Marco Kwan

Associate Partner, Consulting @EY

Toronto, ON, CA

Execution of System and Organization Controls audits (SOC 1 and SOC 2) for a wide variety of Canadian and global service organizations. Experienced with services in various industries, with a heavy focus on managed IT services, application service providers and data centre hosting.• Provided a variety of IT management consulting services related to information systems security, governance, risk management and compliance at numerous clients, such as the development of policies and control matrices against best practices and standards (i.e. NIST, COBIT, ITIL, ISO, PCI, etc.), providing training to internal IT staff to ensure successful implementation of newly designed policies, procedures and controls, management control self-assessments and IT key risk indicator assessments, control gap assessments and remediation efforts against regulatory requirements, advising on vendor risk management and procurement processes and risk assessments over major system implementation and data migration projects.• Design and execution of customized risk-based compliance audits against contractual obligations, industry regulator requirements, service level agreements, software licensing, government regulations and legislation.• Execution of internal and external audits for Sarbanes-Oxley (SOX) and Internal Controls over Financial Reporting (ICFR).• Developed and implemented guidance, work paper templates and staff training materials for EY Canada related to System and Organization Controls audits and IT infrastructure security hardening and configuration assessments.

University of Waterloo

Honours Bachelor of Computer Science