Senior Manager, SOX

For more than 25 years, Corcept has been singularly focused on the science of cortisol, a powerful hormone that when unregulated, can play a role in a broad range of diseases.

Our commercial portfolio includes treatments for hypercortisolism and oncology, and the company has discovered more than 1,000 proprietary selective cortisol modulators and glucocorticoid receptor antagonists. With advanced clinical trials in patients with hypercortisolism, solid tumors, ALS and liver disease, Corcept is unlocking the power of cortisol modulation to help address some of the most devastating diseases patients face today.

Corcept is headquartered in Redwood City, California. To learn more, visit www.corcept.com.

The Senior Manager, SOX will support the Director, SOX in managing and continuously improving the company’s Sarbanes-Oxley compliance program, with particular emphasis on internal controls over financial reporting, information technology general controls, automated controls, key reports, interfaces, and third-party service organizations. This role partners closely with Finance, Internal Audit, Information Technology, business process owners, and external auditors to maintain an effective, risk-based control environment. The Senior Manager also leads remediation activities, advises on systems and business changes, develops team capabilities, and communicates program status and emerging risks to the Director, SOX.

This is a hybrid role requiring on-site presence 3 days per week.

Key Responsibilities:

• Coordinate the annual SOX 404 program, including internal control risk assessment, planning, PBC audit request coordination and collection, and scheduling of annual walkthroughs and operating-effectiveness testing for financial processes and in-scope IT applications
• Maintain and review the Risk Control Matrix (RCM), process narratives, flowcharts and supporting workpapers to ensure clear linkage among financial reporting risks, controls, and audit evidence
• Lead the execution of walkthroughs and control testing across logical access, change management, computer operations, backup and recovery, system development life cycle activities, automated system controls, configurations, batch jobs, interfaces, and key reports
• Evaluate control deficiencies, determine root causes and potential impact, support severity assessments, and partner with control owners to develop and monitor the status of remediation plans and open deficiencies
• Maintain the inventory of key reports for in-scope applications, including report ownership, control linkage, and testing status
• Advise process owners on SOX governance requirements for new systems, upgrades, and significant process changes, including control ownership, documentation expectations, approval requirements, and post-implementation monitoring
• Develop and deliver training on SOX, internal controls over financial reporting, information technology risk, documentation standards, and control-owner responsibilities
• Lead the SOX workstream for new ERP implementations and newly in-scope business processes, including control redesign, documentation, testing, and readiness assessments
• Perform annual segregation of duties analysis and fraud risk assessment
• Maintain close working relationships with management to obtain a deep understanding of financial, IT and entity level controls
• Provide assistance to internal and external auditors during the SOX audit process, including aligning on testing approaches, coordinating requests, providing supporting documentation, addressing questions, reducing unnecessary duplication of effort, and ensuring the timely completion of audits
• Review the execution and documentation of recurring system-related controls, including quarterly user access reviews, system change reviews, and key report change reviews
• Obtain and evaluate SOC 1 reports for significant service providers, identify applicable complementary user entity controls and assess exceptions and coverage gaps
• Identify opportunities to streamline and strengthen the internal control environment and communicate and monitor resulting recommendations
• Perform special project work and other procedures as necessary
• Develop and maintain technical proficiency and current knowledge of professional standards, including accounting, auditing and financial reporting requirements
• Occasional travel on an ad hoc basis may be required

Required Qualifications and Technical Proficiencies:

• Strong knowledge of internal control frameworks and requirements applicable to internal control over financial reporting, including SOX, PCAOB standards, and risk-based audit practices
• Demonstrated experience with information technology general controls, automated controls, key reports, interfaces, SOC 1 reports, and complementary user entity controls
• Proven ability to evaluate control design and operating effectiveness, assess deficiencies, and guide remediation

…