General Internal Control and Audit Advisor

Job Summary Purpose of the Position The General Internal Control and Audit Advisor will provide senior-level, independent advice and assurance to strengthen ASLO’s governance, risk management, accountability, compliance and internal control environment. The post holder will lead the design and continuous improvement of organization-wide control systems; advise the Board, General Director and senior management on major risks; develop risk-based audit and advisory plans; and assess financial, operational, programme, procurement, human resources, logistics, safeguarding and compliance processes. The Advisor will combine strategic internal-control guidance with objective audit assurance. The position must remain independent from day-to-day operational and financial decision-making and will have authorized access to relevant records, systems, premises and personnel, subject to ASLO’s confidentiality, data-protection and safeguarding requirements. Reporting, Independence and Authority • Report functionally to the Board of Trustees or its designated Audit Committee and administratively to the General Director. • Communicate significant or urgent risks directly and confidentially through the approved functional reporting line. • Maintain independence, objectivity and professional scepticism and disclose any actual, potential or perceived conflict of interest before accepting an assignment. • Avoid auditing activities for which the post holder recently held direct operational responsibility. • Obtain unrestricted, timely access to records, staff, assets, systems and project locations required for approved audit work. • Protect confidential information and use audit evidence only for authorized organizational purposes. Key Duties and Responsibilities Internal Control Framework and Strategic Advisory • Design, document and periodically review an organization-wide internal control framework aligned with ASLO’s structure, risks, policies, donor obligations and operational context. • Lead risk and control self-assessments with departments and field offices and maintain a consolidated risk and control matrix. • Advise the Board, General Director and senior management on governance, delegation of authority, segregation of duties, control ownership and risk acceptance. • Review new or revised policies, SOPs, systems and workflows and recommend proportionate preventive, detective and corrective controls before approval. • Develop a prioritized internal-control strengthening roadmap and monitor implementation without assuming management ownership of the controls. • Promote consistent control standards across headquarters, provincial offices, projects and implementing arrangements. Enterprise Risk Management and Audit Planning • Develop and regularly update ASLO’s audit universe and organization-wide risk assessment, including strategic, financial, operational, compliance, safeguarding, fraud, information and reputational risks. • Prepare a risk-based annual internal audit and advisory plan, resource estimate and schedule for approval by the Board/Audit Committee. • Define clear objectives, scope, criteria, methodology, sampling approach and work programmes for each audit or advisory engagement. • Adjust the plan when material changes in funding, programmes, systems, regulations or risk exposure occur. • Identify emerging and cross-cutting risks and provide timely options for senior-management and governance decisions. • Coordinate assignment timing with management while preserving the independence and scope of the internal audit function. Financial, Grant and Donor Compliance • Review accounting records, bank and cash controls, reconciliations, advances, payroll, taxes, supporting documents, budget controls and financial reporting. • Assess the accuracy, completeness, authorization, eligibility, allowability and allocability of project expenditures. • Verify compliance with approved budgets, donor agreements, project documents, ASLO policies, delegation of authority and applicable Afghan laws and regulations. • Evaluate segregation of duties, approval workflows, system access, document retention and controls within financial and management information systems. • Review partner, sub-grantee and field-office financial controls where included in approved assignments. • Advise management on recurring audit, spot-check and donor-compliance findings and on sustainable corrective measures. Operational and Programme Assurance • Review procurement planning, solicitation, bid evaluation, vendor due diligence, contracting, delivery, payment and procurement-file completeness. • Assess value for money, competition, conflicts of interest, sanctions screening, asset management, inventory, fleet, fuel, travel and administrative controls. • Review recruitment, personnel files, contracts, attendance, leave, timesheets, payroll changes, staff benefits, system access and staff-separation processes. • Review whether project activities, outputs and beneficiary records are supported by reliable evidence and aligned with approved project documents, workplans and budgets. • Assess controls over beneficiary selection, distribution, attendance, activity reporting, data quality, complaints and feedback mechanisms, and monitoring records. • Conduct field visits, site observations, document verification and interviews using appropriate sampling and confidentiality safeguards. • Review compliance with safeguarding, PSEA, child protection, data protection, anti-fraud and accountability commitments within the approved audit scope. • Identify systemic operational risks and recommend practical controls that protect programme quality and affected communities. Audit, Special Reviews and Fraud Risk • Lead or conduct approved risk-based internal audits and advisory reviews in accordance with professional standards and ASLO procedures. • Assess fraud and corruption risks and test the design and operation of preventive and detective controls. • Immediately escalate credible indicators of fraud, corruption, diversion, retaliation, safeguarding concerns or serious misconduct through ASLO’s approved confidential reporting mechanisms. • Conduct or support authorized special reviews and investigations only when formally assigned and in accordance with due process, confidentiality and evidence-handling requirements. • Preserve records and maintain clear, complete and secure evidence files and working papers for all authorized reviews. • Do not make final disciplinary, employment or legal determinations; provide evidence-based findings to the authorized decision-makers. Reporting, Follow-Up and Capacity Strengthening • Discuss preliminary findings with responsible managers and verify factual accuracy before finalization. • Prepare clear, concise and evidence-based reports that classify risks, explain root causes and impacts, and propose practical recommendations. • Agree responsible persons and realistic completion dates for management actions while preserving the auditor’s independent assessment. • Maintain a centralized recommendation tracker and validate closure evidence for outstanding actions. • Provide quarterly advice and reporting to the Board/Audit Committee and General Director on high-risk findings, overdue actions, emerging risks and recurring control weaknesses. • Develop practical guidance, tools and targeted training on internal controls, ethics, donor compliance, risk management and audit readiness. • Coach departmental control owners and relevant staff while maintaining clear boundaries between advisory support and management responsibility. Key Deliverables No. Required Deliverable Timing/Frequency 1 Organization-wide internal control framework, risk and control matrix, and improvement roadmap Initial; reviewed annually 2 Risk-based annual internal audit and advisory plan Annually; updated when risks change 3 Engagement terms, audit programme, evidence file, working papers and reports For each assignment 4 Policy, SOP and control-design advisory notes As required 5 Management action and control-improvement tracker Updated monthly and reported quarterly 6 Quarterly governance, risk, compliance and internal control report Quarterly 7 Annual independent opinion on governance, risk management and internal controls Annually 8 Immediate confidential alert on critical fraud, safeguarding, financial or compliance risks As required Job Requirements Required Qualifications and Experience • Bachelor’s degree in accounting, finance, auditing, business administration, economics or another closely related field from a recognized institution; a relevant master’s degree is preferred. • A recognized professional certification or advanced qualification such as CIA, ACCA, CPA, CISA or an equivalent discipline is a strong advantage. • At least seven years of progressively responsible experience in internal control, internal or external audit, compliance, risk management or financial assurance, including at least three years in a senior advisory, supervisory or leadership capacity. • Demonstrated experience with an NGO, UN agency, donor-funded programme or audit firm serving the humanitarian or development sector. • Proven experience designing or strengthening internal-control frameworks, risk and control matrices, audit plans, policies, SOPs and management-action systems. • Demonstrated ability to lead audits or complex reviews covering finance, procurement, payroll, assets, grants, programmes and field operations. • Advanced knowledge of internal controls, enterprise risk management, risk-based auditing, fraud-risk management, audit sampling and professional working-paper standards. • Familiarity with donor compliance requirements and assurance frameworks used by UN agencies and other institutional donors is highly desirable. • Strong strategic advisory, report-writing, analytical, interview, facilitation, training, presentation and executive communication skills. • Proficiency in Microsoft Office, particularly Excel and Word; experience with QuickBooks or other accounting/ERP systems is an advantage. • Fluency in Dari or Pashto and strong working ability in English; ability in both national languages is an advantage. • Willingness and ability to travel to ASLO field offices and project locations, subject to organizational security procedures. Core Competencies • Integrity and ethics: Demonstrates honesty, discretion, impartiality and respect for confidentiality. • Independence and objectivity: Forms conclusions based on verified evidence and resists inappropriate influence. • Strategic advisory: Translates complex risks and control gaps into practical, prioritized advice for governance and senior management. • Analytical judgement: Identifies root causes, evaluates risk and distinguishes isolated errors from systemic weaknesses. • Communication: Presents sensitive findings clearly, respectfully and constructively to different levels of management and governance. • Leadership and capacity building: Guides control owners, facilitates change and strengthens organizational understanding without taking over management responsibilities. • Planning and quality: Leads multiple assignments, meets deadlines and maintains complete, reviewable working papers. • Collaboration: Works effectively with finance, programmes, MEAL, HR, procurement, logistics, IT and field teams while preserving audit independence. • Cultural sensitivity: Works respectfully with diverse teams and communities and applies do-no-harm principles during fieldwork.