Job Title:

Senior IT Auditor

Brand/ Function:

Group Internal Audit

Job Holder

Vacancy

Reports to:

Sally King

IA and Risk Director

JD Completed By:

Kubashni Sannasy

Direct reports

-

Date:

01/07/2026

What is the main purpose of the job?

To provide independent, objective assurance to the Audit Committee on the effectiveness of Whitbread’s system of Technology & Data risk management and internal control environment across all business units in the UK and internationally. The role supports Whitbread in accomplishing its objectives by bringing a systematic, disciplined approach to evaluating and improving the effectiveness of risk management, control and governance, while providing consulting advice that adds value and improves operations. It also acts as a trusted advisor and critical friend to business and IT stakeholders by translating complex technology, cyber and data risks into clear business impacts for senior stakeholders and governance forums. The role is integral in delivering the strategic objectives of the Internal Audit and Risk function.

The role involves working with senior stakeholders across Whitbread and therefore requires excellent interpersonal skills, strong influencing and negotiation skills, and the ability to work effectively with diverse groups. Working in small teams across all Whitbread operations, this role requires a team player with strong planning and organisational skills to carry out efficient and effective IS audits. It will involve the use of data analytics tools such as Power BI, and AI tools such as Microsoft Copilot and Claude throughout the audit lifecycle. Strong data analysis, report writing, and communication skills are required.

Who are the Job holder main customers?

The role will support the IA & Risk Director, working with Technology and Business stakeholders across all business areas (up to Director level), external auditors, and any relevant third parties, including internal audit co-source providers.

Main Tasks and Activities

Measures

Audit Planning:

- Assist and support the development of the annual internal audit plan for Whitbread, using risk, assurance and business change inputs, including risk assessments and engagement with key stakeholders, to shape a targeted IT audit plan aligned to the highest priority technology and data risks;

- Plan and scope IT internal audit reviews, including meeting key stakeholders, drafting audit Terms of Reference. Audits may include programme assurance reviews as well.

Audit Fieldwork:

- Develop RACM which includes designed and operating effectiveness testing procedures, as well as use of data analytics.

- Meet with stakeholders to understand the design of key information system controls and carry out detailed testing to identify control gaps;

- Manage relationships with key stakeholders, both business and IT, to ensure they are aware of the issues being identified through the audit;

- Where required, manage co-source resource to deliver audit fieldwork, ensuring audit evidence, testing rationale and issue traceability are clearly documented to support quality assurance and audit defensibility.

Audit Reporting:

- Draft high-quality, clear and concise audit reports which clearly distinguish between issues, root cause, risk impact, management actions and agreed ownership to support accountability and effective decision-making.

Audit Action Tracking:

- Monitor implementation of control recommendations, and assist in reporting status to the Board and Audit Committee.

Data Analytics and AI Enablement:

- Maintain and enhance existing data analytics use cases, models and dashboards, including Power BI outputs where relevant, while consistently identifying opportunities to apply data analytics and AI-enabled approaches responsibly, with appropriate data quality checks, validation and documented limitations, to improve audit planning, fieldwork, insight generation and reporting.

IT Risk Management:

- Provide guidance to stakeholders to assess and manage IT risks, including emerging technology, cyber, data, resilience and third-party risks, and understand where processes could go wrong, where key controls are IT enabled and what improvements could be made.

Programme Assurance:

- Work with the business to provide assurance on, and governance of, key IT projects and critical change activities, including consideration of delivery risk, control readiness, benefits realisation and governance effectiveness for major technology and data change programmes.

Internal Audit Best Practices:

- Develop the Internal Audit function by suggesting and driving improvements to auditing practices, methods, procedures and documentation, specifically around data analytics and integrated audits.

ExCo and Audit Committee Reporting:

- Coordinate and draft ExCo and Audit Committee reports, ensuring key messages, issue updates and supporting information are accurate, complete and issued in line with agreed reporting timelines.

• Feedback from IA Management
• IA KPI metrics - Timely completion of assigned audits to highest standards with positive feedback from key stakeholders; audit reports are valued by the Audit Committee & Management;
• QAIP internal review with minimal comments
• Audit work is thoroughly documented, there is robust tracking of open audit issues, and audit outputs demonstrate clear linkage between risk assessment, testing performed, evidence obtained, findings raised and final audit opinion.
• ExCo and Audit Committee reporting packs are accurate, complete and issued in line with agreed governance timelines.
• Committee reporting clearly reflects key risks, issue status, management actions and agreed decisions, with minimal rework required following review.
• Existing data analytics use cases, models and dashboards remain accurate, relevant and maintained in line with audit requirements.
• Data analytics implemented in all audits, driving insight to stakeholders

Qualifications

Skills

(Expert ability)

Experience

(Proven expertise)

Essential:

• Educated to degree level
• CISA
• Knowledge of relevant IT governance, risk, control and security frameworks, e.g. COBIT, ITIL, ISF, NIST, GDPR and PCI DSS.
• Knowledge of project delivery methodologies, e.g. Prince2, Agile

Essential:

• Excellent written and verbal communication skills
• Ability to challenge senior colleagues and influence business stakeholders with limited technical information systems expertise
• Rigour/attention to detail
• Ability to think conceptually
• Analytical skills
• Professional scepticism /ability to apply judgement
• Organisation and project management
• Expertise in using data tools (Power BI) and delivering impactful data analytics
• Experience with data visualisation tools and techniques
• Ability to design and apply AI-enabled tools responsibly, including prompts and agents, while validating outputs and maintaining professional judgement to support audit planning, analysis, documentation and reporting.

Essential:

• Track record of IT auditing within a listed business with multi-site or global operations and/or Big4 professional audit firm
• Experience delivering integrated IT/business process audits
• Experience of providing project assurance reviews for transformational change
• Expertise in delivering technical internal audits/reviews, e.g. Cyber Security, cloud, third-party technology risk, data governance, access management, and resilience

Desirable:

• Computer Science, Information Technology or similar degree
• Accounting qualification
• Programme assurance or controls qualifications, e.g. PMP, ITIL, Prince2, Agile, SCRUM Master
• Certification in AI Governance, Cybersecurity or Technology Risk

Desirable:

• PowerAutomate
• SQL

Desirable:

• Experience of large-scale multi-site Retail or hospitality operations
• Experience in auditing Oracle or other ERP systems, cloud platforms, SaaS environments, data platforms or digital customer-facing technology.

Level

Senior / Principal Data Scientist

Location

Chertsey head office

Working pattern

Hybrid — typically around 3 days a week on-site, with the flexibility to work from home

Reports to

Group Director of Risk and Internal Audit

Travel

Occasional international travel

Job Purpose

Dimensions

Risk

• Identify, lead, and implement the continuous improvement of Sport England’s Risk and Assurance framework to strengthen performance, capability and resilience 
• Set a clear strategic direction for the management of key strategic, operational and compliance risks in collaboration with ELT and the Audit, Risk and Governance Committee.

• By embedding Orange Book principles. lead the organisation’s risk-maturity journey by strengthening leadership ownership of risk, ensuring consistency approach so that risk intelligence routinely informs investment design, programme assurance, business planning and organisational performance.
• Provide trusted expert advice to senior leaders and stakeholders enabling the organisation to effectively manage material risks, ensuring external developments are anticipated, appropriately escalated and proportionate mitigation identified and monitored
• Ensure resources, priorities and plans are aligned to deliver agreed outcomes and manage demand effectively within functional area
• Co-ordinates business continuity planning activity across the organisation ensuring that critical processes are periodically tested for crisis situations

55%

Internal Audit

• Manage Sport England’s strategic relationship with its internal auditors to ensure the maximising the value added through the outsourcing of internal audit.
• Act as lead advisor to the Executive Leadership Team and Audit Risk and Governance Committee on internal audit plans, outcomes, and implementation of recommendations.
• Contributing to the drafting of Sport England’s Governance Statement.
• Ensure Internal Audit Plan is integrated with risk register to highlight opportunities for efficiency and effectiveness

10%

Internal Governance & Assurance

• Lead the establishment and implementation of best practice internal governance practices acting as senior point of contact on all internal governance matters.
• Corporate owner of key internal governance policies (including counter-fraud, anti-bribery and corruption, declarations and conflicts of interest and whistleblowing) and monitors compliance with them.
• Monitoring and assessing Sport England’s compliance with all Government Functional Standards.
• Work closely with first-line teams to embed sound internal control practices and proportionate assurance arrangements that support these forums and underpin effective decision making.
• Embed the assurance frameworks within business planning and investment management processes, enabling shared ownership of good governance and control.
• Lead the response to compliance issues, including data evaluation and preparation of reports.
• Lead the development and implementation of organisation wide policies, and procedures, raising awareness of compliance programs, including mandatory and refresher training.

35%

Pervasive

• Provides direction, judgement and accountability.
• Manages, supports and develops others.
• Builds effective relationships and collaboration.
• Communicates clearly and adapts approach, influencing where appropriate
• Plans, prioritises and organises work effectively.
• Manages budgets and resources responsibly.
• Uses evidence and learning to improve outcomes.
• Uses professional and specialist knowledge, standards, frameworks and processes relevant to the function
• Applies relevant strategy, policy, governance and compliance requirements.
• Interprets complex information and translates it into practical advice, plans or actions
• Uses evidence, insight and evaluation to improve delivery and impact
• Builds capability through support, coaching and knowledge sharing.
• Role models professional and inclusive behaviours.
• Creates a positive, collaborative and high-performing team culture.
• Leads a culture consistent with the Nolan principles of integrity, objectivity, accountability, openness, honesty and leadership reinforcing shared responsibility for protecting public funds.

N/a

Organisation Value and Behaviours

Person Specification