Chief Audit Executive

Chief Audit Executive

The Chief Audit Executive ("CAE") serves as the senior executive responsible for the Bank's independent Internal Audit function and is accountable for providing the Audit Committee and executive management with objective assurance regarding the effectiveness of internal control, including governance, risk management, regulatory compliance, and key strategic initiatives.

Consistent with Federal Reserve Supervisory Letter SR 13-1, the CAE is responsible for establishing and maintaining an Internal Audit function that possesses sufficient authority, stature, independence, resources, technology, and expertise to effectively evaluate and improve the organization's governance, risk management, and internal control framework. The CAE reports functionally to the Audit Committee of the Board of Directors and administratively to the Chief Executive Officer.

The CAE leads a scalable, risk-focused audit function that evolves with the Bank's acquisition-driven growth strategy and supports a more enterprise-wide, risk-based model capable of assessing common processes, strategic initiatives, technology transformation, emerging risks, and market-level risk considerations across the organization.

The CAE serves as a trusted advisor to the Audit Committee, executive management, regulators, and external auditors while preserving the independence and objectivity of the Internal Audit function, including by maintaining clear advisory guardrails and avoiding management decision-making responsibilities.

Provide independent assurance to the Audit Committee regarding the effectiveness of governance, risk management, regulatory compliance, and internal control processes.

Maintain an Internal Audit function that is independent of business line management and free from interference in determining audit scope, performing audit procedures, communicating results, and evaluating risk.

Ensure Internal Audit possesses sufficient organizational stature, staffing, specialized expertise, technology capabilities, and budgetary resources to effectively fulfill its responsibilities.

Establish and maintain clear advisory guardrails and triggers for early Internal Audit involvement in strategic initiatives, key operational projects, technology transformation, and acquisition-related activities while preserving independence.

Clarify the roles and responsibilities of Internal Audit in relation to Enterprise Risk Management, SOX/FDICIA readiness, Compliance, and the broader Three Lines model.

Provide regular executive-session reporting to the Audit Committee regarding significant risks, control issues, audit results, emerging risk trends, thematic observations, and the overall condition of the internal control environment.

As the Bank grows through acquisitions, ensure changes to the Internal Audit operating model, resources, coverage, and integration activities are appropriately reported to and approved by the Audit Committee.

Direct a comprehensive enterprise-wide risk assessment process and develop a dynamic, risk-based audit plan that addresses the organization's most significant risks, control activities, strategic initiatives, regulatory expectations, and emerging risk themes.

Modernize and maintain the audit universe to support enterprise-wide, horizontal, and integrated reviews across common processes, systems, products, markets, and acquired entities.

Align Internal Audit's risk assessment framework to common industry risk categories and the Bank's evolving risk taxonomy, including credit, market, operational, compliance, technology, cybersecurity, BSA/AML, third-party, model, financial reporting, and strategic risks.

Evaluate the maturity of Enterprise Risk Management and use ERM outputs, when sufficiently mature, as inputs into audit universe, engagement risk assessment, and thematic risk analysis.

Periodically reassess audit priorities based on changes in the Bank's risk profile, business strategy, acquisitions, technology, regulatory expectations, remediation trends, and emerging risks.

Maintain documented audit methodologies, reporting standards, workpaper expectations, issue rating definitions, validation procedures, and professional practices aligned with regulatory guidance and Institute of Internal Auditors standards.

Standardize issue rating, management action plan, validation, closure evidence, and remediation expectations to promote consistency, transparency, and stakeholder understanding.

Ensure audit recommendations and management action plans are aligned to the mitigation of identified risks, with clear accountability, remediation expectations, validation requirements, and closure criteria.

Maintain a Quality Assurance and Improvement Program ("QAIP") and ensure periodic internal and external assessments of the Internal Audit function.

Establish and monitor performance metrics that assess audit quality, stakeholder feedback, issue management effectiveness, advisory value, risk identification, and progress against strategic improvement initiatives.

Incorporate new or evolving IIA requirements, including Topical Area Standards, into audit programs, methodologies, and quality practices as applicable.

Lead the effective implementation and ongoing optimization of Internal Audit technology platforms, including audit management systems, automated reporting, workflow tools, and data analytics capabilities.

Develop and execute a data analytics strategy that embeds analytics across audit planning, fieldwork, testing, issue monitoring, reporting, and continuous monitoring activities.

Establish governance, standards, documentation expectations, and quality controls for the appropriate use of artificial intelligence within Internal Audit, including appropriate challenge and documentation of AI-generated outputs.

Evaluate and use AI-enabled audit tools and agents, where appropriate, to improve risk assessment, audit program development, population-based testing, control testing, reporting, and capacity management.

Ensure Internal Audit's use of technology, automation, data analytics, and AI remains aligned with the Bank's adoption pace, risk appetite, regulatory expectations, and professional standards.

Develop and maintain a capability-based talent plan that aligns Internal Audit staffing, skills, training, succession planning, and sourcing strategies to the Bank's audit universe, strategic plan, growth objectives, and evolving risk profile.

Establish a formal skills assessment process at both the individual and department levels, including specialized needs in information technology, cybersecurity, compliance, BSA/AML, model risk, data analytics, SOX/FDICIA, and emerging technologies.

Develop a strategic staffing plan over a multi-year horizon that considers acquisitions, regulatory expectations, use of AI and automation, hybrid or remote staffing options, staff augmentation, and co-sourcing or outsourcing needs.

Oversee co-sourced or outsourced audit activities, including provider selection, scope definition, quality assurance, deliverables, knowledge transfer, regulatory expectations, and independence considerations.

Reduce reliance on third-party providers for recurring core audit capabilities over time by building internal expertise where appropriate, while continuing to use specialized providers for targeted subject matter expertise or surge capacity.

Develop and track department-level and individual-level training and development plans tied to department needs, employee career goals, new regulations, emerging technologies, and industry trends.

Build and maintain trusted, constructive relationships with the Audit Committee, executive management, regulators, external auditors, business line leaders, and control functions while preserving Internal Audit independence.

Develop an engagement model for Internal Audit's non-decisioning advisory involvement in key projects, strategic initiatives, technology changes, acquisitions, and process redesign efforts.

Identify and assess key risk considerations during project execution to help support well-designed governance, risk management, and control environments upon implementation.

Implement a formal stakeholder feedback mechanism, with periodic reporting to the Audit Committee and remediation expectations when feedback trends indicate opportunities to improve Internal Audit service delivery, communication, or consistency.

Promote stakeholder understanding of Internal Audit's role, independence, methodology, issue rating approach, remediation expectations, and advisory boundaries through communication tools such as Audit 101 materials and engagement kickoff discussions.

Deliver timely, accurate, risk-focused, and actionable reporting to management and the Audit Committee regarding audit results, issue status, remediation progress, thematic trends, emerging risks, and assurance gaps.

Shift Internal Audit reporting toward a risk-first perspective that explains the risks to the audited area, the effect of identified issues on unmitigated risk, and the alignment of recommendations and management action plans to risk mitigation.

Enhance Audit Committee and management reporting to include enterprise themes, forward-looking risk insights, control environment observations, remediation trends, integrated assurance considerations, and data-supported analysis.

Develop dashboards and recurring reports that provide timely visibility into audit coverage, quality, remediation, issue aging, stakeholder feedback, and value delivery.

Maintain a forward-looking Internal Audit improvement roadmap with accountable owners, milestones, target dates, performance measures, and periodic reporting to executive management and the Audit Committee.

Continuously enhance Internal Audit methodology, technology, talent, reporting, and stakeholder engagement to support the Bank's long-term growth objectives and changing risk environment.

Develop integration plans for acquired resources, processes, systems, audit coverage, and control environments resulting from acquisition activity.

Coordinate with Risk, Compliance, SOX/FDICIA, and other assurance functions to support integrated assurance, reduce duplication, and strengthen enterprise-wide visibility into risk and control coverage.

This role works in a standard office environment and involves extended periods at a computer, regular communication in person and by phone, and occasional lifting of items up to 25 pounds. The Bank will provide reasonable accommodations to enable individuals with disabilities to perform the essential functions of this position.

Regular and reliable attendance and punctuality are required for this position. Must be able to perform the essential functions of this position with or without reasonable accommodation.