group AI and Technology organisation

·   Exposure to a wide range of technology across the Group, from SAP and cloud platforms to data and AI products

·   Close work with technology leaders, Group Internal Audit and external auditors

Scope to modernise controls through a live monitoring dashboard, automation and continuous monitoring

 

 

What we offer