Data Governance & Controls Assurance Consultant

DAI Consultancy; Doha; On-site; QAR 120,000 - 180,000; Full time

Job summary

DAI Consultancy in Doha is seeking a Data Governance & Controls Assurance Consultant to provide advisory and independent-assurance services over client data governance, security, controls and evidence. The role uses a risk-based and evidence-led approach to assess policies, processes and controls, and to report findings with practical recommendations while preserving independence.

The consultant will interview stakeholders, review documentation, perform sampling and evidence validation, and

Qualifications

• Typically 4-8 years in internal audit, technology audit, risk or assurance.
• Experience evaluating design and operating effectiveness and retaining defensible working papers.
• Exposure to data platforms, governance frameworks, information security or regulated environments is preferred.

Responsibilities

• Define risk-based assurance scope, objectives, criteria, evidence needs, sampling approach and reporting protocols.
• Review governance frameworks, policies, standards, RACI matrices, committee evidence, registers and performance reporting.
• Assess control design and operating evidence across data quality, metadata, sharing, security, retention, platforms and analytics.
• Document findings with condition, criteria, cause, consequence, risk and practical recommendation.

Skills

Risk-based auditing

Control testing

Evidence evaluation

Report writing

Education

Bachelor's degree in audit

Job description

Role Purpose

The Data Governance & Controls Assurance Consultant provides advisory and independent-assurance services over client data governance, security, controls and implementation evidence. The role evaluates whether policies, accountabilities, processes and controls are appropriately designed, implemented and supported by evidence, and whether identified issues are being remediated effectively.

The consultant uses a risk-based and evidence-led approach, working with governance, data, security, technology, risk and audit stakeholders. It reports factual findings, root causes, implications and practical recommendations while preserving independence and confidentiality. The role does not own the controls being assessed, approve client risk or act as the client's internal auditor unless that responsibility is formally contracted and independence safeguards are established. The expected outcome is clear assurance that helps client leaders strengthen governance and control effectiveness.

Key Responsibilities

Define risk-based assurance scope, objectives, criteria, evidence needs, sampling approach and reporting protocols. Review governance frameworks, policies, standards, RACI matrices, committee evidence, registers and performance reporting. Assess control design and operating evidence across data quality, metadata, sharing, security, retention, platforms and analytics. Conduct interviews, walkthroughs, document reviews, sample testing and evidence validation. Distinguish control design gaps, implementation gaps, evidence gaps and isolated exceptions. Document findings with condition, criteria, cause, consequence, risk and practical recommendation. Validate management responses, owners, target dates, dependencies and planned closure evidence. Track remediation and perform follow-up testing before recommending closure. Identify systemic themes, control dependencies and recurring weaknesses across domains or entities. Prepare concise assurance reports and facilitate factual-clearance discussions with stakeholders. Maintain independence, confidentiality, working papers, evidence traceability and quality review. Escalate matters requiring formal audit, legal, regulatory or executive attention through authorised channels.

Minimum Requirements

Education

Bachelor's degree in audit, accounting, information systems, cybersecurity or a related field. An equivalent combination of relevant education and directly applicable consulting or implementation experience may be considered.

Professional Experience

Typically 4-8 years in internal audit, technology audit, risk or assurance. Experience in internal audit, technology audit, data governance, controls assurance, risk or compliance. Experience evaluating design and operating effectiveness and retaining defensible working papers. Experience writing findings and facilitating factual-clearance and remediation discussions. Exposure to data platforms, governance frameworks, information security or regulated environments is preferred.

Technical and Domain Knowledge

Risk-based assurance and control assessment methods. Data-governance, policy, accountability and committee controls. Technology, data-quality, metadata, sharing and security-control concepts. Evidence sampling, walkthroughs, testing and working-paper standards. Finding development, root-cause analysis and risk articulation. Remediation planning, follow-up testing and closure evidence. Independence, confidentiality and conflict-of-interest safeguards. Executive assurance reporting and thematic analysis.

Core Competencies

Risk-based auditing. Control testing. Evidence evaluation. Report writing. Technology and data risk. Professional independence. Professional scepticism. Evidence judgement. Integrity. Conducting structured interviews and evidence-based challenge. Writing precise, balanced and defensible findings. Facilitating factual-clearance without diluting valid issues. Maintaining independence while supporting practical remediation. Communicating control risk to technical and executive audiences. Managing sensitive information and complete working papers. Recognising when specialist legal, security or audit escalation is required.

Preferred Certifications

Certified Internal Auditor (CIA) CISA preferred for technology-focused roles

Focus areas

• Risk-based auditing
• Control testing
• Evidence evaluation