Specialist III Business Risk & Controls

Category/Area of Expertise: Audit Job Requisition: 497898 Address: USA-MA-Quincy-1385 Hancock Street Store Code: Strategy - Office of CEO (5144165) The Risk & Controls Manager is a core member of the Business Transformation Program Operations team and serves as the business authority for risk, controls, and segregation-of-duties (SoD) requirements across the ERP implementation. This role is responsible for defining, governing, and maintaining enterprise-aligned business process controls, SoD rulesets, and end-to-end process-level risk management. A critical element of this position is ensuring that existing business processes, control frameworks, and operational guardrails are fully understood, reconciled, and integrated into future-state solution design. The Risk & Controls Manager partners closely with process owners to identify required control capabilities, challenge gaps in future-state design, and ensure the transformed processes preserve or improve control effectiveness. The role works across Technology, Internal Audit, External Audit, and the System Integrator to ensure that transaction integrity, approvals, reconciliations, and reporting safeguards are embedded in business design—not dependent on underlying system configuration alone. The position evaluates unacceptable control conflicts, validates SoD principles, and ensures risk mitigation strategies are consistent with enterprise standards and the broader Risk & Controls organization. The Risk & Controls Manager ensures the ERP program is audit-ready by delivering clear, sustainable, and auditable business process controls that align to enterprise policy, reduce operational risk, and support a scalable, well-governed ERP environment. This is a full-time, dedicated role for the duration of the transformation program (estimated 5-7 years). Our flexible/hybrid work schedule includes 3 in-person days at one of our core locations and 2 remote days. Our core office locations include Salisbury, NC, Quincy, MA, Scarborough ME. Essential job functions: Lead the definition, documentation, and governance of business process controls across all in-scope ERP processes; ensuring controls reflect key business risks and align with ADUSA Risk & Controls frameworks and standards. Contribute to the design criteria and requirements for business process controls during process design, ensuring appropriate risk and control considerations are embedded. Own the design and maintenance of SoD rulesets from a business risk perspective, defining unacceptable conflicts, required mitigating controls, and process driven access principles. Drive end-to-end mapping of controls to business process definitions, flows, and global templates, ensuring the control logic follows the process and is consistent across banners and functions. Risk & Controls Framework & Documentation: Develop and maintain business-owned components of the ERP control documentation, including RACMs, control narratives, process flows, test scripts, and evidence standards; ensuring alignment with ADUSA Risk & Controls documentation standards. Identify and communicate control gaps, redundancies, and optimization opportunities; support business owners and ADUSA R&C in developing practical remediation actions with clear timelines and risk prioritization. Govern the documentation and design of mitigating controls (including those supporting SoD conflicts) in accordance with ADUSA R&C guidance and business operating realities. Partnership with Technology: Serve as the authoritative source of business control requirements for Tech, SAP Security, and GRC teams to translate into system-enforced controls, role design, and access governance processes. Review system role designs and access models to ensure alignment to business-defined SoD and control expectations. Audit & Assurance Alignment: Coordinate with ADUSA Risk & Controls to understand enterprise audit expectations and ensure business-owned control documentation supports effective audit readiness. Engage Internal Audit and External Audit as needed—via ADUSA R&C—to clarify expectations, understand upcoming assurance needs, and support pre-validation activities of business-owned control documentation and evidence. Support the planning and execution of business control testing during SIT/UAT in partnership with program testing teams and ADUSA R&C. Program Oversight & Governance: Represent Business Controls in ERP design sessions, fit-gap workshops, and Business Transformation governance forums, ensuring risk and control requirements are intentionally embedded. Provide oversight and challenge to the System Integrator regarding control design completeness and process risk considerations. Provide program leadership with transparent reporting on business control readiness, risk exposure, and required decision-making. Cross-Functional Integration: Maintain formal, ongoing alignment with central Risk & Controls team to ensure consistency in frameworks, methodologies, and enterprise audit expectations. Ensure business teams understand, adopt, and operate to the approved control designs as part of change readiness and operational transition. Additional job duties may be assigned as needed to meet the needs of the business and support our values. Qualifications: Applicants must be currently authorized to work in the United States on a full-time basis until the end of their appointment. 8+ years of experience in internal controls, business process risk management, audit, or governance roles supporting end-to-end process transformation or ERP. Deep expertise in business process risk & control design within large-scale ERP transformations (preferably SAP), with the ability to translate business risks into control requirements and align documentation to an enterprise Risk & Controls framework. Experience collaborating with technology teams to translate business control requirements into system role, SoD principles, and security models. Strong knowledge of SOX, COSO, business process controls, and audit methodologies. Proven ability to influence in matrixed environments across business, finance, and technology. Strong communication, facilitation, documentation, and stakeholder management skills. Ability to articulate risk and control implications of business process design decisions. Experience working with internal and external auditors on large transformation programs. Ability to manage multiple priorities in a large, fast-moving transformation program. Ability to travel up to 25%. Preferred Qualifications: Professional certifications: CPA, CIA, CRISC, or CFE. Retail grocery/CPG experience with exposure to store ops, merchandising, supply chain, and finance processes. Working knowledge of mitigating control design, access governance principles, and SoD frameworks. ME/NC/PA/SC Salary Range: $92,640 - $138,960 IL/MA/MD/NY Salary Range: $106,480- $159,720 Actual compensation offered to a candidate may vary based on their unique qualifications and experience, internal equity, and market conditions. Final compensation decisions will be made in accordance with company policies and applicable laws. #J-18808-Ljbffr Loyalty360