Government and Infrastructure - Risk Consulting-Enterprise Risk, Controls and Resilience - Senior

• At EY, we’re all in to shape your future with confidence.
• We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go. Join EY and help to build a better working world.
• USA – Consulting – G&I – Risk Consulting – Enterprise Risk, Controls & Resilience – Senior

The opportunity

From strategy to execution, the Government & Infrastructure (G&I) practice of Ernst & Young LLP provides a full range of consulting and audit services to help our Federal, State, Local and Education clients implement new ideas to help achieve their mission outcomes. We deliver real change and measurable results through our diverse, high-performing teams, quality work at the highest professional standards, operational know-how from across our global organization, and creative and bold ideas that drive innovation.

We enable our government clients to achieve their mission of protecting the nation and serving the people; increasing public safety; improving healthcare for our military, veterans and citizens; delivering essential public services; and helping those in need. EY is ready to help our government build a better working world.

Within G&I Risk Consulting, we help government organizations understand and manage risks that can affect mission outcomes, financial performance, operations and public trust. Our teams build and operate the programs that strengthen governance and controls, improve resilience, prevent fraud and financial loss, manage grant and relief funds, enhance compliance, and enable better risk-informed decisions. Across our work, we use data, AI, automation and technology platforms to improve how risks are identified, assessed, monitored and managed.

Our Enterprise Risk, Controls & Resilience team helps government organizations govern risk, strengthen controls and stay resilient. Our work spans internal controls management (including OMB Circular A-123 and Federal Managers' Financial Integrity Act requirements), internal audit, integrated and enterprise risk management (ERM), enterprise resilience, third-party risk management (including vendor risk management), and ethics and regulatory compliance.

We design, transform and operate these programs, using AI, data analytics and Governance, Risk, and Compliance (GRC) platforms to automate control testing and monitoring, so that government organizations can achieve and sustain clean audit opinions and make risk-informed decisions.

As a Risk Consulting Senior in our Enterprise Risk, Controls & Resilience team, you will lead the day-to-day execution of engagement workstreams, supervise and coach Staff and SDC team members, and serve as a trusted point of contact for client stakeholders. You will bring depth in this area and contribute meaningfully to how we grow, by building reusable solutions and helping win and expand work.

Your key responsibilities

Client delivery

Lead workstreams on internal controls (including OMB Circular A-123 and audit readiness), internal audit, ERM, third-party risk, compliance or resilience engagements: plan the work, set priorities and manage deadlines.

Lead walkthroughs and working sessions with process owners; evaluate process and control design; and develop risk and control matrices and test plans for key controls in accordance with OMB Circular A-123 and relevant state internal control and internal audit statutes.

Lead internal audit fieldwork and draft audit reports and findings consistent with IIA Global Internal Audit Standards or GAGAS, as applicable.

Lead root cause analysis and help process owners design remediation and corrective action plans and validate that remediation is effective.

Facilitate risk identification and assessment workshops, and build and maintain risk registers, risk profiles, risk appetite statements and key risk indicators.

Lead third-party risk assessments across the vendor lifecycle: define inherent risk and criticality tiering, scope risk-based due diligence, evaluate SOC 1 and SOC 2 reports and other vendor assurance evidence, assess compliance with contract terms, and design ongoing monitoring, including vendor key risk indicators, fourth party and concentration risk analysis, and offboarding.

Assess and design ethics and regulatory compliance and resilience programs, including compliance risk assessments and policy updates, business impact analyses, critical process and dependency mapping, scenario analysis, continuity of operations plans, crisis management planning, tabletop exercises and recovery testing.

Delegate, supervise and review the work of Staff, and provide timely feedback and on-the-job coaching.

Direct and quality-review testing and documentation delivered by Service Delivery Center (SDC) teams, setting clear requirements and acceptance criteria up front.

Monitor workstream scope, schedule and budget, and escalate risks, issues and change requests early.

Practice development

Build test-procedure libraries, risk taxonomies, key risk indicator libraries, vendor due diligence questionnaires and tiering models, templates and points of view in internal controls, internal audit, ERM, third-party risk, compliance and resilience.

Help train and onboard new team members and share knowledge across the practice.

Business development

Contribute to proposals: technical approach sections, staffing and level-of-effort input, and qualifications; support orals.

Build relationships with client counterparts, spot follow-on needs (e.g., remediation support, ERM maturity, resilience programs, third-party risk program build or managed vendor assessments) and bring them to engagement leadership.

Skills and attributes for success

Understanding of internal control and risk frameworks such as the GAO Green Book, COSO Internal Control and COSO ERM, and OMB Circular A-123, including control testing design and execution and risk and control self-assessment

Understanding of enterprise risk concepts such as risk identification, risk appetite and tolerance, key risk indicators, scenario analysis, third-party risk and business continuity planning

Knowledge of, or experience with, federal business processes such as funds management, budget formulation and execution, receivables, disbursements, property management, human resources, financial reporting and grants management, or comparable state, local and education processes such as benefits programs

Knowledge of working paper documentation standards and internal audit standards (e.g., IIA Global Internal Audit Standards, GAGAS)

Working knowledge of third-party risk management practices, including vendor risk tiering, due diligence and ongoing monitoring, and the ability to interpret SOC 1 and SOC 2 reports, including scope, carve-outs, exceptions and complementary user entity controls

Strong report-writing skills to communicate findings and recommendations to clients

Excellent communication skills to discuss observations and negotiate the acquisition of data for testing and reporting on internal controls

Ability to work independently with clients and on project teams, and to lead a workstream

Ability and willingness to supervise and develop team members

Commercial awareness: an understanding of how scope, budget and staffing drive client value and engagement economics

Ability to conduct research on regulatory guidance, current industry standards and trends, and new legislation and requirements

Knowledge of how to effectively leverage firm approved AI tools to enhance problem-solving and productivity and the ability to exercise sound judgment around AI-related risks and considerations

Ability to assess and articulate the evolving risks that AI presents to clients across multiple risk domains, including AI embedded in vendor products and services

To qualify for the role, you must have

A bachelor's degree in Accounting, Finance, Business Administration, Economics, Risk Management, Public Administration or a related discipline; a master's degree is a plus.

A minimum of 3 years of relevant experience in internal audit, internal controls, OMB Circular A-123, financial statement audit, audit readiness and control remediation, enterprise risk management, third-party or vendor risk management, compliance or resilience, with a public accounting firm, a professional services firm, a government organization or within industry.

Experience leading a workstream or significant engagement tasks and reviewing the work of others.

U.S. citizenship and the ability to obtain and maintain a Secret clearance or higher.

Flexibility to travel based on client and project needs. Our staffing model assigns professionals to projects aligned to their office's metropolitan area; for federal roles, flexibility to travel up to approximately 30% is preferred, and state, local and education roles may require more.

Ideally, you'll also have

Experience with OMB Circular A-123 assessments, financial statement audit, attestation, audit readiness and remediation.

Working knowledge of the US Standard General Ledger (USSGL) and the Statements of Federal Financial Accounting Standards (SFFAS).

Experience building or operating ERM, third-party or vendor risk management, or continuity and resilience programs, including application of standards such as ISO 22301, ISO 31000 or NIST SP 800-34.

Familiarity with state internal control and internal audit statutes (e.g., Massachusetts Chapter 647 of the Acts of 1989, the New York State Governmental Accountability, Audit and Internal Control Act, Section 215.86 of the Florida Statutes, the Texas Internal Auditing Act and the California State Leadership Accountability Act).

Hands-on experience with GRC platforms (e.g., Archer, Optro (formerly AuditBoard), ServiceNow), third-party risk management platforms (e.g., ServiceNow Vendor Risk Management, Archer Third Party Governance, OneTrust, ProcessUnity), vendor risk intelligence tools (e.g., BitSight, SecurityScorecard) and analytics tools (e.g., Power BI, Tableau, Alteryx).

A relevant certification held or in progress, such as CPA, CIA, CGFM, CDFM, RIMS-CRMP, CTPRP or CBCP.

What we look for

At EY, we know it's your point of view, energy and enthusiasm that make the difference. Top performers have experience delivering project plans on large, complex engagements from analysis through implementation. We also look for Seniors who go beyond delivery: people who have contributed to proposals, built reusable tools or methods, coached others and grown client relationships.

What we offer you

At EY, we harness our collective strength to empower you to shape your future with confidence through professional growth, personal fulfillment and an inclusive culture. Learn more at ey.com/us/careers.

We offer a comprehensive compensation and benefits package where you’ll be rewarded based on your performance and recognized for the value you bring to the business. The base salary range for this job is:

New York City, Boston, and Washington DC Metro Areas, Washington State, and Southern California offices – $105,400 to $175,400

Bay Area California offices – $109,700 to $182,800

All other offices locations in the US, including Sacramento – $87,800 to $160,900

Individual salaries within these ranges are determined through a wide variety of factors including but not limited to education, experience, knowledge, skills and geography. In addition, our Total Rewards package includes medical and dental coverage, pension and 401(k) plans, and a wide range of paid time off options.

Under our flexible vacation policy, you’ll decide how much vacation time you need based on your own personal circumstances. You’ll also be granted time off for designated EY Paid Holidays, Winter/Summer breaks, Personal/Family Care, and other leaves of absence when needed to support your physical, financial, and emotional well-being.

Are you ready to shape your future with confidence? Apply today.

To make the most of your application experience, please limit yourself to two applications within a six-month period.

EY accepts applications for this position on an on-going basis.

For those living in California, please click here for additional information.

At EY, our values set the foundation for how we work and the behaviors we expect of our people. Any misrepresentation or falsification of information or lack of integrity at any point in the recruiting process may result in withdrawal of your candidacy, revocation of an offer or immediate termination of employment.

EY | Building a better working world

EY is building a better working world by creating new value for clients, people, society and the planet, while building trust in capital markets.

Enabled by data, AI and advanced technology, EY teams help clients shape the future with confidence and develop answers for the most pressing issues of today and tomorrow.

EY teams work across a full spectrum of services in assurance, consulting, tax, strategy and transactions. Fueled by sector insights, a globally connected, multi-disciplinary network and diverse ecosystem partners, EY teams can provide services in more than 150 countries and territories.

All in to shape the future with confidence.

EY provides equal employment opportunities to applicants and employees without regard to race, color, religion, age, sex, sexual orientation, gender identity/expression, pregnancy, genetic information, national origin, protected veteran status, disability status, or any other legally protected basis, including arrest and conviction records, in accordance with applicable law.

EY is committed to providing reasonable accommodation to qualified individuals with disabilities including veterans with disabilities. If you have a disability and either need assistance applying online or need to request an accommodation during any part of the application process, please call 1-800-EY-HELP3, select Option 2 for candidate related inquiries, then select Option 1 for candidate queries and finally select Option 2 for candidates with an inquiry which will route you to EY’s Talent Shared Services Team (TSS) or email the TSS at [email protected].