Controls Testing Lead

Smartsuite; Newport Beach (CA); On-site; USD 90,000 - 130,000; Full time

Job summary

Capitolis is seeking a Controls Testing Lead to plan and run the control testing program, including sampling, test procedures, tester assignments and evidence standards, ensuring every key control is tested on schedule with consistent results auditors can rely on.

You will report to the Internal Controls Manager, own the testing calendar, log exceptions, coordinate with risk and audit teams, and drive dashboards that show coverage, trends and remediation status across SOX and related frameworks.

Job description

SmartSuite for the Controls Testing Lead

The Controls Testing Lead plans and runs the control testing program: sampling, test procedures, tester assignments, evidence standards and quality review. They make sure every key control is tested on schedule and that results are consistent enough to rely on.

Reports to: Internal Controls Manager

What you own

The Controls Testing Lead plans and runs the control testing program: sampling, test procedures, tester assignments, evidence standards and quality review.

• Plan the testing calendar and sampling approach for key controls
• Write and maintain test procedures and evidence standards
• Assign testers and track completion against the schedule
• Review test workpapers for quality and consistency
• Log exceptions and route them to deficiency evaluation
• Report testing status and exception trends

At a glance

The GRC processes this role owns, touches and depends on.

Owns

accountable for the process

Compliance management

Touches

contributes or approves

Internal audit

Issues and actions

Reporting

Depends on

consumes its output

Risk management

How the GRC processes connect

Three lines of defence set the frame; the chain shows where each process hands off to the next. Colours follow the Controls Testing Lead: navy is owned, blue is touched, grey is depended on.

1. First line The business and its control owners Run the processes, own the controls, fix the issues
2. Second line Risk, compliance and the domain programmes Set the frameworks, assess, monitor and advise
3. Third line Internal audit Independent assurance to the board and audit committee

Reporting lines

Who this role reports to, who reports to them, and the peers they work with most.

Reports to

Internal Controls Manager

Direct reports

Works closely with

Compliance Analyst

See the role

Internal Auditor

See the role

Control Owner

See the role

SOX Program Manager

See the role

How SmartSuite supports the Controls Testing Lead

The Controls Testing Lead plans and runs control testing and is accountable to the Head of Internal Controls and the auditors who rely on the work for results consistent enough to trust. SmartSuite gives you a calendar that runs itself, workpapers a reviewer can re‑perform and exception data that shows where controls are weakening.

Run the testing program you own

Sampling approach written into each test

Each test procedure carries its evidence standard and evaluation criteria in Compliance Assessments & Testing, with the sampling approach you set written alongside, so testers execute to your standard and a reviewer can re‑perform from the workpaper.

Compliance Management suite

Tester assignments tracked against the calendar

Assign tests by control, period and tester with automated reminders; overdue and unstarted tests show on a dashboard so you reallocate before the quarter closes rather than discover the gap after it.

Compliance Management suite

Quality review as a step, not an afterthought

Workpapers route to you for review before a result is final, with comments and sign‑off recorded in the record, so consistency is enforced in the workflow rather than in a year‑end clean‑up.

Audit Management suite

Connect testing to owners, audit and deficiency evaluation

Evidence requests Control Owners can answer

Evidence requests go to the Control Owner with the deadline and the evidence standard attached, and reminders follow automatically, so a late sample is visible to you early enough to act.

SOX Management suite

ITGC and business control tests in one cycle

Test IT general controls and business process controls in the same connected workflow, so the Internal Auditor relying on your work sees one coherent program rather than two calendars.

SOX Management suite

Procedures shared with the Compliance Analyst

Standard procedures and templates live in one library used by the Compliance Analyst and the Internal Auditor, so a control tested for SOX and for ISO 27001 uses the same steps and the same evidence.

Compliance Management suite

Prove coverage and consistency to the Head of Internal Controls

Coverage by control, owner and period

Dashboards show every key control's test status for the cycle, by owner and period, so gaps in coverage are visible while there is still time to close them.

Compliance Management suite

Exception trends across cycles

Logged exceptions are tagged by control, cause and owner, so you can show the Head of Internal Controls where failures recur and which remediations actually held.

SOX Management suite

A testing summary drafted for you

The AI Assistant in a SmartDoc field drafts the cycle's testing summary and deficiency narratives from the recorded results, so the report to the Head of Internal Controls starts from the data rather than a blank page.

SOX Management suite

Compliance management. Schedules and executes recurring control tests from a testing engine with procedures and evidence attached to each test.

Internal audit. Keeps workpapers and sign-offs traceable for audit reliance.

Issues and actions. Logs exceptions and routes them to deficiency evaluation and remediation.

Reporting. Reports testing completion and exception trends by control, owner and period.

Products this role uses most

• Compliance Assessments & Testing Manage assessment campaigns and testing schedules with a reusable question library, automated workflows, and one place for evidence collection.
• SOX Compliance Manage SOX compliance with structured control testing, evidence tracking, and real‑time visibility into financial reporting controls and audit readiness.
• Internal Audit Management Plan, execute, and report on audits with complete assurance oversight — linking findings to risks, controls, and remediation actions in a single workspace.
• Issues Management Track and remediate issues across audits, risk, and compliance with structured workflows, clear ownership, and real‑time visibility into resolution status.

Industry reference

PCAOB AS 2201 sets the expectations for testing key controls: tests of design and operating effectiveness and workpapers a reviewer can re‑perform. The AICPA's audit sampling guidance and firm methodology supply the sample sizes by control frequency. COSO 2013 defines the controls; the IIA's Standards cover engagement performance where internal audit relies on the work.

The same methods serve other attestations. SOC 2 examinations test operating effectiveness over a period; FedRAMP assessments test NIST SP 800‑53 controls and CMMC assessments test NIST SP 800‑171 requirements; GAO's Yellow Book governs testing in government audits; HIPAA audits sample safeguards; bank examiners sample under FFIEC procedures.

Related roles

Internal Controls Manager

Explore Further

Guides and definitions from the GRC Knowledge Center and the What-is glossary, chosen for this role.

Frequently asked questions

The Controls Testing Lead owns the control testing program: the testing calendar and sampling approach for key controls, the written test procedures and evidence standards, tester assignments, the quality review of workpapers and the logging of exceptions for deficiency evaluation. The aim is that every key control is tested on schedule and that results are consistent enough for the Head of Internal Controls, internal audit and the external auditor to rely on. Reporting testing status and exception trends completes the remit.

Compliance Assessments & Testing schedules and executes recurring control tests from a testing engine, with the procedure and the evidence attached to each test. The Controls Testing Lead sets the calendar by control frequency, assigns testers and tracks completion against the schedule, and each tester works from the written procedure rather than their own interpretation of it. Because the evidence sits on the test record, a reviewer can check the work without asking the tester to find it.

Internal Audit Management keeps workpapers and sign-offs traceable, so a reviewer, the Internal Auditor or the external auditor can see who tested what, against which procedure, with what evidence and who reviewed it. That is the re-performance standard PCAOB AS 2201 expects and the basis on which internal audit decides how much to rely on management's testing. The Controls Testing Lead's quality review is recorded as a sign‑off on the workpaper rather than a note in an email.

An exception is logged against the test and routed to deficiency evaluation and remediation in SOX Compliance, so the Controls Testing Lead does not have to carry it across by hand. The exception keeps its link to the control, the sample and the evidence, which is what the SOX Program Manager needs when evaluating severity and aggregation. The Control Owner then documents the response and remediation in Issues Management, and the re‑test can be scheduled once the fix is in place.

SmartSuite reports testing completion and exception trends by control, by owner and by period, straight from the test records. The Head of Internal Controls and the Internal Controls Manager can see how far through the calendar the program is, which owners carry the most exceptions and whether a control is failing repeatedly across periods. That replaces the status spreadsheet most testing leads maintain and gives the deficiency conversation a factual starting point.

Begin with the key control list, the test frequencies and the procedures you already have; these become the controls, the schedule and the attached procedures in Compliance Assessments & Testing. Sampling rules and evidence standards are written once against each control and then apply to every cycle. Testers and Compliance Analysts are assigned to their controls, Control Owners respond to requests in the same records, and the first cycle run in the system gives you the baseline for completion and exception reporting.

See SmartSuite for your role