Senior Internal Auditor

The Internal Audit (IA) team, working in partnership with all Business Units, reviews, assesses and recommends process and control enhancements. Business Units remain responsible for designing and operating necessary controls to protect and enhance Metrolinx assets and reputation.  

Participates in audits and projects that are primarily information system and control focused.  Other work may include financial, operational, internal control, value for money, and compliance audits and related risk assessments under the supervision of the Audit Manager.

Performs risk assessments for each assigned audit; develops process maps and documentation to support control gap analysis.

Designs and executes the test steps for each assigned audit under the supervision of the Manager.

Defines the business requirements to develop and maintain data-based analytics to test controls at the population level.

Performs audits in conformance with professional (IIA) and divisional standards and industry best practice, including working with co-sourced audit service providers and utilizing the IIA competency framework.

Leverages deep understanding and application of IT control and governance best practices to support their work, including ISACA IT governance, NIST cybersecurity and IIA GTAG frameworks.

Identifies and clearly defines audit issues and root causes; recommends improved internal controls and business processes;

Assists the Manager to maintain a database of management’s action plans; monitors action plans for timely implementation and considers the impact of significant subsequent operational changes.

Assists the Manager to maintain current information on the various sources of assurance across the organization (e.g., reviews, audits, evaluations, and assessments performed, conducted or procured by business areas or elsewhere in the organization); evaluates the extent to which reliance thereon can be placed.

Participates in overseeing audit compliance activities required by the Ministry of Transportation (MTO), the Office of the Auditor General of Ontario (OAGO), and other external audit functions, and assesses compliance with other regulatory bodies.

Participates in investigations and other special research or projects.

Assists the Manager to maintain a database of management’s action plans; monitors action plans for timely implementation, and considers the impact of significant subsequent operational changes.

Assists the Manager to maintain current information on the various sources of assurance across the organization (e.g., reviews, audits, evaluations, and assessments performed, conducted or procured by business areas or elsewhere in the organization); evaluates the extent to which reliance thereon can be placed.

Participates in overseeing audit compliance activities required by the Ministry of Transportation (MTO), the Office of the Auditor General of Ontario (OAGO), and other external audit functions, and assesses compliance with other regulatory bodies.

Participates in investigations and other special research or projects.

Assists the Manager with preparation of annual and long-term audit plans.

Assists the Manager and Director to maintain positive working relationships with MTO’s Internal Audit Team (MTO-IA) and the OAGO; liaises between external audit groups and Metrolinx technology and business units.

Works in partnership with IT and PRESTO Business Units to review and assess current processes, recommend pragmatic and sustainable solutions/enhancements, and engage fellow employees to actively identify and manage business risks and controls.

Develops and maintains a positive and productive working relationship with staff and management throughout the organization, with a ‘no surprises’ approach to audit work and findings

Liaises with external groups involved in internal audit to maintain an up-to-date working knowledge of best practices and techniques and develops a network of internal audit colleagues to exchange information.

Maintains an up-to-date knowledge of the standards and guidance included in the International Professional Practice Framework (IPPF) developed by the IIA; stays current with evolving knowledge in the field of Internal Auditing; maintains compliance with IIA standards and its Code of Ethics.

Maintain familiarity with current events and risk developments in the areas of IT Governance and Controls.

Assists with maintaining divisional procedures, manuals, and training materials and in updating them to reflects significant changes in professional or divisional standards.

Uses tools and technology, data, and judgment to be risk-focused and improve the quality and efficiency of internal audit work processes.

Provides audit progress updates to audit management.

Maintains a detailed record of time spent on projects and the timing of each audit stage; monitors for scope creep or time slippage; takes timely and appropriate corrective actions (e.g. modifying internal audit processes and tools) after consultation with the Manager.

Maintains a database of prior recommendations and management action plans, and performs timely follow-up to assess actions taken, and support preparation of related reports for management and the Board.

Maintains and demonstrates an appropriate level of understanding of the business areas and the demands faced by a large operating provincial agency.

Education: Completion of a degree in Business Administration, Accounting, Engineering, Information Technology, or a related discipline – or a combination of education, training and experience deemed equivalent

Experience: Demonstrated years of experience in a role managing risks, processes and controls within an Information Technology or Data Management perspective.  Preference will given for experience in industries with capital intensive projects, public sector information technology, or with an audit / consulting firm. 

Highly recommended that the candidate become a member of the Institute of Internal Auditors and Information Systems and Control Association and have current designations related to IT Audit and Security:

Examples of required designations:

ISACA designations: Certified Information Systems Auditor (CISA), Certified in the Governance of Enterprise IT (CGEIT), and Certified in Risk and Information Systems Control (CRISC)

Auditing/Accounting: Certified General Accountant (CGA), Chartered Professional Accountant - Certified Professional / Management Accountant (CPA, CMA), Chartered Professional Accountant / Chartered Accountant (CPA, CA), with preference given to CPA, CA due to the professional auditing skills obtained during the course of obtaining a CPA, CA designation

Continuing Education and desire to develop designations and certifications in auditing, project management, technology is preferred;

Other Relevant designations are highly recommended with priority given to auditing designations :

• Technology: Control Objectives for IT (CobiT); Information Technology Infrastructure Library (ITIL)

• Fraud: Certified Fraud Examiner (CFE) or Certified Forensic Investigator (CFI)

• IIA designations: Certified Internal Auditor (CIA), Certified Government Auditing Professional (CGAP), Certification in Control Self-Assessment (CCSA), Certification in Risk Management Assurance (CRMA), and Certified Financial Services Auditor (CFSA)

Knowledge and experience with the application of internal auditing standards and guidance in the International Professional Practice Framework (IPPF) and Code of Ethics issued by the IIA; experience following audit practice standards from the Canadian Institute of Chartered Accountants (CICA) would be an asse.

Experience in ingesting datasets from pubic and internal business sources into a cloud-based data warehouse, and able to process analytics to detect and report potential audit exceptions (experience using SQL, PowerBI, ACL, Databricks would be an asset).

Knowledge and experience with the of management information systems terminology, concepts and practices; experience following Information Systems Auditing Standards issued by the Information Systems and Control Association (ISACA) would be an asset.

Strong understanding and practical application of LEAN approaches, experience applying IT frameworks to enhance operational processes (e.g. COBIT, ITIL, NIST), and experience developing and advising on KPI implementation.

Analytical and problem-solving skills to identify root causes of anomalies and determine the best solution.

Experience with data analysis, data modeling, dashboarding, fraud detection, and risk management.

Oral/presentation and report-writing skills to assist in writing internal audit reports and summaries, and active participation in briefings to other staff and management.

Knowledge of complaint handling, of investigation methodologies, principles, and practices, of case management systems and of records management.

Interpersonal skills to establish and maintain harmonious working relationship with co-workers, staff and external contacts and work effectively within a professional multi-disciplinary team.

Experience and skill with preparing analyses, summaries, memos, and reports using computer applications including MS Office (Word, Excel, PowerPoint, Outlook, Access, Visio) and other business software to prepare reports, memos, summaries, and analyses; experience with audit-related software applications (e.g. ACL and TeamMate) would be an asset.