Director of Audit Services

Job Summary:
The Director of Audit Services serves as the senior executive responsible for leading Erlanger's Internal Audit function and advancing organizational integrity, accountability, and performance. This role provides independent and objective assurance and advisory services designed to improve internal controls, operational efficiency, information technology processes, cybersecurity resilience, and governance practices.

This position ensures the effective execution of a risk-based internal audit plan, oversees the development of modern audit methodologies (including data analytics and continuous monitoring), and provides strategic insight to Executive Leadership and the Audit & Finance Committee. The Director also partners with management to drive process improvement, operational excellence, and the maturity of the enterprise risk management (ERM) framework.

The Director Audit Services assists the organization in accomplishing its objectives and financial stewardship by bringing a systematic and disciplined approach to evaluate and improve the effectiveness of the system of internal controls, operational controls, financial controls, risk assessment practices, information technology processes, and governance methods.
Audit Services achieves this by performing the following essential functions:
- Perform annual risk assessments to identify areas of high risk for audit consideration, as well as to contribute to enterprise risk management processes;
- Conduct operational, financial, and technology audits of the highest risks of the organization; and
- Perform independent reviews and consulting services to improve the operating and internal control environment of Erlanger.

The Director of Audit Services must have the ability to design audits to meet audit objectives that address the highest of risks to the organization. The position must present professionally written reports and effectively present audit results to executive leadership, the Audit & Finance Committee, and other groups.


The Director of Audit Services will manage the department budget; mentor, supervise, and provide development to the internal audit staff; and provide direct oversight/review of work product. The Director of Audit Services handles confidential information with maturity and discretion and recruits and develops internal audit staff.


Additional activities performed by Audit Services may include:
- Assessments: Assessments are provided as objective observations. These summaries are provided to management for immediate correction.
- Special Projects: Special Projects are assessments of business processes, internal controls, or compliance incidents based on an inquiry, reported concern, or observation of weaknesses in processes. These summaries are provided to management for immediate correction.
- Reviews and Assurance Audits: Assurance Audits are objective reviews of evidence to provide an independent assessment. The scope of assurance audits include analysis and evaluation of the operational efficiencies, effectiveness, reliability of financial and operational systems; adequacy and clarity of policies and procedures; compliance with policy or laws; safeguarding of assets; and accomplishment of objectives and goals. Reviews are similar but generally are limited in scope and the objectives to be achieved.
- Consulting Services: Consulting services are meant as an advisory service and provide counsel, advice, facilitation, process design assistance, or training on specific subjects. Consulting services add value when an organization is during development or changing of processes, procedures, and controls. The scope of consulting must be agreed upon with management ahead of time to avoid misunderstandings. Audit Services will not assume management's responsibilities to maintain appropriate objectivity or independence.
- Investigations: Investigations evaluate allegations, inquiries or concerns and if substantiated, provide recommendations to improve controls and prevent future occurrences.
- Follow-up Engagements: Follow-up engagements evaluate management action plans to ensure that reported conditions are adequately corrected.

A written report or formal memo will be prepared and issued by the Director of Audit Services or designee following the conclusion of each review or assurance audit and will be distributed as appropriate. A summary of audit findings will be forwarded to the responsible management and executive leadership. Each finding will be risk ranked individually by the Director Audit Services, based on their judgment. Entity risk levels will also be assigned by the Director Audit Services for the reporting to the Audit and Finance Committee. Should there be unresolved disagreement about risk level assigned, the Director of Audit Services will seek the counsel of the Chief Legal Officer.

Education:
Required:
- Bachelor's degree in accounting, Business Administration, Healthcare or related field.


Preferred:
- MBA

Experience:
Required:
- Seven to ten years of previous experience in a progressive internal audit, compliance audit, information technology audit or public accounting environment, with significant exposure to hospital or health system compliance, financial, operational and IT risks/processes and cybersecurity.
- Advanced skills with excel spreadsheets, data analytics, and word processing needed.
- Five years minimum demonstrated effective management experience.

Key Skills & Abilities
- Individual should have excellent communication and organizational skills and the ability to prioritize and manage multiple projects concurrently, with conscientious attention to detail.


Position Requirement(s): License/Certification/Registration
Required:
- Must have or obtain within 2 years, the Certified in Healthcare Compliance (CHC), Certified Internal Auditor (CIA), Certified Public Accountant (CPA), or Certified Fraud Investigator designation.

Preferred:
- CIA, CHIA, CFE or CPA

Department Position Summary:
The Director of Audit Services operates as the lead executive for the Internal Audit Services function of the Organization. This key position oversees the performance of independent and objective assurance and consulting activities that are designed to add value by improving the organization's internal controls structure, IT processes, cybersecurity, organizational governance and operations. The Director Audit Services assists the organization in accomplishing its objectives and financial stewardship by bringing a systematic and disciplined approach to evaluate and improve the effectiveness of the system of internal controls, operational controls, financial controls, risk assessment practices, information technology processes, and governance methods.
Audit Services achieves this by performing the following essential functions:
- Perform annual risk assessments to identify areas of high risk for audit consideration, as well as to contribute to enterprise risk management processes;
- Conduct operational, financial, and technology audits of the highest risks of the organization; and
- Perform independent reviews and consulting services to improve the operating and internal control environment of Erlanger.

The Director of Audit Services reports functionally to the Audit and Finance Committee of the Board of Trustees and administratively to the Chief Financial Officer (CFO).
Professional Standards

The Director Audit Services will adhere to the standards of best professional practice, such as those published by the Institute of Internal Auditors (IIA) and the Information Systems Audit and Control Association (ISACA). The standards include the IIAs Code of Ethics that includes the auditing principles of integrity, objectivity, confidentiality, and competency. Further, the Director of Audit Services will maintain all organizational and professional ethical standards and ensures all compliance and internal audit activities are carried out/supervised in accordance with applicable regulations, laws or standards.


The Director of Audit Services must have the ability to design audits to meet audit objectives that address the highest risks to the organization. The position must present professionally written reports and present audit results to executive leadership and the Audit & Finance Committee.


The Director of Audit Services will manage the department budget; mentor, supervise, and provide development to the internal audit staff; and provide direct oversight/review of work product. The Director of Audit Services handles confidential information with maturity and discretion and recruits and develops internal audit staff.


Independence
The Director of Audit Services shall have no direct operational responsibility or authority over any of the activities audited or reviewed nor develop nor install controls, systems, or procedures, prepare materials, produce, or lead any management activity.


The Director Audit Services will remain free of influence by any element or persons in the organization, including matters of audit selection, scope, procedures, frequency, timing, or report content to permit maintenance of an independent and objective mental attitude necessary in rendering the reports and summaries.


Scope
The scope of Audit Services includes the examination and evaluation of the adequacy and effectiveness of the system of internal controls, operational controls, financial controls, risk assessment practices, information technology processes, cybersecurity. and governance methods. Thus, the Audit Services function performs internal, operational, compliance, financial and technology audits of programs, operations, technology, services, and departments. Additionally, this includes:
- Reviewing the means of safeguarding assets and technology systems;
- Reviewing activities, operations, or programs to determine if the results are consistent with established objectives and goals, or that the activities are working as planned, and if they are both efficient and effective;
- Reviewing systems to validate compliance with policies, plans, procedures, laws, and regulations which could have a significant impact on operations;
- Evaluating the effectiveness of the organization's risk-assessment practices established by the principles of COSO, COBiT, NIST and/or HiTrust; and
- Review the internal control and risk assessments performed by management.

Responsibility
The Director Audit Services has a responsibility to
- Inform and advise key leadership, management, and the Audit and Compliance Committee on significant or material deficiencies identified.
- Provide individual audit results to appropriate management in a timely manner.
- Provide summary reports and performance metrics to the Audit and Finance Committee, the CAO, CLO, CFO, and CEO or other executive management quarterly.
- Apprise the Audit and Finance Committee and the CAO, CLO, CFO, and CEO or other executive management on the status of addressing open-recommendations.
- Submit Annual Risk-Based Audit Plan and assessment for input and approval.


Annual Risk-Based Audit Planning
Annually, the Director Audit Services will submit to senior leadership and the Audit and Finance Committee a summary of the annual audit plan for the upcoming year. The audit plan is developed using a risk-based methodology. Any significant changes in the formally approved work schedule will be communicated to leadership and the Audit and Finance Committee through activity reports presented at the Audit and Finance Committee meetings.

Services and Activities
Activities performed by Audit Services may include:
- Assessments: Assessments are provided as objective observations. These summaries are provided to management for immediate correction.
- Special Projects: Special Projects are assessments of business processes, internal controls, or compliance incidents based on an inquiry, reported concern, or observation of weaknesses in processes. These summaries are provided to management for immediate correction.
- Reviews and Assurance Audits: Assurance Audits are objective reviews of evidence to provide an independent assessment. The scope of assurance audits include analysis and evaluation of the operational efficiencies, effectiveness, reliability of financial and operational systems; adequacy and clarity of policies and procedures; compliance with policy or laws; safeguarding of assets; and accomplishment of objectives and goals. Reviews are similar but generally are limited in scope and the objectives to be achieved.
- Consulting Services: Consulting services are meant as an advisory service and provide counsel, advice, facilitation, process design assistance, or training on specific subjects. Consulting services add value when an organization is during development or changing of processes, procedures, and controls. The scope of consulting must be agreed upon with management ahead of time to avoid misunderstandings. Audit Services will not assume management's responsibilities to maintain appropriate objectivity or independence.
- Investigations: Investigations evaluate allegations, inquiries or concerns and if substantiated, provide recommendations to improve controls and prevent future occurrences.
- Follow-up Engagements: Follow-up engagements evaluate management action plans to ensure that reported conditions are adequately corrected.

A written report or formal memo will be prepared and issued by the Director, Audit Services or designee following the conclusion of each review or assurance audit and will be distributed as appropriate. A summary of audit findings will be forwarded to the responsible management and executive leadership. Each finding will be risk ranked individually by the Director Audit Services, based on their judgment. Entity risk levels will also be assigned by the Director Audit Services for the reporting to the Audit and Finance Committee. Should there be unresolved disagreement about risk level assigned, the Director Audit Services will seek the counsel of the Chief Legal Officer.