Enterprise Risk. Associate Analyst/Analyst

About the Role

The Government and Infrastructure (G&I) practice of Ernst & Young LLP provides a full range of consulting and audit services to help Federal, State, Local and Education clients implement new ideas to help achieve their mission outcomes. The Service Delivery Center (SDC) is made up of high-performing, US-based resources who work closely with experienced professionals to deliver project-based work and managed services to government clients. This role is part of the SDC Risk team aligned to the Enterprise Risk, Controls & Resilience team.

Key Responsibilities

• Carry out assigned engagement tasks to defined procedures, timelines, quality standards, and service levels.
• Help document clients' business and financial processes, risks, and controls by collecting information, supporting walkthroughs, and building process maps and narratives.
• Prepare and track documentation requests, and collect, organize, and maintain evidence.
• Test the design and operating effectiveness of controls against established test plans, in accordance with guidance such as OMB Circular A-123 and relevant state internal control and internal audit statutes, and document results.
• Track deficiencies and corrective action plans (CAPs), and compile observations and root cause information.
• Maintain vendor inventories, risk tiering, and assessment trackers; issue and follow up on vendor due diligence questionnaires; and collect and organize vendor evidence.
• Perform first-level review of vendor responses and assurance evidence against established checklists, flag gaps or exceptions, and run exclusion screening and other risk intelligence checks.
• Track vendor findings, remediation commitments, and reassessment due dates, and refresh vendor risk dashboards.
• Support compliance testing and resilience activities, such as business impact analysis data collection, critical process and dependency mapping, and continuity plan updates and testing.
• Maintain risk registers, and build and refresh recurring risk, control, and compliance reports and dashboards.
• Draft sections of memos, reports, and other deliverables using established templates.
• Research regulatory guidance, current industry standards and trends, and new legislation and requirements.
• Use EY-approved AI and automation tools to improve the speed, accuracy, and consistency of repeatable tasks.
• Track progress and raise risks or issues promptly to your Senior Analyst and engagement leads.
• At the Analyst level: review the work products of Associate Analysts and help onboard new team members.

Requirements & Tech Stack

• Intellectual curiosity and a strong sense of professional skepticism
• Attention to detail and pride in producing accurate, consistent work the first time
• Effective teaming and collaboration with individuals from a variety of backgrounds and skillsets
• Understanding of internal control concepts and frameworks, such as the GAO Green Book, COSO, and OMB Circular A-123, including control testing and risk and control self-assessment
• Ability to quickly grasp complex financial business processes involving multiple stakeholders and information systems
• Knowledge of working paper documentation standards
• Understanding of third-party risk and business continuity concepts, such as vendor risk tiering, due diligence questionnaires, SOC reports, ongoing monitoring, common vendor risk domains (cybersecurity, privacy, financial and operational), and business impact analysis
• Knowledge of how to effectively leverage firm-approved AI tools to enhance problem-solving and productivity and the ability to exercise sound judgment around AI-related risks and considerations
• Ability to assess and articulate the evolving risks that AI presents to clients across multiple risk domains, including AI embedded in vendor products and services
• Proficiency in MS Office (Word, Excel, PowerPoint, SharePoint)
• Ability to become proficient with Tableau or Power BI and Visio
• Ability to meet tight deadlines and follow up on open issues
• Flexibility to travel up to 20%

Qualifications

• A bachelor's degree with an emphasis in Accounting, Finance, Business, Economics, or a related field.
• Associate Analyst: up to 1 year of experience in accounting, audit, internal controls, risk, third-party risk, or compliance, or a demonstrated ability to learn and perform the role.
• Analyst: a minimum of 2 years of experience in accounting, audit, internal controls, risk, third-party risk, or compliance.
• United States citizenship and the ability to obtain and maintain a public trust clearance or higher.
• Strong communication skills, with the ability to analyze business, financial, or technical information and help solve problems.
• Flexibility and ability to work with a nationally distributed team.

Ideally, you'll also have

• Progress toward a relevant certification such as CIA, CGFM, CDFM, CPA, CTPRP, or CBCP.
• Exposure to OMB Circular A-123, the GAO Green Book, state internal control requirements, audit readiness, GRC platforms (e.g., Archer, Optro, ServiceNow), third-party risk management platforms (e.g., ServiceNow Vendor Risk Management, OneTrust, ProcessUnity), or vendor risk intelligence tools (e.g., BitSight, SecurityScorecard).
• Advanced Excel skills (e.g., Power Query, pivot tables) or experience with analytics tools such as Power BI, Tableau, or Alteryx.