SAP GRC Implementation & Configuration

• Lead or actively participate in the implementation, configuration, and optimisation of SAP GRC modules, particularly Risk Management (RM) and Process Control (PC).

Risk Assessment & Management

• Develop and implement the organisation’s risk management framework within SAP GRC, defining risk appetite, owners, and responsibilities.

• Identify, assess, and prioritise risks across SAP business processes, including operational, financial, IT, and compliance risks.

• Design and implement risk mitigation strategies and controls, defining and tracking mitigating controls within the GRC system.

• Perform qualitative and quantitative risk analyses to understand the likelihood and impact of potential risks.

• Monitor data in real-time, leveraging automated risk monitoring functionalities.

Audit & Compliance

• Conduct audits and reviews to assess the effectiveness of internal controls, risk management practices, and governance processes, verifying compliance with regulations, policies, and procedures.

• Provide support during statutory and SOX audits, gathering evidence and preparing documentation required for compliance reporting.

• Assess the design and operating effectiveness of IT General Controls (ITGCs) and business controls supporting financial processes.

• Investigate and respond to audit findings, assisting in the development and validation of remediation plans.

• Ensure compliance with policies, procedures, and IT controls, including the implementation of Automated Control Monitoring (ACM) functionality where applicable.

Reporting & Analytics

• Generate reports and dashboards to provide insights into risk exposure, control effectiveness, and compliance status for management and stakeholders.

Collaboration & Communication

• Work closely with business stakeholders, functional teams, IT security, and auditors to align risk and compliance efforts with business objectives.

• Provide training and support to business users, GRC owners, approvers, and mitigation reviewers on their responsibilities within the GRC framework.

Process Improvement

• Continually assess and enhance existing GRC processes to support the ongoing evolution of the Risk and Control Matrix (RCM).

• Promote a proactive risk and control culture across the organisation.