The Job

You will:

1. Audit Issue Identification and Assessment: Collaborate with internal and external auditors to identify control gaps and compliance issues. Review audit reports and findings to understand the root causes of issues

Review audit reports (internal and external) to identify control gaps, compliance issues, and operational inefficiencies
Conduct root cause analysis to determine the underlying reasons for audit findings
Assess the severity and risk level of identified issues to prioritize remediation efforts

2. Remediation Planning and Implementation: Develop and implement action plans to address audit findings and ensure timely resolution. Work with cross-functional teams to design and execute corrective actions

Develop detailed action plans with issue owners to address audit findings, including specific steps, timelines, and responsible parties
Ensure remediation plans align with organizational policies, regulatory requirements, and industry best practices

3. Tracking and Monitoring Remediation Progress: Maintain a centralized tracking system (e.g., audit issue log or database) to monitor the status of audit findings and remediation efforts. Ensure that remediation activities are completed within agreed timelines

Maintain a centralized system (e.g., audit issue log, GRC tool) to track the status of audit findings and remediation activities
Monitor progress against remediation timelines and escalate delays or roadblocks to senior management
Conduct follow-up reviews to verify that remediation actions have been effectively implemented

4. Reporting and Communication: Prepare regular reports for senior management and audit committees on the status of audit issues and remediation progress. Communicate with stakeholders, including auditors, and internal teams, to provide updates and ensure transparency

Prepare regular status reports for senior management, audit committees, and other stakeholders
Provide clear and concise updates on unresolved issues and potential risks

5. Compliance and Risk Management: Identify and maintain a single view of key controls and remediation actions across IT and mitigate risks associated with unresolved audit issues to ensure the timely resolution of control gaps and the treatments align with regulatory requirements and organizational policies

Ensure that remediation efforts comply with applicable laws, regulations, and organizational policies
Identify and mitigate risks associated with unresolved audit issues or ineffective controls

6. Process Improvement and Preventive Measures: Analyze recurring audit issues to identify systemic problems and recommend process improvements. Promote a culture of continuous improvement and risk awareness across the organization.

Analyze recurring audit issues to identify systemic problems and recommend process improvements
Work with process owners to strengthen internal controls and prevent future audit findings

7. Documentation and Record-Keeping: Document test results, findings, and recommendations. Prepare detailed reports for management and stakeholders. Maintain comprehensive records of control testing activities.

Maintain comprehensive documentation of audit findings, remediation plans, and progress updates
Ensure that all records are accurate, up-to-date, and readily accessible for audits or regulatory reviews

8. Planning and Preparation

Identify the scope of control testing, including systems, processes, and applications to be evaluated
Create detailed test plans outlining objectives, methodologies, and timelines
Develop and maintain the audit activities management framework

9. Control Testing Execution: Conduct testing of IT controls to ensure they are operating effectively. Evaluate the design and operational effectiveness of IT controls. Identify control weaknesses and recommend improvements

Evaluate whether controls are designed appropriately to address specific risks
Verify that controls are functioning as intended and are consistently applied
Conduct walkthroughs with process owners to understand control workflows and identify gaps
Utilize automated tools (e.g., ACL, IDEA, or scripting tools) to perform control testing efficiently

10. Evaluate Control Gaps

Determine if existing controls adequately mitigate identified risks
Rank control deficiencies based on their severity and potential impact

11. Documentation

Document the results of control testing, including evidence of testing procedures and findings
Maintain detailed work papers to support testing conclusions and provide audit trails
Summarize findings, including control weaknesses, root causes, and recommendations for improvement

12. Remediation Support

Suggest actionable solutions to address control weaknesses and enhance control effectiveness
Track the implementation of corrective actions and verify their effectiveness
Conduct follow-up testing to ensure that remediation efforts have resolved identified issues

13. Continuous Improvement: Monitor and review the effectiveness of implemented controls. Stay updated with the latest industry trends, regulations, and best practices. Recommend and implement improvements to control processes and procedures

Periodically assess the overall control environment for emerging risks and areas of improvement
Refine testing methodologies and tools to improve efficiency and accuracy
Educate stakeholders on control best practices and the importance of compliance

14. Tool and Technology Utilization

Use automated tools for data analysis, control testing, and monitoring
Utilize Governance, Risk, and Compliance (GRC) platforms to streamline control testing and reporting
Keep up with advancements in IT control testing tools and technologies

15. Training and Awareness

Provide training and guidance to staff on audit requirements, remediation processes, and best practices. Foster a strong control environment by raising awareness of compliance and risk management

16. Collaboration and Communication

Work closely with IT and business units to understand control environments. Communicate findings and recommendations to relevant stakeholders. Provide training and guidance on control best practices

17. Leadership and Team Development

Lead and mentor a team of risk management professionals, fostering a high-performance culture. Provide guidance and development opportunities, ensuring the team adapts to emerging challenges and stays at the forefront of audit and control issues management trends and best practices

About You

You should have:

Bachelor's Degree (preferred) in relevant risk management disciplines (e.g., Operational Risk management within an IT department or organisation, Information Security, IT Risk Management)
Professional risk management certification (e.gM ISO 31000) and /or industry body affiliation is an advantage
Experienced seasoned professional with deep expertise in developing and running an Operational Risk Management function within an IT Division or organisation
Proven track record in leading a risk function in a Technology environment
15+ years of experience in enacting the first line of defence IT operational risk role and responsibilities
Capable of understanding the Club's unique nature and culture in terms of Risk Management
Capable of assessing and quantifying technology and operational risks, assessing mitigation measures and providing practical recommendations on risk mitigation controls when needed
Understand industry best practices and trends on IT standards, governance, risk, and internal control
Proficient in delivering technology and/or operational risk management frameworks from inception
Knowledge of enterprise architecture, service management, asset management, change management and systems migration
A good understanding of business and product knowledge of the Club and the business strategies, priorities, risks and controls in his/her core or functional area of responsibility
Technically astute and excellent analytical and decision-making ability
Excellent communication and report-writing skills in English
High influencing and communication skills
High professional and ethical standards
Strong leadership, with excellent people and relationship management skills
Manage/handle multiple tasks, and work under pressure and with conflicting priorities
Proactive with high levels of initiative

Terms of Employment

The level of appointment will be commensurate with qualifications and experience.

How to Apply
Please send your resume, complete with expected salary and job reference by clicking the #Apply-Now# button or to:
Fax: 2966-5770
Mail: The Human Resources Department, The Hong Kong Jockey Club, 1 Sports Road, Happy Valley, Hong Kong

We are an equal opportunity employer. Personal data provided by job applicants will be used strictly in accordance with the Club's notice to employees and prospective employees relating to the Personal Data (Privacy) Ordinance. A copy of which will be provided immediately upon request.

Deputy Executive Manager - Audit Issues and Technology Controls Governance