Internal Audit Manager – IT Risk & CASS

Role Description Overall responsibility for the IA service with a focus on business and technology risks from the generation of a risk based annual plan through to delivering independent internal audits across the FNZ Group and conducting continuous monitoring and advisory activities.

Specific Role Responsibilities • Ensuring that internal auditing standards and requirements are fully understood and applied; • Employing industry best practice; • Assessing whether all significant business and technology risks are identified and appropriately reported by management and the Risk function to the Board and Executive Management; • Assessing whether business and technology risks are adequately controlled; • Challenging Executive Management to improve the effectiveness of governance, risk management and internal controls; • Working with senior management to identify and mitigate or minimise strategic, operational, financial and compliance risks to FNZ; and • Developing, socialising and implementing a flexible, risk-based audit plan based on the FNZ’s risk universe, and other concerns identified by management and the Audit Committee.

Functional Area Responsibilities • Maintaining the Audit Universe and associated risk assessment from ongoing continuous monitoring activities; • Delivering the Audit plan by planning, executing and reporting audits covering both business processes and technology domains (e.g.

ITGCs, cloud environments, system implementations, data governance, cybersecurity, and change management); Specifically, the Internal Audit Manager will be expected to take an active part in executing fieldwork by conducting testing and, eventually, supervising the activities performed by both internal staff and the third-party internal auditors performing the fieldwork; • Working with stakeholders to help define the business and technology internal audit plans; • Being actively involved in planning, executing, and delivering the audit plan approved by the Audit committee.

Fieldwork execution will sometimes include coordinating and, eventually, supervising the activities performed by both internal staff and the third-party internal auditors performing the fieldwork; • Documenting the results of audit work in accordance with audit department and the Institute of Internal Auditors (IIA) standards.

Preparing timely audit reports for executive management, the Audit Committee and the Board of Directors; • Enforcing the internal audit findings and recommendations, especially where corrective action is required (issue validation including issue tracker management); • Building strong relationships with business, Risk, Compliance and Technology stakeholders (Engineering, Infrastructure, Cyber Security, IT Operations); • Performing ad-hoc internal-audit related projects as required; • Attending and representing Internal Audit at relevant Governance committees or working groups; and • Contributing, as appropriate, in the year-end financial audit with the external auditor.

Experience required Primary CASS requirements: Core Technical & Regulatory Expertise • Strong knowledge of FCA CASS rules (CASS 6, 7, 8 and 10), including client money, custody, CMAR reporting, and application within a Large CASS firm context.

•Ability to interpret and apply UK CASS requirements across different models (e.g.

Securities vs Custody), aligned to FCA expectations under CASS and SYSC.

CASS Operations & Process Expertise • Hands-on experience with key processes (ICMR/ECMR, custody reconciliations, segregation calculations).

•Understanding of how technology, systems and data flows support CASS processes, including risks in complex operating and client-servicing models.

Internal Audit & Assurance Capability Proven experience auditing CASS controls, including assessing design and operating effectiveness and identifying weaknesses, breaks and potential breaches.

Ability to deliver risk-based CASS audit coverage, including effective challenge of 1st and 2nd line and alignment to regulatory expectations.

Governance & Regulatory Engagement • Experience with CASS governance, MI and breach escalation, with effective engagement across SMFs, Risk/Compliance, CASS Oversight and external stakeholders (incl.

FCA/auditors).

•Strong understanding of Internal Audit’s role in providing independent assurance to the Board over client asset protection.

Regulatory Environment • Experience in UK regulated financial services, applying CASS requirements in large, complex environments, including service provision to CASS-regulated clients.

•Understanding of heightened FCA expectations for robust, independent CASS assurance beyond the external audit.

Core Technology & IT Risk Expertise: • Strong understanding of IT General Controls (ITGCs) including access management, change management, incident management, and IT operations; • Experience auditing cloud-based platforms; • Knowledge of cybersecurity frameworks (e.g.

NIST, ISO 27001) and their application in financial services environments.

Primary general audit requirements: • An experienced leader; • Highly motivated and with a proven track record of strong influencing skills and the ability to liaise and work with senior management; • Good understanding and working knowledge of current internal audit practices & techniques through significant years of progressive work experience within a financial services environment; • Proven experience of developing and delivering audit plan within the financial services sector; and • Experience of coaching and developing junior staff.

Secondary requirements: • Experience with asset management sector; • Experience within a fast-paced fintech environment; • Good understanding of data analytics.

Skills and knowledge: • Good understanding of relevant local legislative framework for the financial services sector; and • A strong, confident persuasive communicator (oral and written), capable of robust dialogue.

Qualifications: · Education: A bachelor’s degree in cyb