IT Audit Manager

UGI; King of Prussia (PA); On-site; USD 120,000 - 150,000; Full time

Benefits offered by this job

Medical, Vision, and Dental Plans

Health Savings Account (HSA)

Dependent Care Savings Account

Paid Maternity/Paternity Leave

Work from home policy

Employee Assistance Program

401K with company match

Tuition Reimbursement

Credentialing assistance

Referral Bonuses

Employee discount programs

Job summary

UGI Corporation in King of Prussia, PA is seeking an IT Audit Manager to lead SOX IT controls testing, system implementations, and IT risk assessments across our enterprise. You will oversee AI-enabled testing, data analytics, and audits of cyber, OT/ICS, and cloud environments, guiding junior staff and coordinating with IT leadership.

You will manage testing programs, ensure alignment with IIA standards, compliance requirements and external auditors’ expectations, and drive risk-based assurance

Qualifications

• Extensive experience applying IT governance, risk and controls in SOX contexts.
• Strong knowledge of ITGC testing, automated controls, and control documentation.
• Experience with IT, cybersecurity, OT/ICS, and cloud environments.
• Ability to lead, coach and develop audit staff and external resources.
• Familiarity with AI-enabled testing and data analytics in audits.

Responsibilities

• Lead and review IT SOX testing and ITGC audits, including evidence gathering and reporting.
• Oversee system implementations, upgrades and assurance activities from design to post-go-live.
• Plan and conduct risk-based audits of IT, cybersecurity, OT/ICS, and cloud platforms.
• Coach IT senior auditors and manage co-source provider work quality and budgets.
• Design and govern AI-enabled testing procedures and maintain audit documentation.

Skills

SOX IT controls testing

ITGC testing

Automated controls

Data analytics

AI-enabled testing

IT risk assessment

Leadership / coaching

Cybersecurity audits

OT/ICS audits

Stakeholder communication

Tools

SAP

Oracle

JD Edwards

AWS

Azure

Git

CI/CD

Job description

This position is based onsite at our King of Prussia, PA office and is not a remote role. Please apply only if you are able to work onsite at this location.

UGI Corporation (NYSE: UGI) is a holding company that distributes and markets energy products and services through our subsidiaries and the company’s common stock is a balanced growth and income investment. UGI Corporation has paid common dividends for more than 135 consecutive years.

In addition to a challenging career and competitive compensation, our employees enjoy:

Generous and Family-friendly Health & Welfare Benefits Including:

• Medical, Vision, and Dental Plans
• Optional Health Savings Account
• Optional Dependent Care Savings Account
• Paid Maternity/Paternity Leave
• Work from home policy
• Employee Assistance Program

Additional Benefits Include:

• 401K with a generous company match
• Tuition Reimbursement
• Assistance with Professional Credentialing
• Referral Bonuses
• Employee Discount Programs

Position Summary:

Internal Audit is an independent function that provides the Audit Committee and management with objective assurance, advice and insight on UGI’s risks, controls and governance, in conformance with The IIA’s Global Internal Audit Standards. The IT Audit Manager leads Internal Audit’s SOX IT controls testing and review, including the department’s use of AI and agentic AI tools to execute and document control testing. The role also leads assurance over major system implementations and enhancements, and risk-based IT, cybersecurity and operational technology (OT/ICS) audits across the UGI enterprise.

Essential Functions:

1. SOX IT Controls Testing and Review (35%)

• Lead and review Internal Audit’s testing of IT general controls and automated application controls within the SOX scope defined by ICC. Serve as the primary reviewer of testing performed by IT senior auditors and co-source resources, ensuring the work meets IIA Standards, SEC requirements, and supports external auditor reliance.
• Plan and schedule SOX IT testing based on the scope and risk and control matrices provided by ICC; coordinate timing and integrated testing with other IT and Business Process audit managers.
• Review test plans and work papers for ITGCs (logical access, change management, IT operations, program development), automated application controls, key reports/IPE and interfaces, including sampling, evidence sufficiency and conclusions.
• Direct the use of AI and agentic AI tools in SOX testing and review AI-generated results with the same rigor as manually performed work.
• Test management’s controls over service organizations, including review of SOC 1/SOC 2 reports, bridge letters and complementary user entity controls.
• Validate test exceptions with control owners, communicate results to ICC, and support ICC’s deficiency evaluation.

2. System Implementation and Enhancement Assurance (20%)

• Provide independent assurance over major system implementations, upgrades and enhancements (e.g., ERP, billing/customer, work and asset management, cloud migrations) from design through stabilization. Ensure financial, compliance and security controls are built into new systems before go-live rather than remediated afterward.
• Perform pre-implementation, in-flight (agile and waterfall) and post-implementation reviews of project governance, requirements, security and role design, segregation of duties, testing, cutover and hyper-care.
• Assess data migration completeness and accuracy, interface controls, and the impact of changes to SOX in-scope systems, coordinating with ICC on scope implications.
• Advise project teams on control design while preserving Internal Audit’s independence and objectivity.

3. IT, Cybersecurity and OT/ICS Audits (15%)

• Plan and lead risk-based audits of infrastructure, cybersecurity, cloud, data and operational technology environments across UGI’s utility, midstream and energy distribution businesses. Bring an informed point of view on emerging technology risk to management and the Audit Committee.
• Audit cybersecurity program areas, including identity and privileged access, vulnerability management, logging and monitoring, incident response, and resilience/recovery.
• Audit OT/ICS environments (e.g., SCADA, gas control, DCS/PLCs, historians, remote access), including IT/OT segmentation and asset inventory.

Team Leadership and Coordination (15%)

• Lead, coach and develop IT senior auditors, staff and co-sourced resources, setting clear expectations, reviewing work papers and providing timely performance feedback. Serve as an Internal Audit liaison to IT and OT leadership and the CISO on audit scope, timing and results.
• Manage co-source provider work quality, budget and knowledge transfer.
• Upskill the IT audit team on ITGC testing, data analytics and AI-enabled testing techniques.
• Issue clear, risk-rated audit reports that explain technical issues in business terms; validate root cause and agree practical, cost-effective remediation with management.

5.AI-Enabled Testing, Data Analytics and IT Risk Assessment (15%)

• Lead the design, validation and governance of the AI and agentic AI tools Internal Audit uses to perform control testing, together with data analytics and automation. Contribute IT, cyber and OT risk assessment and coverage to the annual audit plan and fulfill departmental administrative responsibilities.
• Design and validate AI-enabled and agentic test procedures before use, including defined tasks, inputs and expected outputs, and accuracy and completeness checks against manually performed results.
• Ensure AI-assisted testing is reviewable and reproducible: retained evidence, documented prompts, configurations and tool versions, logs of agent actions, and documented review and sign-off by the accountable auditor.
• Manage the risks of audit AI tools, including data confidentiality, access permissions for audit agents, and errors or hallucinations, in line with IIA Standards, UGI AI policy and external auditor expectations for reliance.
• Maintain the IT portion of the audit universe; manage engagement budgets and documentation in the audit management system and contribute to the Quality Assurance and Improvement Program (QAIP).
• Knowledge, Skills and Abilities:
  • Standards and frameworks: Expert, practical application of The IIA’s Global Internal Audit Standards (including Topical Requirements), COSO Internal Control – Integrated Framework (2013), and working command of COBIT 2019, NIST CSF 2.0, NIST SP 800-53, ISO/IEC 27001:2022 and CIS Controls.
  • SOX IT controls testing: Deep expertise in testing ITGCs, automated application controls, IPE/key reports, interface controls and segregation of duties/sensitive access; sound judgment on sampling, evidence sufficiency and work-paper review; understanding of how management scopes SOX and evaluates deficiencies, and of external auditor reliance requirements (PCAOB AS 2201 and AS 2605).
  • Technology stack: Hands-on ability to read and evaluate configurations, security parameters and role/access designs across Windows and Linux, Active Directory/Entra ID, Oracle and SQL Server databases, ERP and financial applications (e.g., SAP, Oracle, JD Edwards) and AWS/Azure cloud; to evaluate change management in Git-based, CI/CD and SaaS release environments; and to interpret vulnerability scanning, SIEM and identity governance outputs. Working knowledge of job scheduling, backup and recovery, and network security architecture.
  • AI and agentic AI in audit: Hands-on