IT Audit Manager

Requisition Number: 30926 

UGI Corporation (NYSE: UGI) is a holding company that distributes and markets energy products and services through our subsidiaries and the company’s common stock is a balanced growth and income investment. UGI Corporation has paid common dividends for more than 135 consecutive years.

In addition to a challenging career and competitive compensation, our employees enjoy:

Generous and Family-friendly Health & Welfare Benefits Including:

•    Medical, Vision, and Dental Plans 
•    Optional Health Savings Account
•    Optional Dependent Care Savings Account
•    Paid Maternity/Paternity Leave
•    Work from home policy
•    Employee Assistance Program

Additional Benefits Include:

•    401K with a generous company match
•    Tuition Reimbursement
•    Assistance with Professional Credentialing
•    Referral Bonuses
•    Employee Discount Programs

Position Summary:

Internal Audit is an independent function that provides the Audit Committee and management with objective assurance, advice and insight on UGI’s risks, controls and governance, in conformance with The IIA’s Global Internal Audit Standards. The IT Audit Manager leads Internal Audit’s SOX IT controls testing and review, including the department’s use of AI and agentic AI tools to execute and document control testing. The role also leads assurance over major system implementations and enhancements, and risk-based IT, cybersecurity and operational technology (OT/ICS) audits across the UGI enterprise.

The role coordinates SOX testing with other IT and Business Process audit managers, the SOX management team (ICC) and the external auditor, and works closely with IT and OT leadership, the CISO and co-sourcing partners.

Essential Functions: 

1.   SOX IT Controls Testing and Review (35%)

• Lead and review Internal Audit’s testing of IT general controls and automated application controls within the SOX scope defined by ICC. Serve as the primary reviewer of testing performed by IT senior auditors and co-source resources, ensuring the work meets IIA Standards, SEC requirements, and supports external auditor reliance.
• Plan and schedule SOX IT testing based on the scope and risk and control matrices provided by ICC; coordinate timing and integrated testing with other IT and Business Process audit managers.
• Review test plans and work papers for ITGCs (logical access, change management, IT operations, program development), automated application controls, key reports/IPE and interfaces, including sampling, evidence sufficiency and conclusions.
• Direct the use of AI and agentic AI tools in SOX testing and review AI-generated results with the same rigor as manually performed work.
• Test management’s controls over service organizations, including review of SOC 1/SOC 2 reports, bridge letters and complementary user entity controls.
• Validate test exceptions with control owners, communicate results to ICC, and support ICC’s deficiency evaluation.

2.   System Implementation and Enhancement Assurance (20%)

• Provide independent assurance over major system implementations, upgrades and enhancements (e.g., ERP, billing/customer, work and asset management, cloud migrations) from design through stabilization. Ensure financial, compliance and security controls are built into new systems before go-live rather than remediated afterward.
• Perform pre-implementation, in-flight (agile and waterfall) and post-implementation reviews of project governance, requirements, security and role design, segregation of duties, testing, cutover and hyper-care.
• Assess data migration completeness and accuracy, interface controls, and the impact of changes to SOX in-scope systems, coordinating with ICC on scope implications.
• Advise project teams on control design while preserving Internal Audit’s independence and objectivity.

3.   IT, Cybersecurity and OT/ICS Audits (15%)

• Plan and lead risk-based audits of infrastructure, cybersecurity, cloud, data and operational technology environments across UGI’s utility, midstream and energy distribution businesses. Bring an informed point of view on emerging technology risk to management and the Audit Committee.
• Audit cybersecurity program areas, including identity and privileged access, vulnerability management, logging and monitoring, incident response, and resilience/recovery.
• Audit OT/ICS environments (e.g., SCADA, gas control, DCS/PLCs, historians, remote access), including IT/OT segmentation and asset inventory.

4. Team Leadership and Coordination (15%)

• Lead, coach and develop IT senior auditors, staff and co-sourced resources, setting clear expectations, reviewing work papers and providing timely performance feedback. Serve as an Internal Audit liaison to IT and OT leadership and the CISO on audit scope, timing and results.
• Manage co-source provider work quality, budget and knowledge transfer.
• Upskill the IT audit team on ITGC testing, data analytics and AI-enabled testing techniques.
• Issue clear, risk-rated audit reports that explain technical issues in business terms; validate root cause and agree practical, cost-effective remediation with management.

5.AI-Enabled Testing, Data Analytics and IT Risk Assessment (15%)

• Lead the design, validation and governance of the AI and agentic AI tools Internal Audit uses to perform control testing, together with data analytics and automation. Contribute IT, cyber and OT risk assessment and coverage to the annual audit plan and fulfill departmental administrative responsibilities.
• Design and validate AI-enabled and agentic test procedures before use, including defined tasks, inputs and expected outputs, and accuracy and completeness checks against manually performed results.
• Ensure AI-assisted testing is reviewable and reproducible: retained evidence, documented prompts, configurations and tool versions, logs of agent actions, and documented review and sign-off by the accountable auditor.
• Manage the risks of audit AI tools, including data confidentiality, access permissions for audit agents, and errors or hallucinations, in line with IIA Standards, UGI AI policy and external auditor expectations for reliance.
• Maintain the IT portion of the audit universe; manage engagement budgets and documentation in the audit management system and contribute to the Quality Assurance and Improvement Program (QAIP).

• Knowledge, Skills and Abilities: 

   

  • Standards and frameworks: Expert, practical application of The IIA’s Global Internal Audit Standards (including Topical Requirements), COSO Internal Control – Integrated Framework (2013), and working command of COBIT 2019, NIST CSF 2.0, NIST SP 800-53, ISO/IEC 27001:2022 and CIS Controls.
  • SOX IT controls testing: Deep expertise in testing ITGCs, automated application controls, IPE/key reports, interface controls and segregation of duties/sensitive access; sound judgment on sampling, evidence sufficiency and work-paper review; understanding of how management scopes SOX and evaluates deficiencies, and of external auditor reliance requirements (PCAOB AS 2201 and AS 2605).
  • Technology stack: Hands-on ability to read and evaluate configurations, security parameters and role/access designs across Windows and Linux, Active Directory/Entra ID, Oracle and SQL Server databases, ERP and financial applications (e.g., SAP, Oracle, JD Edwards) and AWS/Azure cloud; to evaluate change management in Git-based, CI/CD and SaaS release environments; and to interpret vulnerability scanning, SIEM and identity governance outputs. Working knowledge of job scheduling, backup and recovery, and network security architecture.
  • AI and agentic AI in audit: Hands-on ability to design, configure and validate AI- and agent-assisted test procedures (e.g., evidence extraction, attribute testing) and evidence their accuracy, completeness and audit trail; working knowledge of how generative and agentic AI tools operate (LLMs, retrieval-augmented generation, tool/API use, agent orchestration) and of their limitations (hallucination, incomplete extraction, inconsistency, data leakage); familiarity with The IIA’s AI Auditing Framework and the NIST AI RMF.
  • Operational technology (OT/ICS): Ability to describe and assess an OT architecture (Purdue levels, IT/OT DMZ, remote access paths), common ICS components and protocols, and their principal cyber and operational risks, recognizing OT’s safety- and availability-first priorities; knowledge of relevant standards and regulation.
  • Project and SDLC assurance: Knowledge of project governance, agile and waterfall delivery and ERP implementation lifecycles, and the controls that matter at each phase.
  • Data analytics and automation: Hands-on SQL and at least one analytics tool or language (e.g., Python, ACL, Alteryx, IDEA), with visualization (Power BI or Tableau), used to independently analyze system-generated data, test its completeness, accuracy, and perform testing and continuous monitoring.
  • Business acumen and communication: Ability to translate complex technical issues into business risk, and to write and present concise, persuasive conclusions to senior management.
  • Leadership and relationships: Proven ability to lead teams and co-source partners, manage multiple concurrent engagements on time and within budget, and build credible relationships with technical and non-technical stakeholders.
  • Travel and work location: Ability to travel approximately 5% (domestic and international), including visits to operational sites to observe OT environments, and to commute to Reading locations on occasion.
  • Minimum Qualifications: Please list required levels of education, professional certifications and specific experience.

   

  Education:      

   

  • Bachelor’s degree in Information Systems/MIS, Computer Science, Cybersecurity, Computer or Electrical Engineering, or Accounting with an Information Systems concentration.
  • Preferred: Master’s degree (e.g., MSIS, Cybersecurity, Data Science or MBA).
  • Length of Experience:             Minimum 8 years of progressive IT audit, IT risk or technology assurance experience, including:
  • At least 5 years performing and reviewing SOX ITGC and application control testing for SEC registrants (Big 4 or national public accounting firm experience strongly preferred).
  • At least 3 years in a supervisory or manager capacity (scoping engagements, reviewing work papers, leading staff and/or co-source teams).
  • Lead or significant role on at least two assurance reviews of ERP or other major financial system implementations or upgrades (pre- and post-implementation).
  • Certifications:              Required:
  • Active CISA (Certified Information Systems Auditor, ISACA).
  • Plus at least one additional active credential: CPA, CIA, CISSP, CISM, CRISC, CCSP or GICSP.
  • Preferred:
  • AI audit/governance: ISACA AAIA (Advanced in AI Audit) or IAPP AIGP.
  • OT/ICS: GIAC GICSP or GRID, or ISA/IEC 62443 Cybersecurity certificate.
  • Cloud: AWS or Microsoft Azure security certification, or CSA CCSK/CCSP.
  • Project: PMP or Agile (e.g., PMI-ACP, Certified ScrumMaster).
  • All credentials must be maintained in active status with required CPE.
  • Other: Required:
  • Experience performing risk-based audits of core IT functions (infrastructure, applications, databases, information security, cloud).

All offers of employment are contingent upon the successful completion of a background check and drug screen, subject to applicable laws and regulations.

UGI Corporation is an Equal Opportunity Employer.  The Company does not discriminate on the basis of race, color, sex, national origin, disability, age, gender identity, sexual orientation, veteran status, or any other legally protected class in its practices.