CJChris John

Internal Controls · Risk · SAP Governance · Bengaluru

Chrisoganos Anto M John

Senior Internal Controls, Risk & SAP Governance professional. 14+ years across enterprise internal audit at ABB, Big 4 risk advisory at PwC and EY, and SAP business process delivery for Unilever. I test what actually happens inside the ERP, then work with control owners to fix the control environment, not just document it.

Get in touch LinkedIn profile
40%fewer recurring SoD violations after access governance audits across 500+ roles (ABB)
30%less manual audit effort through analytics and continuous controls monitoring (ABB)
50+control deficiencies identified and remediated across 15+ enterprise applications (PwC)
20+SOX 404 engagements executed across manufacturing, chemicals and FMCG (EY)
01Profile

Controls assurance built on how SAP actually works

I assess the design and operating effectiveness of financial, operational and IT controls under SOX 404, ICFR and ITGC, using COSO and COBIT. What sets my work apart is depth in SAP S/4HANA and SAP GRC (Access Control and Process Control): I read the posting tables, change documents and role tables directly instead of relying on control narratives.

My path ran from operational process and master data quality, through SAP process delivery for Unilever, into Big 4 technology risk at EY and PwC, and then enterprise internal audit at ABB. I have worked on engagements in 10+ countries across Asia, Europe, the Middle East, Africa and Latin America, with on-site delivery in Bangladesh, the UAE and Egypt.

I approach AI-enabled assurance as a governance discipline, grounded in ISO/IEC 42001 and the NIST AI RMF: human accountability, independent validation, explainability and evidence that stands up to audit challenge.

02Expertise

Areas of practice

ICFR-01

Internal Controls & SOX

Control design and operating effectiveness, risk and control matrices, tests of design and operating effectiveness, deficiency evaluation and second-line assurance.

SOX 404ICFRCOSORCM
AC-02

SAP GRC & Segregation of Duties

Access governance, role design, privileged and critical access, and mitigating controls where conflicts cannot be removed. GRC Process Control monitoring rules.

GRC ACGRC PCSoDFirefighter
ITGC-03

ITGC & Application Controls

Access management, change management and privileged access testing, plus automated controls across Order-to-Cash, Procure-to-Pay and Record-to-Report.

ITGCITACCOBITO2C · P2P · R2R
PRC-04

Process Standardisation & Remediation

Simplifying and rationalising controls across business units, root-cause analysis, and corrective actions followed through to closure.

Root causeRemediationOptimisation
CCM-05

Data Analytics & Continuous Monitoring

Automated exception identification, journal entry anomaly review, vendor master and bank detail change monitoring, and access and SoD analytics.

Power BITableauAlteryxExcel
AIG-06

AI Governance

AI management systems and AI-enabled assurance: accountability, validation of AI-assisted output, explainability, privacy and data protection.

ISO/IEC 42001NIST AI RMF
03Experience

Career path

  1. Sep 2026 – present

    Senior Manager, Internal Audit & Financial Advisory

    Leading client engagements in ITGC scoping, SAP application controls testing, GRC segregation of duties reviews, SAP security reviews and SAP licence optimisation, and supervising engagement teams.

  2. Jun 2024 – Jun 2026

    Senior Auditor, Global Internal Audit

    ABB

    Risk-based audit and controls engagements across Finance, Procurement, Operations and Technology in a global matrix organisation. Reduced recurring SoD violations by 40% across 500+ roles, cut manual audit effort by 30% with analytics and continuous monitoring, and reported risk themes and remediation status to senior management across SOX 404, ITGC/ITAC and GDPR.

  3. Dec 2020 – Jun 2024

    Manager, Digital Risk Solutions

    PwC

    Led cross-functional teams on concurrent SOX and enterprise risk programmes for Fortune 500 clients. Delivered 3+ consecutive years of quarterly SOX 404 cycles with zero schedule overruns, remediated 50+ deficiencies across 15+ applications, advised on controls for digital transformation, and trained process and control owners.

  4. Apr 2019 – Dec 2020

    Senior Risk Advisor, Internal Audit & Enterprise Risk

    EY

    Executed 20+ SOX 404 engagements across manufacturing, chemicals and FMCG. Designed future-state control frameworks across S/4HANA transformations, including PPG Industries, and closed automated control findings across 8+ business cycles and 100+ custom objects.

  5. Jul 2014 – Mar 2019

    Consultant, Business Process & Procurement Systems

    Incture Technologies · client: Unilever

    Led process and system delivery across 10+ countries for Unilever's Global Material Master Data transformation, covering supplier lifecycle, supplier risk, sourcing and contracts.

  6. 2007 – 2014

    Earlier career

    RGBSI (deputed to General Motors) · Aditya Birla Minacs

    Master data quality and controls at General Motors, and operational process and vendor management across 800+ components and 120+ vendors.

04Case study

A monitoring control that reported green but wasn't working

FINDING

The control

An SAP GRC Process Control rule monitoring unauthorised posting-period changes was reporting as operating successfully.

TEST

The check

Validating the configuration showed a broken selection variant, so the rule was not actually picking up changes.

EXCEPTIONS

The impact

Exception analysis found 14 posting-period changes made outside the approved change calendar.

REMEDIATION

The fix

The rule was strengthened, variant governance improved, and periodic GRC configuration-health reviews were set up.

05SAP depth

Testing at the data level

Platforms: SAP S/4HANA and ECC, GRC Access Control, GRC Process Control, Security & Authorisations, SAP Ariba. Modules: FI/CO, MM, SD.

Financial postingsACDOCABKPFBSEG
Change documentsCDHDRCDPOS
Vendor master & bankLFA1LFBK
Roles & accessAGR_USERSAGR_1251AGR_TCODESUSR02
06Credentials

Certifications & education

ISO/IEC 42001:2023 Lead Implementer

AI Management Systems · BSI Training Academy · June 2026

Passed

Certified Internal Auditor (CIA)

The Institute of Internal Auditors

Pursuing

NIST AI Risk Management Framework

Introduction course · IIA India · April 2025 · 2 CPE

Completed

SAP Certified Application Associate

S/4HANA Financial Accounting · S/4HANA Sourcing & Procurement · S/4HANA Sales · SAP Ariba Procurement

Certified

SAP Certified Associate

SAP Activate Project Manager

Certified

MBA

City Engineering College, VTU · 2009 – 2011

B.E. Mechanical Engineering

Ballari Institute of Technology and Management, VTU · 2003 – 2007

Industries

Manufacturing · Chemicals · Consumer Goods (FMCG) · Automotive · Shared Services and Global Capability Centres

Languages

English (professional) · Hindi · Telugu · Tamil · Kannada

07Writing & teaching

Sharing what I learn

Daily on LinkedIn

A daily series on SAP controls, segregation of duties, ITGC, SOX and AI governance, often with short process-flow animations that mark where each control sits.

SAP Audit with Chris

Short videos explaining SAP audit concepts in plain terms. I have designed and delivered controls training for process and control owners, and I am building this into corporate training on SAP audit.

Training topics

  • Auditing SAP access and SoD with GRC
  • Testing SAP automated controls
  • Data-level audit testing in S/4HANA
  • Getting started with ISO/IEC 42001

Author

Outside audit I write and self-publish illustrated books on faith, theology and spirituality under the name Chrisoganos Anto M John.

08Contact

Let's talk about your controls

For internal controls and audit leadership roles, SAP controls engagements, AI governance work or training, reach out directly.

Connect on LinkedIn Email me
Location: Bengaluru, Karnataka, India