Chief Audit Executive

About the Role

The Chief Audit Executive ("CAE") serves as the senior executive responsible for the Bank's independent Internal Audit function. This role provides the Audit Committee and executive management with objective assurance regarding the effectiveness of internal control, including governance, risk management, regulatory compliance, and key strategic initiatives. The CAE reports functionally to the Audit Committee of the Board of Directors and administratively to the Chief Executive Officer, ensuring independence and authority in line with Federal Reserve Supervisory Letter SR 13-1.

The CAE leads a scalable, risk-focused audit function that evolves with the Bank's acquisition-driven growth strategy, supporting an enterprise-wide, risk-based model capable of assessing common processes, strategic initiatives, technology transformation, emerging risks, and market-level risk considerations. The role serves as a trusted advisor to the Audit Committee, executive management, regulators, and external auditors while preserving the independence and objectivity of the Internal Audit function.

Governance and Independence

• Provide independent assurance to the Audit Committee regarding the effectiveness of governance, risk management, regulatory compliance, and internal control processes.
• Maintain an Internal Audit function independent of business line management, free from interference in determining audit scope, performing procedures, communicating results, and evaluating risk.
• Ensure Internal Audit possesses sufficient organizational stature, staffing, specialized expertise, technology capabilities, and budgetary resources.
• Establish and maintain clear advisory guardrails and triggers for early Internal Audit involvement in strategic initiatives, key operational projects, technology transformation, and acquisition-related activities while preserving independence.
• Clarify the roles and responsibilities of Internal Audit in relation to Enterprise Risk Management, SOX/FDICIA readiness, Compliance, and the broader Three Lines model.
• Provide regular executive-session reporting to the Audit Committee on significant risks, control issues, audit results, emerging risk trends, thematic observations, and the overall condition of the internal control environment.
• Ensure changes to the Internal Audit operating model, resources, coverage, and integration activities are appropriately reported to and approved by the Audit Committee as the Bank grows through acquisitions.

Risk Assessment and Audit Planning

• Direct a comprehensive enterprise-wide risk assessment process and develop a dynamic, risk-based audit plan addressing the organization's most significant risks, control activities, strategic initiatives, regulatory expectations, and emerging risk themes.
• Modernize and maintain the audit universe to support enterprise-wide, horizontal, and integrated reviews across common processes, systems, products, markets, and acquired entities.
• Align Internal Audit's risk assessment framework to common industry risk categories and the Bank's evolving risk taxonomy, including credit, market, operational, compliance, technology, cybersecurity, BSA/AML, third-party, model, financial reporting, and strategic risks.
• Evaluate the maturity of Enterprise Risk Management and use ERM outputs, when sufficiently mature, as inputs into audit universe, engagement risk assessment, and thematic risk analysis.
• Periodically reassess audit priorities based on changes in the Bank's risk profile, business strategy, acquisitions, technology, regulatory expectations, remediation trends, and emerging risks.

Audit Methodology, Issue Management, and Quality

• Maintain documented audit methodologies, reporting standards, workpaper expectations, issue rating definitions, validation procedures, and professional practices aligned with regulatory guidance and Institute of Internal Auditors (IIA) standards.
• Standardize issue rating, management action plan, validation, closure evidence, and remediation expectations to promote consistency, transparency, and stakeholder understanding.
• Ensure audit recommendations and management action plans align with the mitigation of identified risks, including clear accountability, remediation expectations, validation requirements, and closure criteria.
• Maintain a Quality Assurance and Improvement Program ("QAIP") and ensure periodic internal and external assessments of the Internal Audit function.
• Establish and monitor performance metrics assessing audit quality, stakeholder feedback, issue management effectiveness, advisory value, risk identification, and progress against strategic improvement initiatives.
• Incorporate new or evolving IIA requirements, including Topical Area Standards, into audit programs, methodologies, and quality practices.

Technology, Data Analytics, and Artificial Intelligence

• Lead the implementation and optimization of Internal Audit technology platforms, including audit management systems, automated reporting, workflow tools, and data analytics capabilities.
• Develop and execute a data analytics strategy embedding analytics across audit planning, fieldwork, testing, issue monitoring, reporting, and continuous monitoring activities.
• Establish governance, standards, documentation expectations, and quality controls for the appropriate use of artificial intelligence within Internal Audit, including challenge and documentation of AI-generated outputs.
• Evaluate and use AI-enabled audit tools and agents to improve risk assessment, audit program development, population-based testing, control testing, reporting, and capacity management.
• Ensure Internal Audit's use of technology, automation, data analytics, and AI aligns with the Bank's adoption pace, risk appetite, regulatory expectations, and professional standards.

Talent, Competencies, and Sourcing Strategy

• Develop and maintain a capability-based talent plan aligning Internal Audit staffing, skills, training, succession planning, and sourcing strategies to the Bank's audit universe, strategic plan, growth objectives, and evolving risk profile.
• Establish a formal skills assessment process at both individual and department levels, including specialized needs in information technology, cybersecurity, compliance, BSA/AML, model risk, data analytics, SOX/FDICIA, and emerging technologies.
• Develop a strategic staffing plan over a multi-year horizon considering acquisitions, regulatory expectations, use of AI and automation, hybrid or remote staffing options, staff augmentation, and co-sourcing or outsourcing needs.
• Oversee co-sourced or outsourced audit activities, including provider selection, scope definition, quality assurance, deliverables, knowledge transfer, regulatory expectations, and independence considerations.
• Reduce reliance on third-party providers for recurring core audit capabilities by building internal expertise where appropriate, while continuing to use specialized providers for targeted subject matter expertise or surge capacity.
• Develop and track department-level and individual-level training and development plans tied to department needs, employee career goals, new regulations, emerging technologies, and industry trends.

Stakeholder Engagement and Advisory Role

• Build and maintain trusted, constructive relationships with the Audit Committee, executive management, regulators, external auditors, business line leaders, and control functions while preserving Internal Audit independence.
• Develop an engagement model for Internal Audit's non-decisioning advisory involvement in key projects, strategic initiatives, technology changes, acquisitions, and process redesign efforts.
• Identify and assess key risk considerations during project execution to support well-designed governance, risk management, and control environments upon implementation.
• Implement a formal stakeholder feedback mechanism, with periodic reporting to the Audit Committee and remediation expectations when feedback trends indicate opportunities to improve service delivery, communication, or consistency.
• Promote stakeholder understanding of Internal Audit's role, independence, methodology, issue rating approach, remediation expectations, and advisory boundaries through communication tools such as Audit 101 materials and engagement kickoff discussions.

Reporting and Value Delivery

• Deliver timely, accurate, risk-focused, and actionable reporting to management and the Audit Committee regarding audit results, issue status, remediation progress, thematic trends, emerging risks, and assurance gaps.
• Shift Internal Audit reporting toward a risk-first perspective explaining the risks to the audited area, the effect of identified issues on unmitigated risk, and the alignment of recommendations and management action plans to risk mitigation.
• Enhance Audit Committee and management reporting to include enterprise themes, forward-looking risk insights, control environment observations, remediation trends, integrated assurance considerations, and data-supported analysis.
• Develop dashboards and recurring reports providing timely visibility into audit coverage, quality, remediation, issue aging, stakeholder feedback, and value delivery.

Continuous Improvement and Scalability

• Maintain a forward-looking Internal Audit improvement roadmap with accountable owners, milestones, target dates, performance measures, and periodic reporting to executive management and the Audit Committee.
• Continuously enhance Internal Audit methodology, technology, talent, reporting, and stakeholder engagement to support the Bank's long-term growth objectives and changing risk environment.
• Develop integration plans for acquired resources, processes, systems, audit coverage, and control environments resulting from acquisition activity.
• Coordinate with Risk, Compliance, SOX/FDICIA, and other assurance functions to support integrated assurance, reduce duplication, and strengthen enterprise-wide visibility into risk and control coverage.