Specialist III Business Risk & Controls

Role Overview The Risk & Controls Manager is a core member of the Business Transformation Program Operations team and serves as the business authority for risk, controls, and segregation of duties (SoD) requirements across the ERP implementation. This full‑time, dedicated role lasts the transformation program (approximately 5‑7 years) and requires a flexible/hybrid work schedule: 3 in‑person days and 2 remote days at one of the core locations (Salisbury, NC; Quincy, MA; Scarborough, ME). Essential Job Functions Business Process Controls Ownership Lead the definition, documentation, and governance of business process controls across all in-scope ERP processes; ensuring controls reflect key business risks and align with ADUSA Risk & Controls frameworks and standards. Contribute to the design criteria and requirements for business process controls during process design, ensuring appropriate risk and control considerations are embedded. Own the design and maintenance of SoD rulesets from a business risk perspective, defining unacceptable conflicts, required mitigating controls, and process-driven access principles. Drive end-to-end mapping of controls to business process definitions, flows, and global templates, ensuring the control logic follows the process and is consistent across banners and functions. Risk & Controls Framework & Documentation Develop and maintain business-owned components of the ERP control documentation, including RACMs, control narratives, process flows, test scripts, and evidence standards; ensuring alignment with ADUSA Risk & Controls documentation standards. Identify and communicate control gaps, redundancies, and optimization opportunities; support business owners and ADUSA R&C in developing practical remediation actions with clear timelines and risk prioritization. Govern the documentation and design of mitigating controls (including those supporting SoD conflicts) in accordance with ADUSA R&C guidance and business operating realities. Partnership with Technology Serve as the authoritative source of business control requirements for Tech, SAP Security, and GRC teams to translate into system-enforced controls, role design, and access governance processes. Review system role designs and access models to ensure alignment to business-defined SoD and control expectations. Audit & Assurance Alignment Coordinate with ADUSA Risk & Controls to understand enterprise audit expectations and ensure business-owned control documentation supports effective audit readiness. Engage Internal Audit and External Audit as needed via ADUSA R&C to clarify expectations, understand upcoming assurance needs, and support pre-validation activities of business-owned control documentation and evidence. Support the planning and execution of business control testing during SIT/UAT in partnership with program testing teams and ADUSA R&C. Program Oversight & Governance Represent Business Controls in ERP design sessions, fit-gap workshops, and Business Transformation governance forums, ensuring risk and control requirements are intentionally embedded. Provide oversight and challenge to the System Integrator regarding control design completeness and process risk considerations. Provide program leadership with transparent reporting on business control readiness, risk exposure, and required decision-making. Cross-Functional Integration Maintain formal, ongoing alignment with the central Risk & Controls team to ensure consistency in frameworks, methodologies, and enterprise audit expectations. Ensure business teams understand, adopt, and operate to the approved control designs as part of change readiness and operational transition. Additional job duties may be assigned as needed to meet the needs of the business and support company values. Qualifications Applicants must be currently authorized to work in the United States on a full-time basis until the end of their appointment. 8+ years of experience in internal controls, business process risk management, audit, or governance roles supporting end-to-end process transformation or ERP. Deep expertise in business process risk & control design within large-scale ERP transformations (preferably SAP), with the ability to translate business risks into control requirements and align documentation to an enterprise Risk & Controls framework. Experience collaborating with technology teams to translate business control requirements into system role, SoD principles, and security models. Strong knowledge of SOX, COSO, business process controls, and audit methodologies. Proven ability to influence in matrixed environments across business, finance, and technology. Strong communication, facilitation, documentation, and stakeholder management skills. Ability to articulate risk and control implications of business process design decisions. Experience working with internal and external auditors on large transformation programs. Ability to manage multiple priorities in a large, fast-moving transformation program. Ability to travel up to 25%. Preferred Qualifications Professional certifications: CPA, CIA, CRISC, or CFE. Retail grocery/CPG experience with exposure to store operations, merchandising, supply chain, and finance processes. Working knowledge of mitigating control design, access governance principles, and SoD frameworks. Salary Range

ME/NC/PA/SC: $75,040 – $112,560

IL/MA/MD/NY: $86,320 – $129,480