Government and Infrastructure-Risk Consulting-Enterprise Risk, Controls and Resilience - Manager

Government and Infrastructure-Risk Consulting-Enterprise Risk, Controls and Resilience - Manager

Location: McLean

Other locations: Primary Location Only

Requisition ID: 1757732

At EY, we’re all in to shape your future with confidence.

We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go. Join EY and help to build a better working world.

Government & Infrastructure – Consulting – Risk Consulting – Enterprise Risk, Controls & Resilience – Manager

The Opportunity

From strategy to execution, the Government & Infrastructure (G&I) practice of Ernst & Young LLP provides a full range of consulting and audit services to help our Federal, State, Local and Education clients implement new ideas to help achieve their mission outcomes. We deliver real change and measurable results through our diverse, high-performing teams, quality work at the highest professional standards, operational know-how from across our global organization, and creative and bold ideas that drive innovation. We enable our government clients to achieve their mission of protecting the nation and serving the people; increasing public safety; improving healthcare for our military, veterans and citizens; delivering essential public services; and helping those in need. EY is ready to help our government build a better working world.

Within G&I Risk Consulting, we help government organizations understand and manage risks that can affect mission outcomes, financial performance, operations and public trust. Our teams build and operate the programs that strengthen governance and controls, improve resilience, prevent fraud and financial loss, manage grant and relief funds, enhance compliance, and enable better risk-informed decisions. Across our work, we use data, AI, automation and technology platforms to improve how risks are identified, assessed, monitored and managed.

Our Enterprise Risk, Controls & Resilience team helps government organizations govern risk, strengthen controls and stay resilient. Our work spans internal controls management (including OMB Circular A-123 and Federal Managers' Financial Integrity Act requirements), internal audit, integrated and enterprise risk management (ERM), enterprise resilience, third-party risk management (including vendor risk management), and ethics and regulatory compliance. We design, transform and operate these programs, using AI, data analytics and Governance, Risk, and Compliance (GRC) platforms to automate control testing and monitoring, so that government organizations can achieve and sustain clean audit opinions and make risk-informed decisions.

As a Risk Consulting Manager in our Enterprise Risk, Controls & Resilience team, you may be assigned to one or more government agencies as your primary clients. You will lead engagements or major workstreams, own engagement quality and economics, develop our people and play an active role in growing the practice by shaping offerings, building client relationships and leading pursuits. You will be a key team member in the development and growth of our G&I Risk business, which is a priority for our firm.

Your key responsibilities

Client delivery and engagement leadership

• Lead internal controls (including OMB Circular A-123, audit readiness and control remediation), internal audit, integrated and enterprise risk management, third-party risk, ethics and regulatory compliance, or enterprise resilience engagements or major workstreams, from planning through closure.

• Serve as a direct point of contact for agency leaders, such as CFO, Chief Risk Officer, internal audit and program leaders, including status reporting, managing expectations and resolving issues.

• Advise on control and risk program design, including governance, risk appetite, A-123 and state internal control assessment strategy, audit-readiness roadmaps, internal audit transformation, ERM and third-party risk operating models, compliance programs and resilience programs.

• Lead the design, build and operation of third-party risk management programs, including governance and policy, risk appetite for vendor relationships, inherent risk tiering, risk-based due diligence standards, contract requirements, ongoing monitoring and offboarding, and advise leaders on critical vendor concentration and fourth-party dependencies.

• Own engagement economics: budget-to-actuals, contract terms, burn rates, staffing mix, change requests and margin.

• Design the delivery approach, including which testing, documentation, vendor assessment and reporting work is delivered through our Service Delivery Center (SDC), and set requirements, quality standards and acceptance criteria for that work.

• Review and approve deliverables to make sure they meet EY quality and risk management standards and working paper documentation standards.

• Hold difficult conversations with team members and clients professionally and on time.

Practice and people development

• Shape offerings, methodologies and accelerators in internal controls, internal audit, ERM, third-party risk, compliance and resilience, including AI-enabled testing, controls monitoring and third-party risk assessments delivered as a managed service; contribute to thought leadership.

• Delegate, supervise and review the work of multiple Staff and Seniors, and provide timely feedback and career advice.

• Serve as a formal counselor to Staff and Seniors, including coaching and participating in the firm-wide performance review process.

• Recruit, interview and onboard talent.

• Identify, shape and qualify new opportunities, for example from audit results, oversight findings, vendor-related incidents or new mission requirements, with existing and new clients.

• Lead proposal and orals development (solution, staffing model, pricing inputs and win themes) with Senior Managers and Partners.

• Build account knowledge: client mission priorities, audit and risk posture, budget cycles, contract vehicles and upcoming needs.

Skills and attributes for success

• Understanding of internal control and risk frameworks such as the GAO Green Book, COSO Internal Control and COSO ERM, and OMB Circular A-123, including control testing design and execution and risk and control self-assessment

• Understanding of enterprise risk concepts such as risk identification, risk appetite and tolerance, key risk indicators, scenario analysis, third-party risk and business continuity planning

• Knowledge of, or experience with, federal business processes such as funds management, budget formulation and execution, receivables, disbursements, property management, human resources, financial reporting and grants management, or comparable state, local and education processes such as benefits programs

• Knowledge of working paper documentation standards and internal audit standards (e.g., IIA Global Internal Audit Standards, GAGAS)

• Deep knowledge of third-party risk management practices and the ability to design operating models and maturity roadmaps

• Experience conducting resilience activities such as business impact analyses, critical process identification, dependency mapping, scenario analysis, tabletop exercises, recovery testing, and resilience assessments and roadmaps

• Strong report-writing skills to communicate findings and recommendations to clients

• Excellent communication skills to discuss observations and negotiate the acquisition of data for testing and reporting on internal controls

• Project and people management skills and experience, including leading blended teams that use onshore delivery centers

• Ability and willingness to supervise and develop team members

• Ability to conduct research on regulatory guidance, current industry standards and trends, and new legislation and requirements

• Knowledge of how to effectively leverage firm approved AI tools to enhance problem-solving and productivity and the ability to exercise sound judgment around AI-related risks and considerations

• Ability to assess and articulate the evolving risks that AI presents to clients across multiple risk domains, including AI embedded in vendor products and services

To qualify for the role, you must have

• A bachelor's or master's degree in Accounting, Finance, Business Administration, Economics, Risk Management, Public Administration or a related discipline.

• A minimum of 5 years of relevant experience in internal audit, internal controls, OMB Circular A-123, financial statement audit, audit readiness and control remediation, enterprise risk management, third-party or vendor risk management, compliance or resilience, with a public accounting firm, a professional services firm, a government organization or within industry.

• Demonstrated experience managing engagements or workstreams, including budgets and teams, and contributing to proposals or business development.

• A US certification in at least one of the following: CPA, CIA, CGFM, CDFM, CA, CMA, RIMS-CRMP, FRM, CTPRP or CBCP.

• U.S. citizenship and the ability to obtain and maintain a Secret clearance or higher.

• Due to the nature of our work in G&I, work may be required at client, EY and/or contractor sites. Our goal is to assign professionals to projects within a commutable distance of their work location office; in certain circumstances, travel may be required beyond your work location based on client and project needs. Candidates should be willing to travel on average 25% to 30% or more in a hybrid environment.

Ideally, you’ll also have

• Working knowledge of the US Standard General Ledger (USSGL) and the Statements of Federal Financial Accounting Standards (SFFAS).

• Experience designing or leading ERM, third-party or vendor risk management, compliance, or enterprise, business continuity or operational resilience programs (e.g., applying ISO 22301, ISO 31000 or NIST SP 800-34), or controls monitoring delivered as a managed service.

• Experience implementing or configuring third-party risk management platforms (e.g., ServiceNow Vendor Risk Management, Archer Third Party Governance, OneTrust, ProcessUnity) and integrating vendor risk intelligence sources (e.g., BitSight, SecurityScorecard).

• Familiarity with state internal control and internal audit statutes (e.g., Massachusetts Chapter 647 of the Acts of 1989, the New York State Governmental Accountability, Audit and Internal Control Act, Section 215.86 of the Florida Statutes, the Texas Internal Auditing Act and the California State Leadership Accountability Act).

• Existing relationships with federal or state agencies and experience pursuing work on government contract vehicles.

• PMP or a similar project management certification.

What we look for

At EY, we know it's your point of view, energy and enthusiasm that make the difference. Top performers have experience delivering project plans on large, complex engagements from analysis through implementation. They have experience with federal or state agencies, often gained by working in a Big Four global management consulting firm or a blue-chip company focused on government and the public sector. Just as important is a track record beyond delivery: offerings built, proposals led and client relationships expanded.

What we offer you
At EY, we harness our collective strength to empower you to shape your future with confidence through professional growth, personal fulfillment and an inclusive culture. Learn more at ey.com/us/careers.

• We offer a comprehensive compensation and benefits package where you’ll be rewarded based on your performance and recognized for the value you bring to the business. The base salary range for this job is:
• New York City, Boston, and Washington DC Metro Areas, Washington State, and Southern California offices – $134,000 to $223,300
• Bay Area California offices – $139,500 to $232,700
• All other offices locations in the US, including Sacramento – $111,600 to $204,700
• Individual salaries within these ranges are determined through a wide variety of factors including but not limited to education, experience, knowledge, skills and geography. In addition, our Total Rewards package includes medical and dental coverage, pension and 401(k) plans, and a wide range of paid time off options.
• Under our flexible vacation policy, you’ll decide how much vacation time you need based on your own personal circumstances. You’ll also be granted time off for designated EY Paid Holidays, Winter/Summer breaks, Personal/Family Care, and other leaves of absence when needed to support your physical, financial, and emotional well-being.

EY | Building a better working world

EY is building a better working world by creating new value for clients, people, society and the planet, while building trust in capital markets.

Enabled by data, AI and advanced technology, EY teams help clients shape the future with confidence and develop answers for the most pressing issues of today and tomorrow.

EY teams work across a full spectrum of services in assurance, consulting, tax, strategy and transactions. Fueled by sector insights, a globally connected, multi-disciplinary network and diverse ecosystem partners, EY teams can provide services in more than 150 countries and territories.

All in to shape the future with confidence.

EY provides equal employment opportunities to applicants and employees without regard to race, color, religion, age, sex, sexual orientation, gender identity/expression, pregnancy, genetic information,national origin, protected veteran status, disability status, or any other legally protected basis, including arrest and conviction records, in accordance with applicable law.

EY is committed to providing reasonable accommodation to qualified individuals with disabilities including veterans with disabilities. If you have a disability and either need assistance applying online or need to request an accommodation during any part of the application process, please call 1-800-EY-HELP3, select Option 2 for candidate related inquiries, then select Option 1 for candidate queries and finally select Option 2 for candidates with an inquiry which will route you to EY’s Talent Shared Services Team (TSS) or email the TSS at View email address on click.appcast.io .

Select how often (in days) to receive an alert:

EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients.