Sushen Verma

Sushen Verma, a Chartered Accountant (CA) with a Master's degree in Commerce, cleared CISA examination, CS Final qualification, and CSOE (SOXCPA). With nearly two years of post-qualification experience in IT Audit at EY, he has developed strong skills in Information Systems Auditing, Risk Assessment, SOC 1 & SOC 2 compliance reporting, Internal Controls evaluation, and stakeholder coordination.

IT Audit - Analyst at Ernst & Young (EY) (2024-11 – 2026-07)

EY, global leader in assurance and advisory, empowering businesses with technology solutions and digital resilience.

• End-to-end SOC delivery: Executed SOC 1 and SOC 2 (Type I/II) examinations for service organizations across Cybersecurity, FinTech, InsurTech, Healthcare/Life Sciences, AI/SaaS, IoT/Industrial, Data & Analytics, Agriculture, ERP, Software Testing, and Computer Vision/AR, covering the full audit lifecycle.
• Team leadership: Coordinated team members and junior staff by assigning tasks, sharing clear instructions, and tracking status to keep concurrent engagements on schedule. Escalated client concerns to leadership early so issues were resolved before they affected timelines and ensures sufficiency of evidence, and adherence to audit methodology.
• Planning & scoping: Prepared planning documentation, independence checks, PACE (Process for Acceptance of Clients and Engagements) records, and audit plans involving assessment of mapped client controls to SOC 1 control objectives and SOC 2 Trust Services Criteria.
• System description & subservice organizations: Reviewed system descriptions and identified Complementary User Entity Controls (CUECs) and Complementary Subservice Organization Controls (CSOCs) for carved-out and inclusive subservice organizations.
• Control testing: Conducted walkthroughs with process owners (CISO teams, DevOps, HR, Engineering) and performed Test of Design (ToD) and Test of Operating Effectiveness (ToE) against Security, Availability, Confidentiality, Processing Integrity, and Privacy criteria, using risk-based sampling and detailed evidence analysis.
• Performed SOC aligned testing involving logical access management (Okta/Azure AD, privileged access, user access reviews, timely offboarding), change management (CI/CD pipelines, Jira approvals, code reviews in GitHub/GitLab, emergency changes), and system operations (backup and restoration, DR/BCP, vulnerability management, penetration-test remediation, SIEM monitoring, and incident response).
• SOC 1 involving ICFR Testing: Evaluated business and application controls relevant to financial reporting for FinTech/InsurTech and ERP clients (transaction processing, reconciliations, calculations, claims and policy administration, reporting interfaces) to ensure accuracy, completeness, and integrity of the information.
• Sector-specific risk coverage: Tailored testing to each client's risk profile: PHI protection, confidentiality, and privacy (Healthcare/Life Sciences); data and model governance and processing integrity (AI/SaaS, Data & Analytics, Computer Vision/AR); device provisioning, firmware updates, and data transmission (IoT/Industrial, Agriculture); security operations (Cybersecurity); and test-environment and release controls (Software Testing).
• Exceptions & reporting: Documented and classified control exceptions, performed root-cause analysis, evaluated compensating controls, and prepared workpapers, control matrices, test sheets, and Section 4 (Description of Tests of Controls and Results) for the Independent Service Auditor's Report.
• Tools & platforms: Worked with compliance automation and GRC platforms (Drata, Vanta, Scytale, OneTrust, Anecdotes, AuditBoard) and EY Canvas for evidence collection, Collab, testing, and audit documentation.
• IT General Controls (ITGC): Performed design and operating effectiveness testing of IT General Controls (ITGC) across key areas. In access management tested user provisioning and removal, privileged access, periodic access reviews, and segregation of duties. In change management sampled tickets to confirm approvals, reviews and separation between development and production environments. In IT operations assessed backup and recovery, job scheduling, and incident management. Also validated system generated reports (IPE) used as audit evidence, documented control gaps with root cause and recommendations, and tracked remediation to closure with control owners.
• IT Application Controls (ITAC): Tested application controls in key applications, including SAP, across Procure-to-Pay (P2P), Order-to-Cash (O2C), and Record-to-Report (R2R) processes, evaluating automated calculations, input data validation, configuration settings, and interface controls.
• System Migration Testing: Performed system migration testing by validating data accuracy and completeness, analyzing supporting evidence, identifying discrepancies, and documenting test procedures and results to assess migration controls and data integrity.

IT Audit - Assistant Manager at Ernst & Young (EY) (2026-08 – Present)

Article Assistant at Mini Garg & Associates (2017-02 – 2020-02)

A renowned Gwalior based firm with over 150 clients, delivering a comprehensive suite of services

Audit Assistant at Mini Garg & Associates (2021-01 – 2024-08)

• Led financial, taxation and internal audits across banking, telecom, and retail sectors involving of testing IT controls (BCP/DRP), SAP inventory systems, and core business processes (P2P, O2C, R2R).
• Executed taxation, financial reporting, and regulatory compliance, finalizing audited financial statements, handling filings, drafting dispute responses, managing corporate ROC filings, and preparing credit modeling reports.

CA Final (2024-05)

CA IPCC (2018-05)

CA CPT (2015-06)

M. Com in International Business Operations (IBO) – IGNOU (2022-12)

CS Final (2019-12)

B. Com – Jiwaji University (2018-06)

Class XII in Commerce – CBSE (2014-04)

Class X – CBSE (2012-04)