SOX Compliance Manager

SOX Compliance Manager

| India | Controls & Assurance

Purpose of the Role

The SOX Compliance Manager is responsible for managing the effective execution and day-to-day delivery of Rio Tinto’s global Sarbanes-Oxley (SOX) compliance programme, ensuring activities are completed on time, to the required quality standards and in line with the agreed SOX methodology.

The role reports directly to the SOX Director and will have internal and external SOX testing teams to manage alongside working closely with SOX Compliance Managers, control owners, Finance, technology teams, and external auditors to coordinate risk assessments, control testing, evidence collection, deficiency evaluation, and remediation activities.

The role oversees the different phases of the SOX testing lifecycle, including design, interim, update, year-end, and remediation testing, ensuring appropriate planning, resource allocation, quality review, and timely resolution of issues.

The SOX Compliance Manager is responsible for monitoring programme progress, maintaining consistent and reliable SOX documentation, addressing operational challenges, and escalating significant risks or matters requiring management attention.

The role also supports the implementation of programme improvements, standardised processes, and automation initiatives to improve the efficiency, quality, and effectiveness of SOX delivery across Rio Tinto.

Key Accountabilities

Leadership and Team Management

• Lead, coach and support internal SOX testing teams and external service providers to ensure high-quality and timely delivery.

• Manage day-to-day team activities, workload, priorities, and resource allocation across the SOX testing lifecycle.

• Set clear expectations for testing quality, documentation, accountability, and timely completion of assigned activities.

• Review team performance, provide regular feedback and support technical development and continuous learning.

• Promote collaboration, teamwork, and consistent ways of working across internal teams, Protiviti and Regional SOX Compliance Managers.

• Champion Rio Tinto's values, employee wellbeing, and expected standards of conduct.

SOX Programme Planning and Delivery

• Manage the day-to-day execution of the global SOX programme in line with the approved scope, methodology and annual plan.

• Lead planning and delivery across design, interim, update, year-end, and remediation testing phases.

• Develop and maintain testing schedules, milestones, resource plans, and deliverables, ensuring activities are completed on time and to the required quality.

• Coordinate closely with Regional SOX Compliance Managers, internal testing teams, and external service providers to ensure consistent delivery.

• Monitor testing progress, identify delays or dependencies and take timely action to resolve operational challenges.

• Provide regular programme status updates, highlighting key achievements, outstanding activities, risks, and matters requiring escalation.

• Support the implementation of programme changes and priorities established by the SOX Director.

Risk Assessment, Scoping and Control Documentation

• Prepare the annual SOX scoping and risk assessment by coordinating required information, analysis, and documentation.
• Review control coverage and identify potential gaps, duplication or controls that may not adequately address the relevant risks of material misstatement.
• Provide recommendations for control rationalisation, standardisation and improvements based on testing outcomes and practical experience.
• Ensure Risk and Control Matrices, control descriptions, process documentation, and ownership details are accurate and maintained in the GRC platform.
• Coordinate updates to SOX documentation arising from changes in business processes, systems, control design, or testing requirements.
• Escalate significant scoping, risk assessment, or control design matters to the SOX Director for review and decision.

Control Testing and Quality Assurance

• Oversee the execution of walkthroughs, design effectiveness, and operating effectiveness testing across the agreed SOX scope.

• Review testing workpapers, supporting evidence and conclusions to ensure compliance with the SOX methodology and quality expectations.

• Ensure appropriate testing coverage, sample selection, documentation, and timely completion across all testing phases.

• Coordinate with KPMG and internal testing teams to align sample requirements, minimise duplicate requests and reduce the workload on control owners.

• Ensure testing evidence is complete, dependable, and appropriately retained within the GRC platform.

• Identify and resolve testing issues, evidence gaps, and quality concerns, escalating significant matters where required.

• Manage testing review comments and ensure timely resolution before completion of each testing phase.

Certifications, Deficiencies and Remediation

• Coordinate periodic control design certifications and follow up with control owners to ensure timely completion.

• Review certification responses and identify changes or issues that may require further assessment or testing.

• Manage the tracking and assessment of control deficiencies, including supporting root-cause analysis, impact assessments, and proposed remediation.

• Work with control owners and Regional SOX Compliance Managers to agree practical remediation plans, responsibilities, and target dates.

• Monitor remediation progress and follow up on overdue actions to minimise unresolved deficiencies at year-end.

• Coordinate remediation testing and review supporting evidence before recommending closure.

• Escalate significant, recurring or potentially material deficiencies to the SOX Director with clear supporting analysis and recommendations.

External Audit and Stakeholder Coordination

• Function as the primary operational contact for KPMG on SOX testing, sample selection, evidence req