External Auditor

Smartsuite; Newport Beach (CA); On-site; USD 120,000 - 180,000; Full time

Job summary

Capitolis in Newport Beach seeks an experienced External Auditor within its GRC framework. The role reviews management's controls, testing and evidence to form an opinion under SOX, SOC 2, ISO and regulatory examinations, ensuring traceable access to control status and remediation.

You will plan and perform external audits, review control testing, evaluate deficiencies, follow remediation, and report to the audit committee.

Job description

Governance, risk and compliance

SmartSuite for the External Auditor

The External Auditor is an independent assessor who reviews management's controls, testing and evidence to form an opinion. In SOX, SOC 2, ISO and regulatory examinations they need controlled, traceable access to control status, test results and remediation without email back‑forth.

What you own

The External Auditor is an independent assessor who reviews management's controls, testing and evidence to form an opinion.

• Plan and perform the external audit or assessment
• Review management's control testing and evidence
• Evaluate deficiencies and their aggregation
• Follow up remediation of prior-year findings
• Issue the audit opinion or assessment report
• Communicate findings to the audit committee

At a glance

The GRC processes this role owns, touches and depends on.

Owns

accountable for the process

Internal audit

Touches

contributes or approves

Reporting

Depends on

consumes its output

Compliance management

Issues and actions

How the GRC processes connect

Three lines of defence set the frame; the chain shows where each process hands off to the next. Colours follow the External Auditor: navy is owned, blue is touched, grey is depended on.

1. First line The business and its control owners Run the processes, own the controls, fix the issues
2. Second line Risk, compliance and the domain programmes Set the frameworks, assess, monitor and advise
3. Third line Internal audit Independent assurance to the board and audit committee

Reporting lines

Who this role reports to, who reports to them, and the peers they work with most.

Reports to

Direct reports

Works closely with

Chief Audit Executive

Head of Internal Controls

SOX Program Manager

Compliance Director

Audit Committee Chair

How SmartSuite supports the External Auditor

The External Auditor forms an independent opinion on management's controls and answers to the audit committee, and to PCAOB inspection on US registrant audits, for evidence that is sufficient and traceable. SmartSuite gives an auditor controlled access to control status, test results and remediation in the system of record, so the review is served without email back‑forth.

Perform the review from the system of record

Process to control to evidence in one chain

Financial processes, risks, controls, tests, evidence and findings are linked end to end in SOX Compliance, so you follow the chain from a significant account to the evidence sampled without requesting a walkthrough document.

Evidence attached at the time of testing

Each control test shows its procedure, evaluation criteria and the evidence attached at the time of testing, so re-performance starts from what the tester actually examined rather than from a description.

Control changes with their retest decisions

Control updates, process changes and the decisions to retest are captured with version history, so you can see what changed since interim testing and whether management re‑tested it.

Work with the SOX team, internal audit and the audit committee

Queries logged against the item

Questions to the SOX Program Manager or the Head of Internal Controls are logged as tasks against the control or test, with the response and its evidence attached, so nothing is answered in a thread that later cannot be found.

Reliance on internal audit's testing

The Chief Audit Executive's testing uses the same procedures, templates and scoring across cycles, so when you consider relying on internal audit's work the methodology is visible rather than described.

Deficiencies seen as management aggregates them

Significant deficiencies, material weaknesses and corrective actions are tracked to closure in one place, so your evaluation of aggregation starts from management's own classification and evidence.

Issue the opinion with less rework and clear governance

Quarter-by-quarter progress without status calls

Interim testing, quarterly cycles and year-end readiness are visible on dashboards, so you plan fieldwork from live status rather than from a status meeting with the Compliance Director.

Multi-entity scope in one environment

Single-entity and multi-entity SOX programs are supported in one system, so a group audit does not mean a different evidence process for each subsidiary you cover.

Responses grounded in management's records

The AI Assistant in a SmartDoc field drafts testing summaries, deficiency narratives and auditor responses from management's records, so the responses you receive are grounded in the evidence rather than written from recollection.

Internal audit. Provides role-based, read-only access to testing results, evidence views and activity history so external review is served from the system of record.

Issues and actions. Shows remediation progress on findings without a separate status process.

Reporting. Reduces rework through consistent, centralized records and exportable evidence packs.

Products this role uses most

SOX Compliance

Manage SOX compliance with structured control testing, evidence tracking, and real‑time visibility into financial reporting controls and audit readiness.

Internal Audit Management

Plan, execute, and report on audits with complete assurance oversight — linking findings to risks, controls, and remediation actions in a single workspace.

SOC 2 Compliance

Achieve SOC 2 compliance with structured workflows, automated evidence collection, and continuous visibility into control effectiveness and audit readiness.

Industry reference

PCAOB AS 2201 governs the integrated audit of internal control for US registrants; the AICPA's SSAE 18 governs SOC 1 and SOC 2 examinations; ISO/IEC 17021-1 governs certification bodies auditing ISO 27001, 22301 and 37301; ISAE 3000 and ISSA 5000 govern sustainability assurance. GAO's Yellow Book applies to government audits.

Sector examinations follow the same pattern: bank examiners under FFIEC procedures, HIPAA and CMS audits in healthcare, FedRAMP third-party assessors and CMMC assessors for public sector suppliers, and PCI qualified security assessors for payment data. All need traceable access to control status, tests and remediation.

Related roles

No items found.

DEEPEN YOUR KNOWLEDGE

Explore Further

Guides and definitions from the GRC Knowledge Center and the What-is glossary, chosen for this role.

Frequently asked questions

The External Auditor is an independent assessor who reviews management's controls, testing and evidence to form an opinion: planning and performing the audit or assessment, reviewing management's control testing and evidence, evaluating deficiencies and their aggregation, following up remediation of prior-year findings and communicating findings to the audit committee. Whether the engagement is a SOX integrated audit under PCAOB AS 2201, a SOC 2 examination under SSAE 18 or an ISO certification, the need is the same: controlled, traceable access to control status, test results and remediation.

SmartSuite provides role-based, read‑only access to testing results, evidence views and activity history, so the External Auditor reviews management's work in the system of record rather than through evidence requests answered by email. The auditor sees the control, the test procedure, the evidence and who performed and reviewed the test, together with the activity history that shows when each step happened. SOX Compliance and SOC 2 Compliance hold the respective programs, and the Head of Internal Controls manages what the auditor can see.

SmartSuite shows remediation progress on findings without a separate status process, so the External Auditor can see for each prior-year finding what management committed to, who owns it, where it stands and whether it has been re‑tested. The SOX Program Manager and the Head of Internal Controls track the same records, which removes the reconciliation between the auditor's finding list and management's tracker. Internal Audit Management holds internal audit's own findings alongside, so reliance decisions have a full picture.

SmartSuite shows the records are consistent and centralized, and export to PDF, Excel or CSV when the engagement file needs a copy, so the External Auditor receives the same structure for every control and every period instead of evidence assembled differently by each owner. Rework falls because the auditor does not re‑request evidence already attached to the test, and because the activity history answers the questions about timing and review that otherwise need a follow‑up. The Chief Audit Executive and the Compliance Director see what the auditor sees, which keeps the three parties aligned.

Management sets up the auditor's role-based, read‑only access to the programs under examination, scoped to the controls, tests and evidence in the engagement, with the activity history recording what was viewed. The External Auditor does not change records, and the access itself is evidence of the controlled process the audit committee expects. The same approach serves bank examiners working under FFIEC procedures, FedRAMP and CMMC assessors and PCI assessors, each needing traceable access to control status, tests and remediation.