SOX Director

Purpose of the Role

The SOX Director is responsible for providing strategic leadership, governance, and oversight of Rio Tinto’s global Sarbanes-Oxley (SOX) compliance programme, ensuring a consistent, risk-based, and effective approach to internal controls over financial reporting.

As a key member of the Second Line of Defence (2LoD), the role provides independent oversight, technical expertise and challenge to ensure material financial reporting risks are appropriately identified, assessed, and addressed through effective internal controls.

The role works closely with senior Finance and business leadership, Group Internal Audit (GIA), external auditors, and other key stakeholders to influence decisions, address significant risks and ensure alignment across the global SOX programme.

The SOX Director is accountable for setting the strategic direction of the programme, overseeing its effective delivery, and driving continuous improvement through standardisation, simplification, automation, and greater use of data-driven assurance.

The role provides leadership to the global SOX team, builds organisational capability, and takes an active role in significant risk assessments, complex control matters, technical evaluations, deficiency assessments, and governance reporting.

Key Accountabilities

Leadership and Culture

• Lead, coach, and develop a high-performing SOX team, promoting collaboration, accountability, inclusion, and continuous learning.
• Set clear objectives, performance expectations, and development priorities aligned with the wider Controls & Assurance strategy.
• Build technical expertise and leadership capability across the SOX team and wider SOX network.
• Promote constructive challenges, professional judgement, and evidence-based decision-making.
• Champion Rio Tinto's values, employee wellbeing, and expected leadership behaviors.
• Support succession planning and the long-term development of SOX capability.

SOX Programme Leadership and Governance

• Set the strategic direction and priorities for Rio Tinto's global SOX programme, ensuring a risk-based, effective, and sustainable approach to compliance.
• Provide overall leadership, governance, and independent Second Line of Defence (2LoD) oversight of the SOX programme.
• Own and continuously improve the SOX framework, methodology, policies, standards, and governance arrangements.
• Oversee programme performance, ensuring significant risks, delivery challenges and dependencies are appropriately managed.
• Act as a key subject matter expert and trusted adviser to senior leadership on SOX, internal controls over financial reporting and related governance matters.
• Support the General Manager - Controls & Assurance in delivering functional strategy, priorities, and governance commitments.

SOX Risk Assessment and Scoping

• Lead the annual SOX risk assessment and scoping strategy, ensuring appropriate coverage of material financial reporting risks, entities, processes, systems, and disclosures.
• Oversee the assessment of risks and relevant financial statement assertions, ensuring the SOX programme remains aligned with Rio Tinto's financial reporting requirements.
• Review and challenge significant scoping judgements, risk assessments, and proposed changes to the control environment.
• Drive risk-based scoping and control rationalization to eliminate unnecessary complexity without compromising assurance.
• Assess the SOX implications of changes in accounting standards, organizational structures, acquisitions, divestments, major projects, and technology.
• Lead discussions with KPMG on significant scoping and risk assessment matters, ensuring appropriate alignment and documented conclusions.
• Review and approve significant risk assessments, scoping papers, and technical recommendations.

Control Environment and SOX Design Excellence

• Provide strategic oversight of SOX control design, ensuring controls address material financial reporting risks.
• Establish consistent standards for control design, documentation, ownership, and evidence of requirements across the Group.
• Challenge ineffective, duplicative, or unnecessarily complex controls and drive opportunities for standardization and rationalisation.
• Promote greater use of preventive, automated, and system-enabled controls to strengthen the control environment.
• Provide technical leadership on complex control design matters, including management review controls, significant estimates, and judgmental areas.
• Ensure lessons from testing, audit findings, and deficiencies are reflected in improvements to the control environment.
• Oversee significant changes to risks, controls, and related documentation within the GRC platform.

SOX Testing and Assurance Oversight

• Provide overall oversight of SOX testing strategy, methodology, quality, and delivery across the global programme.
• Establish expectations for risk-based testing, evidence quality, documentation, and review.
• Challenge testing approaches to ensure sufficient assurance while reducing unnecessary work for control owners and the business.
• Oversee programme performance and significant testing outcomes, ensuring material issues and delivery risks are addressed.
• Drive improvements in the assurance model through standardization, automation, data analytics, and appropriate reliance on management testing.
• Ensure effective coordination between internal testing teams, external service providers, and KPMG to reduce duplication and improve assurance efficiency.

Deficiency Evaluation and Remediation

• Oversee the consistent identification, evaluation, classification, and reporting of SOX control deficiencies.
• Provide technical leadership and challenge on significant or complex deficiency assessments, including potential financial reporting impacts.
• Review material deficiency conclusions, root causes, compensating controls, and proposed remediation approaches.
• Ensure significant and