CONFIDENTIAL

Job Title Group Internal Controls Manager Location Chertsey Head Office Reporting to Head of Financial & ESG Controls

Role Overview The Group Internal Controls Manager plays an important role in supporting the design, implementation and embedding of a robust SOX-like internal controls over financial reporting (ICFR) across Compass Group. Compass Group aims to operate a robust UK Corporate Governance Code control environment and as part of this seeks to achieve control standards aligned with US SOX over its ICFR. This role will be at the forefront of this ambition, supporting the evolution of the Group’s ICFR framework in a proportionate and scalable way. The successful candidate will bring recent, hands-on experience implementing, operating and/or auditing strong (including SOX) frameworks, and will apply this expertise to help elevate the Group’s internal control maturity across a large, decentralised global organisation. Operating as part of the Group Second Line of Defence, the role partners closely with countries, head office functions, Internal Audit and External Audit to ensure controls are appropriately designed, documented, tested, remediated and governed in line with UK Governance Code, SOX and ICFR expectations. Key Responsibilities ICFR Framework enhancement • Support the implementation and enhancement of financial controls to align with a SOX-style

ICFR framework across Compass Group. • Support the design of risk assessments, scoping methodologies, materiality thresholds and

control rationalisation. • Support the development and maintenance of Risk and Control Matrices (RACMs) aligned to

best practice (SOX standards). • Drive consistent application of best practice concepts such as key controls, Information

Produced by the Entity (IPE), IT-dependent controls, entity-level controls and management review controls (MRC).

• Document end-to-end process flows to support risk identification, control design, testing and audit requirements

Embedding Controls • Work hands-on with countries and head office functions to understand processes, facilitate

standardisation, and embed best practice (SOX style) controls into end-to-end financial processes.

• Provide expert challenge and guidance to process and control owners on design, documentation and evidence standards.

• Translate technical requirements into clear, practical guidance suitable for a decentralised operating model.

CONFIDENTIAL

• Build strong control capability across the business through training, coaching, sharing of best practice and knowledge sharing.

Testing, Deficiencies & Remediation • Perform testing of design and operating effectiveness of key controls. • Review testing performed by the business, ensuring alignment with best practice including

SOX methodology. • Assess deficiencies including severity evaluation (deficiency, significant deficiency, material

weakness). • Perform root cause analysis and support the design of robust remediation plans. • Track remediation progress and ensure timely and sustainable closure of control issues.

Audit & Governance • Act as a key UK Governance Code, SOX and ICFR liaison with internal audit and external

audit. • Contribute to bi-annual controls compliance reporting & review. • Support governance and controls reporting to key stakeholders.

Skills & experience • Recent, hands-on experience implementing, operating and/or auditing SOX 404 internal

controls. • Strong working knowledge of UK Governance Code and SOX methodologies including

scoping, risk assessment, key control identification, IPE, sampling, testing and remediation. • Experience working with external auditors on controls audits or readiness programmes. • Strong understanding of core financial processes (Record to Report, Order to Cash, Procure

to Pay, Hire to Retire). • Strong stakeholder management skills with the ability to influence and challenge

stakeholders. • Pragmatic mindset with the ability to apply rigour proportionately. • Professionally qualified accountant (ACA, ACCA, CIMA or equivalent). • Background in SOX compliance, Internal Audit, External Audit or Risk Assurance.

What This Role Offers • Opportunity to support the enhancement of a robust UK Corporate Governance Code

control environment to achieve control standards aligned with US SOX in a FTSE 20 global organisation.

• High visibility with senior stakeholders. • Ability to help shape the Group’s ICFR framework and long-term SOX roadmap. • International exposure and strong professional development opportunities.

EAT | Enterprise Assurance Transformation

Data, MI & Assurance Manager | Job Description Page 1

Role Profile

JOB TITLE ICFR Lead

LOCATION United Kingdom

FUNCTION / DEPARTMENT Financ e | EAT – SOX Imple m e nta ti on

REPORTING TO Head of Risk, Control & Gover na nc e

DIRECT REPORTS Financ e Analyst / ICFR Analyst

KEY STAKEHOLDERS UK financ e and sector leader shi p; Corpor at e Gover na nc e ; proce ss and

control owner s across the busine ss; Group Financi al Control ; Internal Audit; External Audit; IT / ERP (CIO) teams

Role Overview

Compass Group aims to operate a robust UK Corporate Governance Code control environment and, as part of this, seeks to achieve control standards over its internal controls over financial reporting (ICFR) aligned with US SOX. The overall ICFR programme is led by Group Financial Control in a proportionate and scalable way, with this role responsible for driving its design, implementation and embedding across the UK business.

The ICFR Lead is a senior, hands-on leadership role responsible for driving the design, implementation and embedding of a SOX-standard ICFR framework across a large and complex UK business. Operating as part of the Second Line of Defence and working to the Group ICFR framework, the role leads the UK ICFR journey, from first-year implementation planning through to a mature, sustainable control environment, and is the UK business’s senior point of expertise and challenge on financial controls. As the framework matures, the role also improves the efficiency and effectiveness of the control environment through process improvement and automation, and provides a robust challenge and expertise on the design and implantation of controls.

This role calls for an individual who can make an immediate impact and deliver from the outset. The successful candidate will bring extensive, recent and hands-on experience of implementing SOX to a full 404 standard, including genuine in-house experience of running a first-year implementation, not solely an external audit or advisory perspective. They will have the calibre, gravitas and technical depth the programme demands, and the leadership presence to set direction, influence and challenge senior stakeholders, and support the business on the journey.

While building and leading a team, the ICFR Lead will remain willing to operate hands-on and engage directly in the detail of delivery, including walking processes, drafting control matrices, testing controls and remediating issues alongside the business.

Key Responsibilities

Leading the UK ICFR Journey

• Lead the delivery of the SOX-standard ICFR framework across the UK business, working to the Group ICFR programme and methodology and setting the local plan, milestones and priorities for the first-year implementation and beyond.

• Act as the senior point of expertise on ICFR for the UK business, providing a robust second-line opinion and expert direction, challenge and decision-making on control design, scoping and remediation.

• Drive efficiency and effectiveness in the control environment through process optimisation, standardisation and automation as the framework matures.

• Introduce and manage management self-assessment of key controls, building ownership and accountability across the first line.

• Set the tone and pace of the ICFR journey, building momentum, holding the business to account for delivery, and embedding a strong controls culture across a complex operating model.

• Partner with UK finance leadership and Group Financial Control to ensure the UK framework aligns with the Group ICFR programme, methodology, expectations and reporting.

EAT | Enterprise Assurance Transformation

Data, MI & Assurance Manager | Job Description Page 2

ICFR Finance Data & Governance

• Develop finance data structures, reporting models, ownership frameworks and supporting documentation. • Manage General Ledger mapping, rationalisation and ownership across accounts, cost centres, profit

centres, legal entities and reporting hierarchies. • Define data-quality measures, reporting controls and issue-resolution processes to improve the reliability

and accessibility of finance data.

ICFR Framework Design & Implementation • Lead risk assessments, scoping methodologies, materiality thresholds and control rationalisation to a SOX

404 standard. • Direct the development and maintenance of Risk and Control Matrices (RACMs) aligned to best practice /

SOX standards, supporting the largest and most complex parts of the business as they document and operate their RACMs.

• Drive consistent application of key controls, Information Produced by the Entity (IPE), IT-dependent and IT general controls (ITGCs), entity-level controls (ELCs) and management review controls (MRCs).

• Oversee end-to-end process documentation (walkthroughs and flowcharts) to support risk identification, control design, testing and audit requirements.

Embedding Controls & Business Partnering

• Work hands-on with UK finance and operational teams to understand processes, facilitate standardisation and embed SOX-style controls into end-to-end financial processes (Record to Report, Order to Cash, Procure to Pay, Hire to Retire).

• Provide expert challenge and guidance to process and control owners on control design, documentation and evidence standards.

• Identify and document best-practice controls and make these available across the business, together with practical guidance and job aids on documentation and evidence standards.

• Translate technical SOX requirements into clear, practical guidance suitable for a complex business. • Advise on the control impact of process changes, new systems and ERP / finance transformation initiatives

(e.g. SAP).

Testing, Deficiencies & Remediation

• Lead and coordinate testing during implementation and readiness, ensuring controls are appropriately evidence and deficiencies identified ahead of transition into the ongoing assurance model.

• Review testing performed by the business, ensuring alignment with SOX methodology. • Assess deficiencies, including severity evaluation (deficiency, significant deficiency, material weakness),

perform root cause analysis and design robust remediation plans. • Drive and track remediation progress through the implementation and readiness phases, supporting timely

and sustainable closure of control issues.

Leading & Developing the Team

• Lead and develop the UK ICFR implementation capability, directly managing the ICFR Analyst and coordinate wider finance, controls and specialists resources across the programme.

• Build strong control capability across the wider business through training, coaching and knowledge sharing.

• Balance leadership of the team with personal, hands-on delivery of the most complex or critical control work.

Audit, Governance & Reporting

• Act as the key UK liaison with Internal Audit and External Audit on ICFR matters, coordinating requests and managing readiness.

• Provide regular updates to UK and Group leadership on the effectiveness of the control environment and the progress of the ICFR journey.

• Contribute to bi-annual controls compliance reporting and review.

EAT | Enterprise Assurance Transformation

Data, MI & Assurance Manager | Job Description Page 3

Knowledge, Skills & Experience

Essential • Extensive, recent, hands-on SOX experience: significant experience (typically 7 to 10 years across financial

controls, internal audit, external audit or risk assurance) implementing, operating and testing SOX 404 internal controls in a large, complex business.

• In-house SOX implementation experience: demonstrable experience implementing and operating SOX from within a business (industry), not solely from an external audit or advisory perspective. This is essential.

• First-year implementation experience: a track record of leading a SOX / ICFR first-year implementation end to end (scoping, risk assessment, control design, documentation, testing and remediation).

• Senior Manager calibre with a strong leadership presence: the gravitas, resilience and strength of personality to lead the ICFR journey, set direction, and influence and challenge stakeholders up to and including senior leadership.

• Hands-on leadership: able to lead and develop a team while remaining personally engaged in the detail of delivery.

• Ability to operate in complexity: experience delivering controls in a large, complex, decentralised and/or multi-site business.

• Continuous-improvement mindset: experience enhancing control environments through process optimisation and automation.

• Systems and technical grounding: command of financial reporting systems, processes and control frameworks, and a solid understanding of IFRS and/or US GAAP.

• Professionally qualified accountant (ACA, ACCA, CIMA, CPA, CIA or equivalent). • Strong working knowledge of SOX methodology (scoping, risk assessment, key control identification, IPE,

sampling, testing and remediation) and of core financial processes (R2R, O2C, P2P, H2R). • Strong stakeholder management skills, with the ability to influence and challenge, and to translate rigour

into a proportionate, pragmatic approach.

Desirable

• Big 4 / professional services background combined with subsequent in-house experience. • Experience working with external auditors on controls audits or SOX readiness programmes. • Working knowledge of SOX / GRC tooling (Optro/AuditBoard), ERP environments (e.g. S/4 HANA) and

consolidation / reporting systems (HFM). • Experience contributing to Executive Committee, Audit Committee or Group-level controls reporting.

What This Role Offers • The opportunity to lead, shape and embed the ICFR journey for a major UK business within a FTSE-listed

global organisation operating to control standards aligned with US SOX. • The scope to modernise the control environment as it matures, through process improvement and

automation. • A high-profile role with significant visibility to UK and Group senior stakeholders. • The chance to build a framework and a team from a position of genuine influence. • Strong professional development and international exposure.

Title Group Internal Control Manager

Company Smurfit Westrock

Country Ireland

Location Dublin – Group HQ

Function Group Internal Control

About Smurfit Westrock

Smurfit Westrock, a global leader in sustainable paper and packaging, operates in 40 countries with over 500 packaging converting operations and 62 paper mills. We offer an unparalleled portfolio of innovative packaging solutions, ranging from corrugated and consumer packaging to Bag-in-Box® packaging and point- of-sale displays. With the circular economy at the core of our business, we use renewable, recyclable and recycled materials to create sustainable packaging solutions. As a trusted partner to companies across the world, Smurfit Westrock is dedicated to creating efficient and scalable paper and packaging solutions to help solve complex packaging challenges. We are committed to delivering meaningful value for shareholders, customers, employees and the communities where we operate.

Overview/Background

This is an opportunity to join the Group Internal Control team at the beginning of the journey of assessment of risks and internal control over financial reporting (ICFR) following the New York Stock Exchange (NYSE) listing of the combined Smurfit Westrock organisation. In this challenging role, you will have the chance to help shape and drive the company’s Sarbanes Oxley (SOX) framework, while building relationships with key stakeholders within the business along the way. As such, adherence to deadlines, communication skills and a flexible approach will be vital.

Key Accountabilities/Responsibilities

• Contribute to the design of the Group’s internal control framework. Identify opportunities to increase efficiency and continuously improve the framework

• Develop and maintain strong relationships with business stakeholders across various regions

• Support with queries, identify knowledge gaps and provide training/ guidance

• Contribute to the preparation of the Group financial risk assessment and scoping for SOX

• Contribute to the administration of the quarterly and annual SOX certification processes

• Work closely with the business to ensure key controls are timely identified and embedded in the process, tested, and operating effectively

• Monitor & advise process owners on action plans for remediation of deficient controls on a timely basis

• Perform root cause analysis and design efficient and effective remediation plans

• Work closely with process/control owners to ensure that deficiencies are timely resolved

• Create value for the business by helping to design effective solutions to drive compliance with company policies in an efficient manner & thereby reduce the risk of material financial reporting misstatements

• Contribute to the preparation of periodic reporting to key stakeholders such as senior management

• Assist in developing practical approaches and solutions that address internal control compliance challenges and issues

• Assist to drive change, implement process improvements, and be a valued business partner.

Key Competencies/Qualifications/Requirements

• >7 years of relevant professional experience, including experience in a financial compliance role (with a strong preference for SOX experience)

• Fluent in English, Spanish an advantage

• Able to prioritise, meet deadlines and get the job done

• Able to identify, document and evaluate key financial & business control processes in a global organisation, with a strong understanding of the relationship between risks and controls

• Strong analytical skills

• Strong communication and relationship management skills with key stakeholders within the business

• A proactive & flexible team player - ready and willing to listen and learn in a hands-on environment

• Driven and self-motivated