SOX Compliance Manager

| India | Controls & Assurance

Purpose of the Role

The SOX Compliance Manager is responsible for managing the effective execution and day-to-day delivery of Rio Tinto’s global Sarbanes-Oxley (SOX) compliance programme, ensuring activities are completed on time, to the required quality standards and in line with the agreed SOX methodology.

The role reports directly to the SOX Director and will have internal and external SOX testing teams to manage alongside working closely with SOX Compliance Managers, control owners, Finance, technology teams, and external auditors to coordinate risk assessments, control testing, evidence collection, deficiency evaluation, and remediation activities.

The role oversees the different phases of the SOX testing lifecycle, including design, interim, update, year-end, and remediation testing, ensuring appropriate planning, resource allocation, quality review, and timely resolution of issues.

The SOX Compliance Manager is responsible for monitoring programme progress, maintaining consistent and reliable SOX documentation, addressing operational challenges, and escalating significant risks or matters requiring management attention.

The role also supports the implementation of programme improvements, standardised processes, and automation initiatives to improve the efficiency, quality, and effectiveness of SOX delivery across Rio Tinto.

Key Accountabilities

1. Leadership and Team Management

• Lead, coach and support internal SOX testing teams and external service providers to ensure high-quality and timely delivery.
• Manage day-to-day team activities, workload, priorities, and resource allocation across the SOX testing lifecycle.
• Set clear expectations for testing quality, documentation, accountability, and timely completion of assigned activities.
• Review team performance, provide regular feedback and support technical development and continuous learning.
• Promote collaboration, teamwork, and consistent ways of working across internal teams, Protiviti and Regional SOX Compliance Managers.
• Champion Rio Tinto's values, employee wellbeing, and expected standards of conduct.

2. SOX Programme Planning and Delivery

• Manage the day-to-day execution of the global SOX programme in line with the approved scope, methodology and annual plan.
• Lead planning and delivery across design, interim, update, year-end, and remediation testing phases.
• Develop and maintain testing schedules, milestones, resource plans, and deliverables, ensuring activities are completed on time and to the required quality.
• Coordinate closely with Regional SOX Compliance Managers, internal testing teams, and external service providers to ensure consistent delivery.
• Monitor testing progress, identify delays or dependencies and take timely action to resolve operational challenges.
• Provide regular programme status updates, highlighting key achievements, outstanding activities, risks, and matters requiring escalation.
• Support the implementation of programme changes and priorities established by the SOX Director.

3. Risk Assessment, Scoping and Control Documentation

·   Prepare the annual SOX scoping and risk assessment by coordinating required information, analysis, and documentation.

·  Review control coverage and identify potential gaps, duplication or controls that may not adequately address the relevant risks of material misstatement.

· Provide recommendations for control rationalisation, standardisation and improvements based on testing outcomes and practical experience.

·  Ensure Risk and Control Matrices, control descriptions, process documentation, and ownership details are accurate and maintained in the GRC platform.

· Coordinate updates to SOX documentation arising from changes in business processes, systems, control design, or testing requirements.

·Escalate significant scoping, risk assessment, or control design matters to the SOX Director for review and decision.

4. Control Testing and Quality Assurance

• Oversee the execution of walkthroughs, design effectiveness, and operating effectiveness testing across the agreed SOX scope.
• Review testing workpapers, supporting evidence and conclusions to ensure compliance with the SOX methodology and quality expectations.
• Ensure appropriate testing coverage, sample selection, documentation, and timely completion across all testing phases.
• Coordinate with KPMG and internal testing teams to align sample requirements, minimise duplicate requests and reduce the workload on control owners.
• Ensure testing evidence is complete, dependable, and appropriately retained within the GRC platform.
• Identify and resolve testing issues, evidence gaps, and quality concerns, escalating significant matters where required.
• Manage testing review comments and ensure timely resolution before completion of each testing phase.

5. Certifications, Deficiencies and Remediation

• Coordinate periodic control design certifications and follow up with control owners to ensure timely completion.
• Review certification responses and identify changes or issues that may require further assessment or testing.
• Manage the tracking and assessment of control deficiencies, including supporting root-cause analysis, impact assessments, and proposed remediation.
• Work with control owners and Regional SOX Compliance Managers to agree practical remediation plans, responsibilities, and target dates.
• Monitor remediation progress and follow up on overdue actions to minimise unresolved deficiencies at year-end.
• Coordinate remediation testing and review supporting evidence before recommending closure.
• Escalate significant, recurring or potentially material deficiencies to the SOX Director with clear supporting analysis and recommendations.

6. External Audit and Stakeholder Coordination

• Function as the primary operational contact for KPMG on SOX testing, sample selection, evidence requests, findings, and outstanding actions.
• Coordinate external audit requirements with Finance, Technology, business units, control owners, Regional SOX Compliance Managers, and service providers.
• Manage the preparation and tracking of PBC requests, ensuring timely responses and appropriate supporting documentation.
• Support KPMG's assessment of management testing team competence, objectivity, and testing quality, including preparation of required documentation.
• Identify opportunities to align management and external audit testing to reduce duplication and improve efficiency.
• Resolve day-to-day audit queries and escalate significant disagreements, technical matters, or delivery risks to the SOX Director.
• Maintain effective working relationships with stakeholders and ensure clear communication of SOX requirements, timelines, and responsibilities.

7. Process Improvement and Technology

• Identify and implement opportunities to improve testing efficiency, documentation quality, and consistency across the SOX programme.
• Support control standardisation, rationalisation, and automation initiatives in line with the SOX improvement strategy.
• Work with Technology and control owners to address operational control gaps and improve the reliability of evidence and reporting.
• Support enhancements to GRC workflows, dashboards, testing templates, issue tracking, and reporting.
• Identify opportunities to use data analytics, automated testing, and Continuous Control Monitoring to improve assurance activities.
• Share lessons learned from testing, audit findings, and remediation to support ongoing programme improvements.

8. Training and SOX Awareness

• Coordinate and deliver periodic SOX training and communications to control owners, operators, and relevant stakeholders.
• Ensure control owners understand SOX requirements, control responsibilities, evidence expectations, and certification processes.
• Provide guidance and training on the use of the GRC platform, including control documentation, evidence submission, and certifications.
• Support Regional SOX Compliance Managers in addressing common control issues and improving the consistency of SOX practices.
• Identify training needs arising from testing findings, control deficiencies, and changes to the SOX methodology.

9. Reporting and Documentation

• Maintain accurate and up-to-date programme trackers, testing results, deficiency records, and remediation status within the GRC platform.
• Prepare regular SOX delivery reports, dashboards and status updates for the SOX Director and relevant stakeholders.
• Ensure reporting clearly identifies progress against milestones, outstanding activities, testing outcomes, and key delivery risks.
• Prepare supporting analysis, documentation and materials for management reviews, external auditor discussions, and governance reporting.
• Ensure SOX records and testing documentation are complete, consistent, and readily available for management and external audit review.

10. Resource and Delivery Management

• Lead and manage the internal SOX testing team, including allocation of responsibilities, workload management, performance oversight, coaching, and development, while overseeing and managing external service providers to ensure effective coordination, quality, and timely delivery of SOX testing activities.
• Monitor delivery against agreed plans, timelines, and resource requirements, identifying capacity constraints early.
• Coordinate work allocation across testing teams to balance workloads and meet programme priorities.
• Monitor external provider deliverables, quality, and performance against agreed expectations.
• Identify opportunities to improve resource efficiency and reduce unnecessary effort or costs.
• Provide resource and delivery updates to the SOX Director, including recommendations to address capacity or performance challenges.

Experience, Skills and Qualifications 

• Bachelor's or master's degree in accounting, finance, business administration, or a related discipline.
• CA, CPA, or an equivalent professional qualification is preferred; CISA or other relevant qualifications are desirable.
• 10+ years of recent and relevant experience in PCAOB and SOX external audits, ideally at Manager level or above within a Big Four firm or an equivalent role.
• Strong practical knowledge of PCAOB auditing standards, SOX requirements, and internal controls over financial reporting, including risk assessments, control design, testing, deficiency evaluation, and remediation.
• Demonstrated experience managing SOX testing activities, including walkthroughs, design and operating effectiveness testing, evidence review, documentation, and quality assurance.
• Experience collaborating directly with external auditors on risk assessments, testing approaches, sample selection, audit evidence, control deficiencies, and remediation.
• Strong understanding of financial reporting processes, business-process controls, IT general controls and the dependencies between business and technology controls.
• Experience coordinating SOX activities across multiple business units, functions, or locations, preferably within a large or multinational organisation.
• Practical experience in assessing control deficiencies, supporting root-cause analysis, developing remediation plans and monitoring actions through to closure.
• Experience providing independent Second Line of Defence (2LoD) oversight and constructive challenge to control owners and business stakeholders.
• Working knowledge of GRC platforms, ERP systems and SOX documentation and testing tools; experience with data analytics and automated testing is desirable.
• Experience supporting control standardisation, process improvements, automation, and other initiatives to improve SOX delivery efficiency.
• Strong stakeholder management and communication skills, with the ability to coordinate effectively with Finance, Technology, control owners, external auditors, and service providers.
• Demonstrated experience managing, coaching, and reviewing the work of internal or external testing teams, including planning, resource allocation, and performance monitoring.
• Strong analytical skills, attention to detail, professional judgement, and the ability to manage competing priorities and deliver quality outcomes within agreed timelines.
• Good written and verbal communication skills, including the ability to prepare clear testing conclusions, deficiency assessments, management updates, and supporting documentation.

Measures of success

· Timely and effective delivery of SOX activities across design, interim, update, year-end, and remediation testing phases.

· Completion of SOX testing in line with the approved scope, methodology, quality standards, and agreed timelines.

·Accurate and up-to-date Risk and Control Matrices (RaCMs), testing documentation and supporting evidence within the GRC platform.

·Consistent quality of walkthroughs, testing workpapers, evidence and conclusions, with minimal review comments and rework.

· Timely identification, assessment, tracking, and remediation testing of control deficiencies, with minimal overdue actions at year-end.

· Effective coordination with KPMG, including timely sample confirmation, PBC submissions, resolution of audit queries and reduced duplication of testing.

· Strong collaboration with Regional SOX Compliance Managers, control owners, Finance, IS&T, and external testing providers.

· Effective planning, allocation, and utilisation of internal and external testing resources to meet programme milestones.

· Timely completion of control certifications, training, and communications to support control owner awareness and compliance.

· Accurate and timely reporting of testing progress, deficiencies, remediation status, outstanding actions, and delivery risks.

· Consistent application of SOX testing methodology, documentation standards, and quality expectations across the testing teams.

· Timely identification and escalation of testing delays, control gaps, significant deficiencies, and other matters requiring management attention.

·Successful implementation of agreed control rationalisation, process improvements, automation, and GRC enhancements.

·Effective management of testing team performance, deliverables and development, promoting accountability and continuous improvement.

· Efficient delivery of SOX activities within agreed resources, budgets, and timelines, while minimising disruption to control owners.

About Rio Tinto
 

Rio Tinto is a leading global mining and materials company. We operate in 35 countries where we produce iron ore, copper, aluminium, critical minerals, and other materials needed for the global energy transition and for people, communities, and nations to thrive.
 

We have been mining for 150 years and operate with knowledge built up across generations and continents. Our purpose is finding better ways to provide the materials the world needs – striving for innovation and continuous improvement to produce materials with low emissions and to the right environmental, social and governance standards. But we can’t do it on our own, so we’re focused on creating partnerships to solve problems, create win-win situations and meet opportunities.

Respect and Inclusion

At Rio Tinto, we particularly welcome and encourage applications from Indigenous Peoples, women, the LGBTQ+ community, mature workers, people with disabilities and people from different cultural backgrounds.

We are committed to an inclusive environment where people feel comfortable to be themselves. We want our people to feel that all voices are heard, all cultures respected and that a variety of perspectives are not only welcome – they are essential to our success. We treat each other fairly and with dignity regardless of race, gender, nationality, ethnic origin, religion, age, sexual orientation or anything else that makes us different.

R69250