Purpose of the Role

The SOX Director is responsible for providing strategic leadership, governance, and oversight of Rio Tinto’s global Sarbanes-Oxley (SOX) compliance programme, ensuring a consistent, risk-based, and effective approach to internal controls over financial reporting.

As a key member of the Second Line of Defence (2LoD), the role provides independent oversight, technical expertise and challenge to ensure material financial reporting risks are appropriately identified, assessed, and addressed through effective internal controls.

The role works closely with senior Finance and business leadership, Group Internal Audit (GIA), external auditors, and other key stakeholders to influence decisions, address significant risks and ensure alignment across the global SOX programme.

The SOX Director is accountable for setting the strategic direction of the programme, overseeing its effective delivery, and driving continuous improvement through standardisation, simplification, automation, and greater use of data-driven assurance.

The role provides leadership to the global SOX team, builds organisational capability, and takes an active role in significant risk assessments, complex control matters, technical evaluations, deficiency assessments, and governance reporting.

Key Accountabilities

1.Leadership and Culture

·Lead, coach, and develop a high-performing SOX team, promoting collaboration, accountability, inclusion, and continuous learning.

·Set clear objectives, performance expectations, and development priorities aligned with the wider Controls & Assurance strategy.

·Build technical expertise and leadership capability across the SOX team and wider SOX network.

·Promote constructive challenges, professional judgement, and evidence-based decision-making.

·Champion Rio Tinto's values, employee wellbeing, and expected leadership behaviors.

· Support succession planning and the long-term development of SOX capability.

2.SOX Programme Leadership and Governance

· Set the strategic direction and priorities for Rio Tinto's global SOX programme, ensuring a risk-based, effective, and sustainable approach to compliance.

·Provide overall leadership, governance, and independent Second Line of Defence (2LoD) oversight of the SOX programme.

·Own and continuously improve the SOX framework, methodology, policies, standards, and governance arrangements.

·Oversee programme performance, ensuring significant risks, delivery challenges and dependencies are appropriately managed.

·Act as a key subject matter expert and trusted adviser to senior leadership on SOX, internal controls over financial reporting and related governance matters.

·Support the General Manager – Controls & Assurance in delivering functional strategy, priorities, and governance commitments.

3.SOX Risk Assessment and Scoping

· Lead the annual SOX risk assessment and scoping strategy, ensuring appropriate coverage of material financial reporting risks, entities, processes, systems, and disclosures.

·Oversee the assessment of risks and relevant financial statement assertions, ensuring the SOX programme remains aligned with Rio Tinto's financial reporting requirements.

·Review and challenge significant scoping judgements, risk assessments, and proposed changes to the control environment.

·Drive risk-based scoping and control rationalization to eliminate unnecessary complexity without compromising assurance.

·Assess the SOX implications of changes in accounting standards, organizational structures, acquisitions, divestments, major projects, and technology.

·Lead discussions with KPMG on significant scoping and risk assessment matters, ensuring appropriate alignment and documented conclusions.

·Review and approve significant risk assessments, scoping papers, and technical recommendations.

4.Control Environment and SOX Design Excellence

·Provide strategic oversight of SOX control design, ensuring controls address material financial reporting risks.

·Establish consistent standards for control design, documentation, ownership, and evidence of requirements across the Group.

·Challenge ineffective, duplicative, or unnecessarily complex controls and drive opportunities for standardization and rationalisation.

·Promote greater use of preventive, automated, and system-enabled controls to strengthen the control environment.

·Provide technical leadership on complex control design matters, including management review controls, significant estimates, and judgmental areas.

·Ensure lessons from testing, audit findings, and deficiencies are reflected in improvements to the control environment.

·Oversee significant changes to risks, controls, and related documentation within the GRC platform.

5.SOX Testing and Assurance Oversight

·Provide overall oversight of SOX testing strategy, methodology, quality, and delivery across the global programme.

·Establish expectations for risk-based testing, evidence quality, documentation, and review.

·Challenge testing approaches to ensure sufficient assurance while reducing unnecessary work for control owners and the business.

·Oversee programme performance and significant testing outcomes, ensuring material issues and delivery risks are addressed.

·Drive improvements in the assurance model through standardization, automation, data analytics, and appropriate reliance on management testing.

·Ensure effective coordination between internal testing teams, external service providers, and KPMG to reduce duplication and improve assurance efficiency.

6.Deficiency Evaluation and Remediation

·Oversee the consistent identification, evaluation, classification, and reporting of SOX control deficiencies.

·Provide technical leadership and challenge on significant or complex deficiency assessments, including potential financial reporting impacts.

·Review material deficiency conclusions, root causes, compensating controls, and proposed remediation approaches.

·Ensure significant and recurring deficiencies are appropriately escalated and addressed through sustainable remediation.

·Oversee year-end deficiency assessments and significant remediation conclusions, including alignment with KPMG.

· Identify recurring or systemic control weaknesses and drive broader improvements across the Group.

7. External Auditor and Senior Stakeholder Engagement

·Lead the strategic relationship with KPMG on SOX matters, promoting constructive challenge, transparency, and effective audit coordination.

·Act as a senior point of contact for significant SOX judgements, technical discussions, audit concerns, and disagreements.

·Influence senior Finance, business, and technology leadership to strengthen control ownership and address material financial reporting risks.

·Promote effective collaboration across SOX, Finance, Technology, Group Services, GIA, and other assurance functions.

·Identify opportunities to increase auditor reliance on management's work and reduce duplication of assurance activities.

·Provide senior leadership with clear advice, recommendations, and visibility of significant SOX matters.

8.Continuous Improvement and Technology

·Lead the long-term improvement and transformation of the SOX programme, focusing on effectiveness, efficiency, and sustainability.

·Drive standardization, simplification and rationalisation of risks, controls, documentation, and testing approaches.

· Champion the adoption of preventive and automated controls, Continuous Control Monitoring, and data-driven assurance.

·Set strategic requirements for GRC technology and support the adoption of tools that improve programme governance, workflows, reporting, and efficiency.

·Work with Technology leadership to ensure IT controls, automated controls and key system dependencies are appropriately addressed within the SOX framework.

·Monitor regulatory developments and emerging practices, translating relevant changes into improvements to the SOX programme.

·Establish priorities and measures to demonstrate the benefits of programme improvement initiatives.

9.Transformation, M&A and Strategic Projects

· Provide strategic SOX leadership for major acquisitions, divestments, joint ventures, integrations and business or technology transformation programmes.

· Ensure financial reporting risks, control requirements and SOX readiness are considered early in significant change initiatives.

·Lead significant SOX risk assessments, control strategies and readiness reviews associated with major projects.

· Influence projects and business leadership to ensure appropriate control ownership, governance, and sustainable transition into business-as-usual operations.

·Review significant technical assessments, recommendations and governance materials relating to transformation initiatives.

· Lead or contribute to strategic projects and priorities assigned by the General Manager – Controls & Assurance.

10. Documentation, Reporting and Governance

·Oversee the quality, completeness and consistency of SOX governance reporting, technical documentation, and programme communications.

· Prepare or review significant technical position papers, risk assessments, methodologies, governance materials, and recommendations.

·Provide clear reporting to senior management on programme effectiveness, material risks, deficiencies, remediation, and strategic priorities.

·Support the General Manager – Controls & Assurance in preparing executive leadership and Audit and Risk Committee reporting.

·Ensure significant SOX judgements, conclusions and recommendations are appropriately supported and documented.

11. Financial and Resource Management

· Provide oversight of SOX programme costs, budgets, resource requirements, and delivery models.

·Support strategic resource planning, sourcing decisions, and prioritisation of programme investments.

·Challenge unnecessary costs, duplication and reliance on external providers while maintaining appropriate assurance quality.

·Assess the resource implications of changes in SOX scope, business activities, and transformation programmes.

·Monitor financial and resource performance and provide recommendations to the General Manager – Controls & Assurance.

Experience, Skills and Qualifications 

·Bachelor's or master's degree in accounting, finance, business administration, or related discipline.

·CA, CPA, or equivalent professional qualification is strongly preferred; CISA or other relevant qualifications are desirable.

·15 plus years of recent and relevant experience in SOX compliance, external audit, and internal controls over financial reporting, including leadership experience at a senior manager or director level within a Big Four firm or an equivalent corporate role.

· Recent and extensive knowledge of PCAOB auditing standards, SOX requirements, SEC expectations, and leading practices in internal controls over financial reporting.

· Demonstrated experience leading complex SOX programmes, including risk assessments, scoping, control design, testing strategies, deficiency evaluations, and remediation oversight across large, complex, or multinational organisations.

·Strong technical expertise and professional judgement in assessing significant financial reporting risks, complex control matters, and material deficiencies, with the ability to develop and challenge technical positions.

·Proven experience managing senior-level relationships with external auditors, including resolving complex technical matters, challenging audit conclusions, and influencing assurance approaches.

·Demonstrated ability to provide independent Second Line of Defence (2LoD) oversight, constructive challenge, and strategic advice to senior management.

·Strong understanding of financial reporting processes, business operations, IT general controls, automated controls, and the dependencies between business and technology controls.

·Experience providing SOX leadership for major business changes, including acquisitions, divestments, joint ventures, ERP implementations, and transformation programmes.

·Proven experience driving control standardisation, rationalisation, automation, and continuous improvement to strengthen the control environment and improve programme efficiency.

·Good understanding of GRC platforms, ERP systems, data analytics and emerging technologies, including Continuous Control Monitoring and automated assurance.

·Demonstrated ability to influence senior Finance, Technology, business, and assurance stakeholders and communicate complex technical matters clearly to executive leadership and governance forums.

·Strong strategic thinking, analytical skills, professional skepticism, and the ability to balance regulatory requirements, financial reporting risks, and business priorities.

·Proven experience leading and developing high-performing teams, building technical capability, and managing internal and external resources across a global or matrix organisation.

·Strong written and verbal communication skills, including experience preparing technical position papers, senior management presentations, and governance reporting.

Success Measures

· Effective governance and oversight of the global SOX programme, ensuring timely delivery and achievement of key objectives.

· A complete, risk-based, and defensible SOX scope aligned with material financial reporting risks and business changes.

· Improved quality and consistency of the SOX Risk Universe, Risk and Control Matrices (RaCMs) and overall control framework.

· Stronger alignment between financial reporting risks, controls, and assurance activities.

·Measurable improvements in control effectiveness through standardisation, simplification, and rationalisation.

·Increased adoption of preventive, automated and data-driven controls, including Continuous Control Monitoring.

·Improved efficiency and quality of SOX testing, with reduced duplication and greater external auditor reliance on management's work.

·Timely resolution of significant control deficiencies, with fewer recurring and systemic issues.

· Effective integration of acquisitions, major projects, new systems, and business changes into the SOX framework.

·Strong engagement and alignment with senior leadership, SOX Compliance Managers, Finance, Technology, GIA, and KPMG.

·Clear, timely and insightful reporting to senior management and governance forums, supporting informed decision-making.

·A high-performing and engaged SOX team with strong technical capability, accountability, and development opportunities.

·Effective management of programme costs, resources, and external providers, delivering value without compromising assurance quality.

About Rio Tinto
 

Rio Tinto is a leading global mining and materials company. We operate in 35 countries where we produce iron ore, copper, aluminium, critical minerals, and other materials needed for the global energy transition and for people, communities, and nations to thrive.
 

We have been mining for 150 years and operate with knowledge built up across generations and continents. Our purpose is finding better ways to provide the materials the world needs – striving for innovation and continuous improvement to produce materials with low emissions and to the right environmental, social and governance standards. But we can’t do it on our own, so we’re focused on creating partnerships to solve problems, create win-win situations and meet opportunities.

Respect and Inclusion

At Rio Tinto, we particularly welcome and encourage applications from Indigenous Peoples, women, the LGBTQ+ community, mature workers, people with disabilities and people from different cultural backgrounds.

We are committed to an inclusive environment where people feel comfortable to be themselves. We want our people to feel that all voices are heard, all cultures respected and that a variety of perspectives are not only welcome – they are essential to our success. We treat each other fairly and with dignity regardless of race, gender, nationality, ethnic origin, religion, age, sexual orientation or anything else that makes us different.

R69247