Arthur J. Gallagher & Co.
Global IT Risk and Compliance Senior Manager
March 2019 - Present
- Reduced IT SOX control deficiencies, including IT application controls, IT general controls, and entity-level controls, from 122 in 2018 to 7 in 2023 and approximately 5 since, despite increased system and control scope.
- Coordinated management response for 38 internal audits since 2022 with Deloitte across change management, disaster recovery, data transmissions, third-party risk, M&A security, vulnerability and patch management, logging and monitoring, cloud governance, configuration management, PCI, AI usage, and sanctions screening.
- Partnered with management, Internal Audit, SOX, and external audit teams across the Americas, EMEA, and APAC to scope audits, clarify evidence, resolve disagreements, and negotiate practical remediation plans aligned to risk and control expectations.
- Managed and monitored remediation action plans for audit and compliance findings, helping close typical reports with 3-5 findings and 2-3 action plans per finding while delivering over 95% of action plans on schedule without extensions.
- Implemented Global IT Compliance quality assurance checks over access reviews, database passwords, and service account password refresh and usage, preventing control exceptions and supporting auditor reliance on key IT systems.
- Led remediation of significant identity and access management issues, including enterprise service account vaulting and monitoring and a weekly backdated-termination review using login and audit history to address access disablement timing risk.
- Supported complex SOX and audit matters, including 2024 access review sufficiency analysis and 2025 Snowflake interface testing for a major revenue recognition system migration, by translating control design, mitigating controls, and QA evidence into audit-ready support.
- Centralized review of approximately 45 critical SOC 1 reports, supported effective unqualified SOC 1 and SOC 2 reports with EY, and led creation of a 2025 corporate/GTS SOC 2 report covering shared Security, HR, and technology controls.
- Own Global IT Policy and Standards updates and redesigned the IT policy exception process to incorporate Cybersecurity review, risk categorization, and renewal workflow improvements; set the agenda for the quarterly IT Risk Committee and participate in enterprise risk, service management, and cyber issue governance forums.
- Prepared executive-level IT risk and SOX reporting for senior leadership, the IT Risk Committee, and Audit Committee audiences, including 2023 reporting on SOX deficiency reduction and 2025 planning for the AssuredPartners integration and 2026 compliance approach.