Mohamed Ayoub DAGHARI

*** Industry: Automotive & Financial Services (France),Technology & Innovation (Netherland, USA), Retail (France), Legal (China) Governance, Strategy & Senior Stakeholder Advisory, GRC Implementation • Defined IT audit strategies and governance approaches, conducting brainstorming sessions with decision-makers, COMEX members, VP and C-level executives. • Advised VP Audit, CIO, CISO, CRO, CAE, PMO and business leadership on Governance, Risk & Compliance (GRC), enterprise risk governance, AML/CFT and digital transformation initiatives. • Provided risk-based recommendations aligned with business, operational, technology and regulatory objectives. • Coordinated with shareholders and entities across APAC, EMEA and LATAM to communicate findings, recommendations and remediation priorities. • Provided recommendations for the implementation of internal IT control frameworks (LOD1/LOD2) across credit, leasing, retail, insurance and deposit activities. • Conducted quality reviews of ITGC and ITAC audits, trained and mentored auditors, and participated in IT auditor/consultants recruitment. • Supported organizations in integrating regulatory, cybersecurity, risk management, and governance requirements throughout IT and digital transformation lifecycles. • Followed up on ECB (European Central Bank) recommendations and remediation action plans, including validation of IT teams' deliverables. • Reviewed and evaluated GRC tools implementation used to support SOC 2 compliance, including evidence collection, control monitoring, and report preparation. IT Audit, Risk & Internal Controls, ISAE 3000 (SOC 2 type II reports) • Led and supported IT audit engagements covering ITGC, ITAC, IT project management/governance, operational resilience and regulatory compliance. • Conducted risk assessments to identify key risks, define audit scope and develop audit strategies. • Assessed the effectiveness of control environments across LOD1 and LOD2, identifying control deficiencies and defining remediation recommendations. • Assessed Business Continuity Plans (BCP), Disaster Recovery Plans (DRP), backup strategies, recovery solutions, RTO/RPO objectives, and operational feasibility. • Conducted Business Impact Analysis (BIA) using CIAP criteria - Confidentiality, Integrity, Availability and Proof — to identify critical processes, dependencies, and business impacts. • Assessed companies’ readiness for SOC 2 compliance, identifying control gaps and supporting the preparation and drafting of SOC 2 reports. Cybersecurity, Regulatory Compliance & AI • Conducted cybersecurity and security control assessments covering application security, cloud security, access controls and security architecture. • Contributed to secure architecture initiatives based on Privacy by Design and Security by Default principles. • Led and supported initiatives related to EU AI Act compliance and digital transformation, integrating governance, cybersecurity, risk and regulatory requirements. • Worked across DORA, NIS2, AI Act, GDPR, CRA, BCBS239, MiFID, AML/CFT and LCB-FT requirements. Digital Transformation & Data Analytics • Supported PMOs, Product Owners and project teams in integrating cybersecurity, risk management and compliance requirements into IT and digital transformation initiatives. • Reviewed IT/data migration projects and developed dashboards for CIO/CRO stakeholders to monitor project progress, risk exposure and remediation. • Supported transformation initiatives by coordinating business, IT, risk, compliance and security stakeholders. Third-Party Risk Management, External Audit & Investigations, reviewing External Firms Proposals • Conducted TPRM risk assessments and reviewed third-party contracts and SLAs. • Coordinated and supervised cybersecurity and IT audits performed by EY, Deloitte, and Orange Cyberdefense, including Office 365, DORA/NIS2, SWIFT and TPRM engagements. • Reviewed and validated external firms' proposals, contracts and deliverables (PWC, Deloitte, EY). • Conducted internal/external investigations involving third parties, including forensics, chain of custody and contractual requirements.

– Technical Reference / Lead responsible for developing IT audit guidelines and methodology under the supervision of the Group Internal Audit Director (BRRD, GDPR, DORA, NIS2, BCBS239, ISA315, NEP, MiFID II). – Mentored IT auditors to enhance audit quality and efficiency. – Evaluated IT controls implemented across the group and its entities (Level 1 and Level 2). – Prepared KPIs to visualize data quality issues and track measures related to the Corporate Information & Data Control (CIDC).

– Leading audits on critical/strategic ICT third parties (including the particiption in preparing the strategy) – Implementation of DORA requirements (Pillar 1, Pillar 4) and coordinating with teams in charge of implementing the requirements of Pillar 2 and Pillar 3. – Participating in the creation of a risk management framework (group standard) – Lead projects in relation to IT Internal Audit (IT general controls, IT applicative and security controls, analyzing security reports (SOC 1, SOC 2, SOC 3, SOA-ISO27001, pentest reports, web platform scanning reports...). – Training IT auditors and IT risk assessors.

– Leading Statutory Audit projects/missions ISA - PCAOB (France - USA) – Conducting SOX (USA) and J-SOX (Japan) audits projects – Conducting IT Migration Review Projects – Drafting SOC reports (SOC 1, SOC 2 type II) – Training/supervision of IT auditors/consultants

– Statutory Audit : – Audited IT environments (applications, databases, operating systems, Active Directory, etc.) as part of statutory audit engagements. Gained a comprehensive understanding of IT environments, processes, and identified associated risks and controls; reviewed SOC reports. – Executed IT audits, including IT General Controls (ITGC) and IT Application Controls (ITAC), covering processes such as changes, user access, IT operations, and application configurations. – Prepared audit reports including observations, executive summaries, and actionable recommendations. – Audited business processes (Procurement, Payroll, Sales, Inventory...). – Performed detailed financial data analysis (revenue, KPIs, etc.). – Consulting - ISO 27001, ISO 27005, RPA & Data Analytics, Innovation – Participate in the Implementation of an ISMS (Information Security Management System) with KPIs in compliance with ISO 27001. – Internal project - Developed a risk management program according to ISO 27005. – Reviewed policies and procedures following ISO 27001 standards (Information Security Policies, BCP, DRP...) – RPA & Data Analytics – Participated in data analytics transformation projects including data cleaning, modeling, and visualization using Power BI and Excel VBA validated as part of a Master's program. – Innovation – Conducted research on IT-oriented technological topics & * Prepared reports for research tax credit purposes (Crédit Impôt Recherche).

– Implemented an Organizational and Social Compliance Program, including policies ensuring smooth business operations in accordance with ISO 19600, with alignment to IT governance and data management practices. – Conducted compliance audits (GDPR, personal data protection for legal, tax, and social purposes), including data classification and IT-related data protection measures to ensure conformity with labor code requirements. – Provided advisory & coaching on payroll management, accounting, social audits (social balance sheets), and HR best practices, integrating IT controls and ISO 27001 compliance where relevant.

– Conducted compliance audits (GDPR, legal, tax, and social personal data protection) to ensure alignment with labor code requirements. – Developed HR dashboards to monitor employee activities and flows, including absenteeism and remuneration. – Classified data (sensitive data, personal data) to ensure proper handling and compliance.

– Proficient in ODOO 10 Community for HR and Accounting modules. – Acted as Business Analyst (MOA): supported the development of Accounting HR & Payroll ODOO modules by drafting functional requirements and collaborating with developers. – Perform testing and evaluated IT Application Controls (ITAC) (Web and ERP modules) – Managed payroll processes, including preparation of statutory tax and social declarations (CNSS, RS, Finance Authority, Employment Office). – Reviewed and verified financial and payroll statements prepared by the Accounting and Finance departments. – Implemented data confidentiality and integrity controls to ensure compliance with personal data protection regulations. – Prepared HR budgets, managed payroll and conflict resolution, ensuring legal and regulatory compliance. – Handled invoicing and cross-border coordination with teams in France and Saudi Arabia.

– Assisted in planning and executing financial audits for companies in the transport and tourism sectors, ensuring compliance with accounting standards and regulatory requirements. – Audited information systems and supported the assessment of internal controls, identified risks, and verified the accuracy of financial statements. – Prepared audit documentation, workpapers, and draft reports under the supervision of senior auditors. – Collaborated with audit teams to analyze financial data and contributed to actionable recommendations for process improvements. – Proficient in Sage ERP/Accounting solutions for financial reporting and data analysis.