Catrinel Iordan

Second line role giving independent oversight and challenge of IT and operational controls across the group.
• Lead independent control reviews of access management, segregation of duties, cyber incident response and IT third-party risk.
• Assess the design and operating effectiveness of first line controls; issue findings and agree remediation plans with management.
• Rate control maturity by map

Project based position (ING Netherlands)

First line of defense risk role embedded in the business, owning the design of risks and controls for AI projects and working with the second line to meet its expectations.
Led the risk and control journey for AI projects through to go-live, cutting handling time from 1 day to 1 hour per case and FTEs from 8 to 2.
Designed Risk & Control Self-Assessments

Second line oversight of IT and cyber risk in a regulated bank.

Led a team of external auditors in gap assessments against ECB and DORA requirements, responding to National Bank and ECB requests.
Reported quarterly to the Board and management on cybersecurity, business continuity, fraud, outsourcing and audit follow-ups.
Acted as risk gatekeeper for new implementations and migrations (cloud o

Ensured timely project go-live by leading a team of Subject Matter Experts (SMEs) to establish compliant IT infrastructure across various domains.
Worked with cross-functional technical teams and business units to ensure adherence to frameworks and standards, while also ensuring a smooth implementation of the technical solution. (Devops, MS Project, Jira)

Managed projects using both Agile and Wat

Internal controls lead for a global pharmaceutical client, focused on financial and fraud risk across regions.
Ran the full Integrated Risk & Control System lifecycle: scoping, risk and control assessment, documentation, QA, testing and assurance reporting to senior management.
Designed and implemented a SOX-light control framework for R2R, S2P and O2C.
Led a team of 10 on the R2R program; updated

Designed and implemented the SOX framework, including SLAs tracked in Archer.
Built and delivered SOX awareness training for all WNS staff.
Reported control effectiveness to internal and external senior management and prepared Audit Committee updates.

Owned the annual SOX program within Internal Audit for two countries, from scoping and planning to conclusions agreed with senior management, covering business, entity-level and IT controls (COBIT).
Led and developed a team of 3: set objectives, ran annual reviews and trained team members to test independently.
Prepared Audit Committee updates and managed the relationship with external auditors.
R

Implemented and tested key controls under SOX 404 across all cycles; joined operational audits and internal investigations.

Year-end and interim audits: planning, materiality and risk assessment, controls testing and substantive testing.

Oct 2026

Jan 2022 · Expired Jan 2024

Jul 2016

Mar 2013