Job title

Senior Internal Auditor

Business area

Finance

Reward level and salary

D

Scope of the role

This is an exciting opportunity to join the Internal Audit & Risk (IA&R) team at M&S, working across diverse business areas both in the UK and internationally. You’ll play a pivotal role in reviewing the effectiveness of business processes, challenging and supporting improvements to the control environment, and adding value during ongoing transformational change. The role combines traditional audit delivery with a growing emphasis on data analytics, offering exposure to all commercial and functional activities.

Audit Delivery

• Lead and support audit engagements across the business, ensuring commercial relevance and alignment with the Internal Audit methodology.
• Deliver clear risk assessments, test programmes, and audit reports that address key risks and objectives.
• Adapt audit scope in response to emerging issues and challenges.
• Present findings clearly and objectively, collaborating with Internal Audit Managers and the Assistant Data Manager.
• Ensure stakeholder engagement throughout the audit process, providing regular updates to avoid surprises.
• Maintain high standards of quality, integrity, and delivery against functional KPIs.

Data Analytics & Digital Audit

• Support the development and execution of data-driven audit routines, including scoping, validation, testing, and reporting.
• Collaborate with stakeholders to embed and monitor data testing routines within the business.
• Contribute to the targeted data analytics audit plan and assist in its ongoing refinement.

Audit Plan Development

• Propose relevant audits for inclusion in the annual audit plan based on business insight and stakeholder engagement.
• Support revisions to the audit and data analytics plans throughout the year.

Stakeholder Engagement

• Build strong relationships across all levels of the organisation to gain insight into business risks and controls.
• Engage with the broader data community to ensure process and control considerations are integrated into discussions.
• Use M&S behaviours to enhance credibility and influence.

Continuous Improvement

• Stay current with professional developments, industry changes, and best practices.
• Share insights and contribute to the evolution of audit methodology and control effectiveness.
• Support the update of the department’s learning and development plan, particularly around digital skillsets and data analytics.

Action Follow-Up

• Maintain regular contact with action owners to track progress and ensure timely completion of audit actions.
• Assist in compiling audit action status reports for Operating and Audit Committees.

Job title

Group Risk Analyst

Business area

Internal Audit & Risk, Finance Group, London

Job purpose

A great opportunity to work with different teams across M&S, reviewing the effectiveness of risk management activities, challenging, and supporting improvements to the control environment as well as adding value to the business during the significant ongoing transformational change.

The role of Internal Audit & Risk (‘IA&R’) is to provide independent and objective feedback to the Audit Committee and Business Leadership on key risks to the business and the appropriateness and effectiveness of mitigating controls. The functional remit is extensive and covers all commercial and functional activities. The team also provides consulting support to project teams on the design and implementation of business process controls and conducts investigations in the event of a significant control failure.

Level & Grade

C

Reporting to

Group Risk Manager

Direct reports

0

Scope of the role

• The role is wide ranging, covering all business areas in the UK and internationally and involves interaction and engagement across all levels of the organisation.
• A key aspect of the role will be to manage key risk relationships across the business and support the Group Risk Manager to coordinate the end-to-end group risk reporting process, including supporting the business in risk management process, collating the key group risks and tracking actions against mitigation plans.
• To act as a central point of contact for the business on all risk related matters.

Risk Delivery

• Supporting the half yearly group risk review process, including preparation of the half-yearly Group Risk reports for the Executives, the Executive Committee, the Audit Committee and reports for external disclosure.
• Supporting the facilitation of ongoing identification, management and reporting of key risks, including emerging risks, across the business through the half yearly group risk reviews, including leading discussions in some areas of the business.
• Supporting the qualitative review of risk registers across the business and consolidation of key risks into the principal risks and uncertainties.
• Supporting the development and maintenance of a risk appetite framework for the review and reporting relevant information to senior stakeholders. This includes collecting and collating appropriate data from the business in relation to key risk indicators.
• Maintaining the Group risk guidance material and supporting its practical application across the business.
• Assisting with the assessment and roll-out of a risk management tool across the business and ongoing management of this.

Stakeholder and Relationship Management

• Actively developing strong relationships with a wide range of business contacts to gain knowledge and insight into the issues affecting the business and maintaining effective communication on risk.
• Assisting the business with identifying appropriate risk improvement actions and maintaining quarterly action status reporting to monitor progress against risk mitigations.
• Adopting the M&S behaviours during interactions with the business to give credibility to the risk work undertaken.

Continuous Improvement

• Updating and expanding knowledge of good practices, professional developments, industry changes and sharing these across the risk community within the business and within the internal audit team (as relevant). This includes maintaining risk contacts in the industry to share good practice with.
• Providing ideas and challenge to improve our risk methodology, the control environment and the effectiveness of business risk mitigation plans.

Note that where capacity allows outside of risk delivery, there may be opportunity to support internal audit delivery, working with experienced internal audit colleagues.