MICHAEL D. HEINZE

• Co-directed the end-to-end development and delivery of 5 SOC reports (DAI, WAWF, EDA, GFP, DAAS/GEX), strengthening transparency and control assurance over mission-critical financial and logistics environments.
• Co-managed 11-person IT audit team, enhancing testing efficiency and delivering high-quality TOD/TOE evaluations for multiple DLA systems.
• Evaluated 300+ ITGC and application controls across access, SoD, configuration/change management, interfaces, and data integrity, enhancing control coverage and issue identification.
• Implemented standardized testing methodologies and documentation protocols, improving audit quality and consistency while reducing rework and strengthening evidence defensibility under AT-C 320.
• Led technical and QC reviews of walkthroughs and workpapers, ensuring accurate control assessments and clear, risk-aligned reporting to support final SOC conclusions.

• Led a 17-member IT audit team performing ITGC and application control assessments across ~30 Navy financial and logistics systems, strengthening compliance with federal audit and cybersecurity standards.
• Optimized delivery across five workstreams by improving resource allocation and workflow coordination, enabling on time completion of all audit milestones.
• Expanded control coverage and improved testing precision by developing risk-based, system-specific audit programs and standardized FISCAM-aligned walkthrough tools.
• Increased workpaper accuracy and testing consistency by designing QC tools and documentation review protocols adopted across engagement, enhancing overall audit quality.
• Performed high-impact system walkthroughs and technical reviews, identifying control design gaps and ensuring clear, defensible reporting prior to Partner review.
• Optimized delivery across five workstreams through improved resource allocation and workflow coordination, ensuring all audit milestones completed on time.
• Facilitated issue resolution during Reporting Phase, ensuring timely delivery of high-quality Notifications of Findings and Recommendations (NFRs).
• Supported DON’s ERP transition by evaluating data cleaning, conversion, migration, and decommissioning controls to ensure secure and accurate transfer of financial data.

• Directed a $3.7M IT audit portfolio and led a 24-person team to deliver high-quality ITGC and application control assessments across 12 legacy financial and healthcare systems, improving audit coverage and execution efficiency.
• Strengthened federal compliance by evaluating 300+ controls across access, SoD, configuration/change management, interfaces, batch processing, and business process domains, ensuring alignment with FISCAM and cybersecurity standards.
• Ensured accurate, uninterrupted financial reporting by leading data-migration audit procedures—including conversion testing, reconciliation controls, mapping validation, and post-migration assurance—for major system modernization efforts.
• Enhanced audit quality and consistency by establishing standardized methodologies, walkthrough tools, and evidence collection protocols, which reduced rework and increased documentation accuracy across all workstreams.
• Delivered senior-level QC oversight and resolved high-impact NFRs through clear, risk-aligned reporting—contributing to the engagement achieving a 5/5 Contractor Performance Assessment Reporting System (CPARS) rating for three consecutive years.

• Led a 9–11-person compliance team on the USAF’s DEAMS ERP implementation, designing a risk-based internal control environment supporting 22,000 users and enabling accurate enterprise-wide financial reporting.
• Developed and implemented FISCAM, FISMA, and SFIS-aligned internal controls, policies, and procedures—delivering a scalable, audit-ready control framework for a mission-critical financial system.
• Served as sole audit liaison for Air Force’s first external Schedule of Budgetary Authority (SBA) audit, responding to 170+ PBC requests and providing 400+ control artifacts demonstrating DEAMS control operating effectiveness.
• Remediated nine NFRs post-audit, significantly strengthening the control environment and contributing to successful FY16 and FY17 SBA audit completions.
• Authored 30+ internal control policies and procedures, implementing monitoring controls across financial reporting, RMF/security, interface integrity, job scheduling, privileged access, DBA oversight, edit/validation/error-correction, SoD, configuration changes, code modifications, SQL-based updates, and PII protection.
• Developed structured testing, documentation, and monitoring protocols that increased audit readiness and enhanced system governance across DEAMS.
• HYPERLINK "https://www.dote.osd.mil/Portals/97/pub/reports/FY2013/af/2013deams.pdf?ver=2019-08-22-111345-660"

• Delivered internal audit and IT risk advisory services to publicly held clients, strengthened control environments, improved audit readiness, enhanced compliance with industry and regulatory standards.
• Performed ITGC, application, and operational control assessments, provided risk-based recommendations that increased process efficiency and reduced control gaps, drove targeted remediation across multiple client environments.
• Analyzed client operations to identify process improvement opportunities.
• Facilitated workshops to gather stakeholder input and align project goals.
• Developed strategic plans to enhance organizational effectiveness and efficiency.

• Built and led a new Internal Audit function from inception, hiring, developing, and managing a 4-person audit team while reporting directly to the Audit Committee and supporting strategic readiness for a planned public debt offering.
• Designed and implemented the company’s first SOX-compliant internal control environment, enabling successful SOX, PCI, GLB, CFPB, and SSAE 16/SAS 70 compliance across seven subsidiaries, establishing enterprise-wide governance and financial reporting discipline.
• Identified a $5.2M pre-acquisition revenue recognition error that uncovered a $40M acquisition overpayment, prompting executive-level corrective action and significantly improving acquisition due diligence controls.
• Discovered a $1.5M revenue misstatement at a Canadian subsidiary and implemented automated reporting, reconciliation, and monitoring tools to prevent future reporting failures.
• Strengthened expense governance over $30M annual reimbursement program, recovering $160K in erroneous franchise partner payments and establishing systemic controls to prevent recurrence.
• Implemented enhanced cash-management policies that produced $235K in annual savings, improving liquidity visibility and treasury effectiveness.
• Authored a comprehensive accounting position paper comparing ASC 310-30 to the company’s legacy Cost Recovery method for purchased debt portfolios, providing leadership with clear, data-driven guidance that improved revenue recognition accuracy and strengthened financial reporting integrity.
• Directed annual risk assessments and executed multi-year internal audit plans for SOX/ICFR, ITGCs, cybersecurity, financial reporting, operational audits, and regulatory compliance, raising control maturity across the enterprise.
• • Managed and oversaw seven consultants and internal audit staff in delivering ongoing PCI, GLB, CFPB, and SOX audits, consistently improving audit readiness and regulatory compliance posture.
  • Led eight internal process reviews for a $35M internally developed ERP initiative, remediating weaknesses in SDLC governance, requirements management, project controls, documentation standards, and capitalization processes.
  • Served as an executive member of the CFPB Compliance Committee, Bank Audit Readiness Committee, and ERP Decommission Task Force, influencing enterprise wide compliance strategy and risk management decisions.

• Supervised a 22‑person team managing a $4.4M portfolio of SOX implementation and internal audit engagements for public clients including Cricket Wireless, Artesyn Technologies, Peregrine Technologies, Innovo, Peerless, New Frontier Media, eCollege, and Ivanhoe Energy.
• Reduced compliance costs and improved operational efficiency by providing clients with risk‑based internal control guidance and strategic audit leadership.
• Led clients in developing and operationalizing annual risk assessment frameworks, improving risk prioritization and control planning.
• Directed the creation of SOX 404 process documentation, ensuring an effective balance of preventive, detective, manual, and automated key controls to strengthen ICFR while minimizing testing burden.
• Built sustainable SOX 404 compliance programs, including self‑assessment processes that improved audit readiness and reduced reliance on external consultants.
• Integrated internal audit and SOX compliance functions for multiple clients, improving coordination, reducing duplication of effort, and increasing assurance coverage.