ISO Lead Auditor Manager

Role Purpose & Context

Role Summary

The ISO Lead Auditor Manager directs our entire compliance strategy for a bunch of different ISO standards, like 9001, 14001, and 45001. Day-to-day, you'll be making sure our audit programme actually works, that we're ready for external audits, and that our team is top-notch. You'll sit right at the heart of our operations and executive leadership, translating complex regulatory stuff into practical, actionable plans for the business. When you do this job well, we sail through external audits, avoid costly fines, and, more importantly, we genuinely improve our quality, environmental impact, and safety culture. If it's not done well, we risk losing certifications, facing regulatory penalties, and seriously damaging our reputation – not to mention putting our people and planet at risk. The big challenge here is getting everyone on board, from the shop floor to the boardroom, and making sure compliance isn't just seen as a burden. The reward? You'll build a compliance system that actually protects the business and helps us grow responsibly, knowing your work really makes a difference.

Reporting Structure

• Reports to: Director of Quality & Compliance
• Direct reports: Roughly 10-25 people, including some team leads or junior managers.
• Matrix relationships: Principal Compliance Manager, Head of Audit & Compliance, Quality & EHS Manager, Senior Compliance Programme Lead,

Key Stakeholders

Internal:

• Director of Quality & Compliance
• Heads of Operations, Production, and Supply Chain
• Executive Leadership Team (ELT)
• Legal and Risk Management teams
• Internal Audit Committee

External:

• External Certification Bodies (e.g., BSI, SGS)
• Regulatory Agencies (e.g., HSE, Environment Agency)
• Key Customers (for compliance assurance)
• Industry Associations and Standards Bodies

Organisational Impact

Scope: This role directly shapes our organisational strategy and capability in compliance, quality, health, and safety. You're not just finding problems; you're building the systems and the culture that prevent them. Your decisions here directly impact our operational efficiency, market reputation, and our ability to win new business, especially with clients who demand stringent compliance.

Performance Metrics

Quantitative Metrics

1. Metric: External Audit Major NC Reduction
2. Desc: The number of Major Non-conformances raised by external certification bodies during surveillance or recertification audits.
3. Target: Achieve a 25% year-over-year reduction in Major Non-conformances.
4. Freq: Annually, following each external audit cycle.
5. Example: If we had 4 Major NCs last year, we'd aim for 3 or fewer this year. This shows our systems are getting genuinely better, not just patched up.
6. Metric: Cost of Non-Quality (CONQ) Attribution
7. Desc: Demonstrable reduction in financial losses (e.g., scrap, rework, warranty claims, regulatory fines) directly linked to improvements driven by the audit programme.
8. Target: Demonstrate a 10% reduction in CONQ attributable to audit programme improvements.
9. Freq: Quarterly, reviewed with Finance and Operations teams.
10. Example: After a deep dive into our returns process, your team's audit findings led to a new inspection stage, reducing customer returns by £150K in Q4 – that's a direct win.
11. Metric: Certification Success Rate
12. Desc: The percentage of all scheduled recertification and surveillance audits that result in a first-time pass without any major issues or delays.
13. Target: Maintain a 100% first-time pass rate for all certifications across the enterprise.
14. Freq: Annually/Bi-annually, as per certification schedules.
15. Example: Successfully renewing our ISO 9001, 14001, and 45001 certifications across all sites on the first attempt, every time. No last-minute scrambles.
16. Metric: Audit Programme Budget Adherence
17. Desc: Managing the allocated budget for the entire internal and external audit programme, including team resources, training, and external consultant fees.
18. Target: Keep the audit programme budget within 5% of the approved annual plan.
19. Freq: Monthly, with a formal quarterly review with the Director.
20. Example: If your annual budget is £750K, you'd aim to spend between £712.5K and £787.5K, showing good financial stewardship of a significant cost centre.

Qualitative Metrics

1. Metric: Regulatory Agency Relationship & Engagement
2. Desc: How well we manage our relationships with key regulatory bodies, ensuring proactive communication and a reputation for transparency.
3. Evidence: Invited to participate in industry working groups; no unexpected visits or penalties; positive feedback from regulators on our proactive disclosures; smooth handling of any minor incidents.
4. Metric: Executive Confidence & Strategic Influence
5. Desc: The level of trust and reliance the executive team places in your advice and the audit programme's insights for strategic decision-making.
6. Evidence: Regular invitations to ELT strategy meetings; opinions sought on major business changes (e.g., new product launches, M&A); executive sponsorship for compliance initiatives; audit findings directly informing board-level risk discussions.
7. Metric: Team Development & Retention
8. Desc: The effectiveness of your leadership in developing your team's skills, fostering a positive work environment, and retaining key talent.
9. Evidence: Low voluntary turnover rate within your team (below 10%); successful internal promotions; positive feedback in 1-on-1s and annual reviews about growth opportunities; team members actively mentoring others.
10. Metric: Effectiveness of CAPA System
11. Desc: The overall health and efficiency of our Corrective and Preventive Action system, ensuring issues are truly resolved and don't recur.
12. Evidence: Reduction in repeat non-conformances; high closure rate of CAPAs within agreed timelines; evidence of thorough root cause analysis (not just 'human error'); positive feedback from auditees on the CAPA process fairness and effectiveness.

Primary Traits

• Trait: Strategic Scepticism
• Manifestation: You don't just ask 'show me the evidence'; you ask 'show me how this process links to our overall risk strategy.' You're looking for the systemic gaps, not just individual slips. You'll challenge assumptions from senior leaders, politely but firmly, if the data or the standard doesn't back them up. This isn't about nit-picking; it's about protecting the business at a higher level.
• Benefit: At this level, we're dealing with enterprise-wide risks. A lack of strategic scepticism can lead to overlooking critical vulnerabilities that could cost us millions in fines or reputational damage. We need someone who can see beyond the immediate task and question the fundamental design of our management systems.
• Trait: Influential Tenacity
• Manifestation: You can stand your ground in a room full of executives, explaining why a Major Non-conformance isn't negotiable, even when they're pushing back hard. You'll keep nudging, coaching, and sometimes gently pushing other department heads to close out critical CAPAs, not just because it's a rule, but because you genuinely believe it's for the good of the business. You're persistent without being a pain.
• Benefit: Managing compliance programmes means dealing with competing priorities and sometimes resistance from busy operational teams. If you can't influence and persuade, critical issues will fester, and our certifications will be at risk. You need to be able to get people to do the right thing, even when it's inconvenient.
• Trait: System Architect Mentality
• Manifestation: You're not just auditing a process; you're thinking about how all our processes fit together to form a cohesive management system. You'll spot that a recurring issue in production actually stems from a weakness in the purchasing process. You're constantly looking for ways to streamline, simplify, and strengthen the entire compliance framework, not just fix individual parts. You'll design the audit programme itself.
• Benefit: Our business is complex, and individual audits are just snapshots. We need someone who can design and oversee an audit programme that systematically addresses risks across the entire organisation. Without this, we're just playing whack-a-mole with problems instead of building a truly resilient system.

Supporting Traits

• Trait: Inquisitive Leadership
• Desc: You'll foster a culture of curiosity within your team, encouraging them to dig deeper than the surface. You're genuinely interested in understanding the 'why' behind failures and successes, and you'll model that behaviour for your direct reports.
• Trait: Articulate Persuader
• Desc: The ability to present complex audit findings and strategic recommendations clearly and concisely to diverse audiences, from your team to the Board. You can adapt your message to resonate with different levels of understanding and influence decisions.
• Trait: Calm Under Boardroom Pressure
• Desc: Maintaining composure and professionalism when presenting challenging audit findings or compliance risks to the executive leadership team or even the Board. You can handle tough questions and defend your team's work without getting flustered.
• Trait: Unwavering Ethical Compass
• Desc: You'll be the ethical backbone of the compliance function. This means making tough calls, even when it's unpopular, and ensuring your team always operates with the highest integrity, especially when faced with pressure to compromise.

Primary Motivators

1. Motivator: Building Resilient Systems
2. Daily: You'll get a real kick out of designing and implementing new audit methodologies or CAPA processes that genuinely prevent future issues, rather than just reacting to them. You're always looking for ways to make our compliance framework stronger and more efficient.
3. Motivator: Strategic Organisational Impact
4. Daily: You're driven by seeing your team's work directly influence executive decisions and contribute to the company's long-term success and reputation. You want to be at the table where big decisions are made, advising on the compliance implications.
5. Motivator: Developing and Leading Talent
6. Daily: You love coaching and mentoring your team, helping them grow their skills and take on bigger challenges. Seeing your direct reports succeed and develop into strong auditors or compliance professionals is a major source of satisfaction.

Potential Demotivators

Honestly, this job isn't always glamorous. You'll spend a fair bit of time dealing with bureaucratic inertia – getting sign-offs can feel like wading through treacle. You'll also face political resistance when trying to implement changes that might disrupt established ways of working, even if they're for the best. Sometimes, you'll feel like you're constantly pushing water uphill, especially when budget constraints mean you can't implement every 'best practice' idea you have. If you need constant, immediate gratification for every initiative, you might find the pace of change frustrating here.

Common Frustrations

1. Dealing with other department heads who see compliance as 'your problem' rather than a shared responsibility.
2. The slow pace of change in a larger organisation, especially when you know there's a better way to do things.
3. Budget limitations that prevent you from investing in the latest tools or training for your team.
4. Managing underperforming team members and having difficult performance conversations.
5. The 'audit fatigue' from operational teams who feel constantly scrutinised, even when you're trying to help them.

What Role Doesn't Offer

1. A purely technical, individual contributor role – you're managing people and strategy now.
2. A 'set it and forget it' environment – compliance is constantly evolving, and so will your approach.
3. A role where you can avoid difficult conversations or political challenges; they're part of the job.
4. The ability to completely avoid administrative tasks and reporting; it's still a core part of managing a function.

ADHD Positives

1. The strategic oversight and constant problem-solving aspects can be really engaging, offering varied challenges that prevent boredom.
2. Leading a team means you can delegate routine tasks, freeing you up for higher-level, stimulating work.
3. The need for quick, decisive action in crisis management (e.g., during a major incident or regulatory visit) can be a strength.

ADHD Challenges and Accommodations

1. The extensive documentation and reporting requirements can be challenging; using AI tools for first drafts or having administrative support can help.
2. Maintaining focus during long, detailed policy reviews or strategic planning sessions might require structured breaks or visual aids.
3. Managing a large team and numerous concurrent projects requires strong organisational systems; using project management software and delegating effectively is key.

Dyslexia Positives

1. Strong conceptual thinking and the ability to see the 'big picture' of compliance systems are highly valued here.
2. Excellent verbal communication skills for influencing stakeholders and leading meetings are often a strength.
3. Problem-solving complex, systemic issues through non-linear thinking can be a significant advantage.

Dyslexia Challenges and Accommodations

1. The heavy reliance on written reports, policy documents, and detailed audit findings can be demanding; using dictation software, proofreading tools, or having a trusted editor can be helpful.
2. Reading and interpreting dense regulatory text might require extra time or tools that summarise key points.
3. Ensuring accuracy in numerical data within reports is critical; double-checking with spreadsheets or automated checks is a must.

Autism Positives

1. A deep, systematic understanding of ISO standards and regulatory frameworks is a huge asset in this role.
2. The ability to identify patterns and logical inconsistencies in processes is crucial for effective auditing and system design.
3. A strong commitment to accuracy and adherence to established procedures is highly valued in compliance.

Autism Challenges and Accommodations

1. Navigating complex organisational politics and unspoken social cues in executive meetings can be draining; clear communication from colleagues and explicit expectations are helpful.
2. Managing a large, diverse team requires significant social interaction and emotional labour; structured 1-on-1s and clear communication channels can support this.
3. Unexpected changes to audit plans or strategic priorities can be challenging; advance notice and clear rationale for changes are beneficial.

Key Responsibilities

Experience Levels Responsibilities

1. Level: Principal Auditor / Compliance Manager (L5)
2. Responsibilities: Set the vision and overarching strategy for our entire Compliance, Quality, Health, and Safety audit programme, making sure it aligns with our business goals and top-level risks.
3. Build and develop the organisational capability of the audit function, which means hiring, training, and mentoring a team of auditors and audit managers, ensuring we've got the right skills.
4. Lead the transformation of our compliance management systems, moving us from merely reactive auditing to a proactive, risk-based approach that actually prevents issues.
5. Own the P&L for the Compliance & Audit department, managing a budget typically between £500K and £2M, making smart decisions about resources, tools, and external support.
6. Act as the primary point of contact and manage critical relationships with all our external certification bodies and, when needed, directly engage with regulatory agencies.
7. Present our compliance posture, key risks, and audit programme performance directly to the Executive Leadership Team and the Board Audit Committee on a regular basis, defending findings and recommendations.
8. Design and implement robust internal controls and governance frameworks across the organisation, making sure we're not just compliant, but genuinely resilient against future risks.
9. Supervision: You're largely self-directed, working to quarterly objectives that you've helped define. Your Director will be there for strategic alignment and support, but you'll own the 'how' and much of the 'what' for your function. You'll provide strategic guidance and oversight to your direct reports, who may include other managers.
10. Decision: You'll have full authority over your department's operations, including budget allocation up to £500K, all hiring and firing decisions within your team, and vendor selection for audit tools or external consultants up to £100K. Decisions impacting overall company strategy or P&L above £2M will require alignment with the Director and potentially the ELT.
11. Success: Success looks like a compliance function that is seen as a business enabler, not a blocker. We'll have a highly competent and engaged audit team, consistently positive external audit outcomes, and a demonstrable reduction in our overall compliance risk profile. You'll have built a system that works, and everyone will know it.

Decision-Making Authority

• Type: Audit Programme Design & Scope
• Entry: No involvement beyond executing assigned tasks.
• Mid: Proposes minor adjustments to specific audit scopes or methodologies within a project.
• Senior: Designs and leads the scope for complex internal audits, making recommendations for overall programme changes.
• Type: Budget Allocation (Departmental)
• Entry: No budget authority. Reports expenses to supervisor.
• Mid: Manages small project budgets (e.g., £1K-£5K) with manager approval.
• Senior: Recommends budget for specific workstreams up to £25K, subject to Director approval.
• Type: Team Hiring & Performance
• Entry: No involvement.
• Mid: Participates in interviews for junior roles, provides feedback.
• Senior: Leads interviews for L1/L2 roles, provides input on performance reviews for mentees.
• Type: Regulatory Engagement Strategy
• Entry: No direct engagement. May provide requested data.
• Mid: Responds to specific data requests from regulatory bodies under supervision.
• Senior: Acts as a point of contact for routine regulatory inquiries, drafting responses for review.

Competency Requirements

Foundation Skills (Transferable)

At this level, we expect you to have a rock-solid foundation in the basics, but more importantly, the ability to apply and teach these skills at a strategic level. It's not just about knowing them; it's about leading with them.

• Category: Strategic Communication & Influence
• Skills: Executive Presentation Skills: Delivering clear, concise, and persuasive presentations to the Board and ELT, defending audit findings and strategic recommendations under pressure.
• Negotiation & Conflict Resolution: Mediating disagreements between departments regarding audit findings or CAPA implementation, achieving consensus on difficult issues.
• Cross-Functional Leadership: Guiding and influencing teams across different departments (e.g., Operations, HR, Legal) to adopt and embed compliance best practices.
• Category: Organisational Leadership & Development
• Skills: Team Building & Mentorship: Recruiting, developing, and retaining a high-performing audit team, including coaching managers and senior auditors.
• Change Management: Leading and embedding significant changes to compliance processes or management systems across the organisation, overcoming resistance.
• Performance Management: Setting clear expectations, providing constructive feedback, and managing performance within your team to ensure high standards.
• Category: Strategic Problem-Solving & Risk Judgement
• Skills: Systemic Root Cause Analysis: Overseeing and validating complex root cause analyses for major non-conformances, ensuring effective preventive actions.
• Strategic Risk Assessment: Identifying, evaluating, and prioritising compliance risks at an enterprise level, informing the overall audit programme design.
• Decision Making Under Ambiguity: Making sound compliance decisions when information is incomplete or conflicting, with significant business implications.
• Category: Business Acumen & Financial Management
• Skills: P&L Management: Understanding and managing the budget for your department, demonstrating cost-effectiveness and return on investment for compliance initiatives.
• Business Process Understanding: A deep grasp of the organisation's core business processes to effectively integrate compliance requirements and identify risks.
• Cost of Quality Analysis: Modelling and reporting on the financial impact of non-quality and non-compliance, using data to drive investment in improvements.

Functional Skills (Role-Specific Technical)

You'll need a deep, practical mastery of auditing principles and the ability to apply them strategically. This isn't just about knowing the theory; it's about designing and governing the entire system.

Technical Competencies

• Skill: Process Auditing (Strategic Application)
• Desc: You'll design and oversee the application of process auditing methodologies (like the 'Turtle Diagram') across the entire organisation, ensuring consistency and effectiveness. You'll coach your team on how to deconstruct complex, cross-functional processes into their core components to identify systemic weaknesses, not just isolated incidents.
• Level: Expert
• Skill: Root Cause Analysis (Oversight & Validation)
• Desc: You're responsible for ensuring that all major non-conformances undergo thorough root cause analysis, going far beyond the '5 Whys.' You'll validate the effectiveness of techniques like Fishbone Diagrams and Fault Tree Analysis, challenging your team and auditees to find the true underlying causes and prevent recurrence.
• Level: Expert
• Skill: Risk-Based Auditing (Programme Design)
• Desc: You'll architect the entire internal audit programme based on a robust risk assessment, ensuring audit resources are focused on areas with the highest potential impact on quality, safety, and compliance. This means integrating risk registers, past performance data, and strategic business objectives into the audit planning process.
• Level: Expert
• Skill: ISO 19011:2018 Interpretation & Governance
• Desc: You'll be the ultimate authority on the guidelines for auditing management systems, applying its principles to govern our internal audit programme and ensure all auditors meet competence requirements. You'll use this standard to establish our internal audit policy and procedures.
• Level: Expert
• Skill: CAPA Management (System Design & Governance)
• Desc: You'll design, implement, and continuously improve our Corrective Action / Preventive Action (CAPA) system. This means ensuring a disciplined approach from problem identification through to verification of effectiveness, preventing 'CAPA Ping-Pong' and driving genuine systemic improvement.
• Level: Expert
• Skill: Evidence Gathering & Sampling Techniques (Governance)
• Desc: You'll establish the standards and provide oversight for evidence gathering and sampling across the audit programme. This ensures your team uses appropriate methods (statistical vs. judgmental) to draw valid, defensible conclusions from audit activities, maintaining the credibility of our findings.
• Level: Advanced

Digital Tools

• Tool: iAuditor (by SafetyCulture)
• Level: Strategic
• Usage: Managing the enterprise license, developing global audit templates and logic-based checklists for the entire team, and integrating iAuditor data with our Power BI dashboards for executive reporting.
• Tool: ServiceNow GRC
• Level: Architect
• Usage: Designing and configuring GRC workflows for audit planning, issue management, and CAPA tracking. Defining the risk control frameworks within the system and building executive dashboards for the Audit Committee.
• Tool: SharePoint
• Level: Strategic
• Usage: Architecting the enterprise-wide information management strategy for all controlled documentation related to QMS/EHSMS. Ensuring secure, version-controlled storage for audit evidence and compliance records.
• Tool: Microsoft Excel
• Level: Strategic
• Usage: Modelling the cost of quality and risk exposure based on audit data. Building automated reporting templates for the audit team and performing complex data analysis for strategic insights.
• Tool: Power BI
• Level: Strategic
• Usage: Governing the enterprise-wide compliance reporting strategy. Integrating data from multiple systems (GRC, ERP, iAuditor) into a single source of truth for executive-level performance monitoring.
• Tool: MS Teams
• Level: Strategic
• Usage: Establishing the company-wide policy and best practices for remote auditing and secure collaboration with external certification bodies and internal teams. Managing team communication and project channels.

Industry Knowledge

• Area: Integrated Management Systems
• Desc: Deep understanding of how various ISO standards (e.g., 9001, 14001, 45001, 27001) can be integrated into a single, cohesive management system to reduce duplication and improve efficiency.
• Area: Regulatory Landscape & Enforcement
• Desc: Comprehensive knowledge of relevant UK and international compliance regulations, including the latest enforcement trends and potential penalties for non-compliance.
• Area: Quality Management Principles
• Desc: Expertise in core quality management principles (e.g., customer focus, leadership, process approach, improvement) and how they drive business excellence beyond mere compliance.
• Area: Environmental, Health & Safety Legislation
• Desc: Thorough understanding of key EHS legislation and how to ensure organisational adherence, including incident reporting and emergency preparedness requirements.

Regulatory Compliance Regulations

• Reg: ISO 9001:2015 (Quality Management Systems)
• Usage: You'll be the ultimate arbiter of its interpretation, designing audit programmes to ensure full compliance and driving continuous improvement in our quality management system across the enterprise.
• Reg: ISO 14001:2015 (Environmental Management Systems)
• Usage: You'll oversee our environmental compliance, ensuring our EMS meets all requirements, driving initiatives to reduce environmental impact, and managing external audits related to this standard.
• Reg: ISO 45001:2018 (Occupational Health & Safety Management Systems)
• Usage: You'll direct our OH&S strategy, ensuring our systems protect our workforce, prevent incidents, and comply with all safety legislation, managing the audit programme for this critical standard.
• Reg: Relevant UK Health & Safety Legislation (e.g., HSWA 1974, CDM Regulations)
• Usage: You'll ensure our management systems are designed to meet or exceed all applicable UK health and safety laws, acting as a key advisor on legal compliance during strategic planning and incident response.

Essential Prerequisites

• Proven experience (12+ years) in a senior auditing or compliance role, with at least 3-5 years managing an audit programme or a team of auditors.
• Multiple ISO Lead Auditor certifications (e.g., ISO 9001, 14001, 45001) from a recognised body.
• Demonstrable experience in managing relationships with external certification bodies and, ideally, direct engagement with regulatory agencies.
• A strong track record of designing, implementing, and improving management systems across a complex organisation.
• Experience managing a significant departmental budget and making sound financial decisions related to compliance.

Career Pathway Context

To thrive here, you won't just have done the work; you'll have led it. We're looking for someone who has stepped up from being a Lead Auditor to actually running the show, building teams, and influencing at a senior level. If you've been a Principal Consultant in a compliance firm or headed up Quality for a smaller company, that could also count.

Qualifications & Credentials

Emerging Foundation Skills

• Skill: AI-Driven Risk Prediction & Anomaly Detection
• Why: Competitors are already using AI to analyse vast datasets (incident reports, audit findings, sensor data) to predict potential compliance failures before they happen. This shifts our focus from reactive auditing to proactive risk mitigation, giving us a significant competitive edge and preventing major incidents.
• Concepts: [{'concept_name': 'Predictive Analytics Models', 'description': 'Understanding how machine learning models can identify patterns and forecast future risks based on historical data.'}, {'concept_name': 'Real-time Data Integration', 'description': 'Connecting various data sources (IoT sensors, ERP, GRC) to feed real-time information into risk models.'}, {'concept_name': 'Anomaly Detection Algorithms', 'description': 'Anomaly Detection Algorithms'}, {'concept_name': 'Ethical AI & Bias in Risk Models', 'description': 'Ethical AI & Bias in Risk Models'}, {'concept_name': 'Explainable AI (XAI) for Audit Findings', 'description': 'Explainable AI (XAI) for Audit Findings'}]
• Prepare: This quarter: Attend a webinar on AI in GRC or risk management; start understanding the basics.
• Next 3 months: Research case studies of companies using AI for predictive compliance; identify potential internal applications.
• Month 4-6: Work with our Data Science team (if we have one) or external consultants to pilot a small-scale anomaly detection project.
• Month 7-9: Develop a business case for integrating predictive analytics into our core audit planning process.
• QuickWin: Start experimenting with AI tools (like ChatGPT or Claude) to summarise large sets of incident reports or audit findings, looking for emerging themes. It's a low-risk way to see patterns.
• Skill: ESG (Environmental, Social, Governance) Auditing & Reporting
• Why: Investors, customers, and regulators are increasingly demanding robust ESG performance and transparent reporting. This isn't just 'nice to have' anymore; it's a critical component of business value and risk management. Our audit programme needs to expand to cover these areas effectively.
• Concepts: [{'concept_name': 'ESG Reporting Frameworks (e.g., GRI, SASB, TCFD)', 'description': 'Understanding the different standards and metrics used for ESG disclosure.'}, {'concept_name': 'Double Materiality Assessment', 'description': 'Identifying ESG issues that impact both the business and external stakeholders.'}, {'concept_name': 'Social Auditing Methodologies (e.g., SA8000)', 'description': 'Social Auditing Methodologies (e.g., SA8000)'}, {'concept_name': 'Greenhouse Gas (GHG) Protocol', 'description': 'Greenhouse Gas (GHG) Protocol'}, {'concept_name': 'Supply Chain Due Diligence for Human Rights', 'description': 'Supply Chain Due Diligence for Human Rights'}]
• Prepare: This quarter: Read up on the latest ESG reporting trends and regulatory developments in the UK and EU.
• Next 3 months: Identify key ESG risks and opportunities relevant to our business; map them against existing ISO standards.
• Month 4-6: Develop a preliminary audit plan or checklist for a specific ESG area (e.g., supply chain labour practices).
• Month 7-9: Engage with our Sustainability or Investor Relations teams to understand their current reporting needs and challenges.
• QuickWin: Review our current ISO 14001 and 45001 audit scopes to see where ESG elements can be naturally integrated. Start drafting an 'OFI' (Opportunity for Improvement) related to an ESG topic in your next internal audit.

Advancing Technical Skills

• Skill: Advanced GRC Platform Configuration & Integration
• Why: Our GRC system (like ServiceNow) needs to become the central nervous system for all compliance activities. This means moving beyond basic use to advanced configuration, custom workflow design, and seamless integration with other business systems (ERP, HRIS). Auditors need a single source of truth, and you'll be key to building it.
• Concepts: [{'concept_name': 'API Integrations & Data Orchestration', 'description': 'Connecting ServiceNow GRC with other systems to automate data flow and reduce manual entry.'}, {'concept_name': 'Custom Workflow & Rule Engine Design', 'description': 'Building bespoke workflows within GRC to manage unique compliance processes or regulatory requirements.'}, {'concept_name': 'GRC Reporting & Dashboard Development', 'description': 'GRC Reporting & Dashboard Development'}, {'concept_name': 'User Access Management & Security within GRC', 'description': 'User Access Management & Security within GRC'}, {'concept_name': 'Low-code/No-code Development for GRC Extensions', 'description': 'Low-code/No-code Development for GRC Extensions'}]
• Prepare: This quarter: Deep dive into ServiceNow GRC's advanced configuration options and integration capabilities.
• Next 3 months: Identify one manual compliance process that could be fully automated within GRC; design the workflow.
• Month 4-6: Work with IT to implement a pilot integration between GRC and another key business system.
• Month 7-9: Lead a project to build a new executive compliance dashboard directly within GRC, pulling data from integrated sources.
• QuickWin: Explore the ServiceNow Community forums for advanced GRC use cases and best practices. Identify one small, repetitive task your team does that could be automated with a simple GRC workflow.
• Skill: Data Governance & Compliance Analytics
• Why: As we rely more on data for compliance decisions and AI-driven insights, ensuring the integrity, accuracy, and security of that data becomes paramount. You'll need to establish robust data governance frameworks specifically for compliance data, ensuring it's trustworthy for auditing and reporting.
• Concepts: [{'concept_name': 'Data Quality Management (DQM)', 'description': 'Implementing processes to ensure compliance data is accurate, complete, and consistent.'}, {'concept_name': 'Data Lineage & Auditability', 'description': 'Tracking the origin and transformations of compliance data to ensure its trustworthiness for audit purposes.'}, {'concept_name': 'Data Privacy Regulations (e.g., GDPR, DPA)', 'description': 'Data Privacy Regulations (e.g., GDPR, DPA)'}, {'concept_name': 'Master Data Management (MDM) for Compliance', 'description': 'Master Data Management (MDM) for Compliance'}, {'concept_name': 'Data Visualisation for Compliance Insights', 'description': 'Data Visualisation for Compliance Insights'}]
• Prepare: This quarter: Review our current data governance policies through a compliance lens; identify gaps.
• Next 3 months: Work with IT and Legal to define data ownership and stewardship for key compliance datasets.
• Month 4-6: Implement a data quality check for one critical compliance data source (e.g., CAPA records).
• Month 7-9: Develop a strategy for integrating data governance principles into our overall audit methodology.
• QuickWin: Start by documenting the data flow for one of your most critical compliance reports. Where does the data come from? Who owns it? How is it transformed? This simple exercise often reveals immediate areas for improvement.

Education Requirements

• Level: Minimum
• Req: A Bachelor's degree in a relevant field such as Business Management, Engineering, Environmental Science, Occupational Health & Safety, or a related discipline.
• Alts: We're open to candidates with equivalent professional experience (at least 15+ years) and a proven track record of managing complex compliance programmes, even without a degree. Show us what you've built.
• Level: Preferred
• Req: A Master's degree (e.g., MBA, MSc in Quality Management, Environmental Management, or Risk Management) would be a definite advantage.
• Alts: Significant leadership experience in a highly regulated industry or a recognised professional qualification at a postgraduate level could also be considered.

Experience Requirements

You'll need roughly 12-16 years of progressive experience in compliance, quality, health, or safety roles. This should include at least 5-7 years in a dedicated audit management or programme leadership capacity, where you've overseen multiple ISO standards. We're looking for demonstrable experience managing a team of auditors (including other managers), engaging directly with external certification bodies, and presenting to senior executive teams. You'll also need a solid track record of designing and implementing effective management systems, not just auditing existing ones.

Preferred Certifications

• Cert: ISO/IEC 27001 Lead Auditor
• Prod: Various (e.g., BSI, PECB)
• Usage: Increasingly important for integrated management systems, especially if our business handles sensitive data or has IT-related compliance needs.
• Cert: Certified Information Systems Auditor (CISA)
• Prod: ISACA
• Usage: Useful if you're looking to expand into IT compliance and audit, which is a growing area for many organisations.
• Cert: NEBOSH Diploma (or equivalent)
• Prod: NEBOSH
• Usage: Demonstrates advanced knowledge in occupational health and safety, which is critical for our ISO 45001 programme and overall safety culture.
• Cert: Chartered Quality Professional (CQP)
• Prod: Chartered Quality Institute (CQI)
• Usage: Shows a commitment to the quality profession and a broad understanding of quality management principles beyond just ISO 9001.

Recommended Activities

• Regularly attend industry conferences and seminars on compliance, quality, and EHS management to stay current with best practices and regulatory changes.
• Participate in professional networks or forums (e.g., CQI, IOSH) to share knowledge and learn from peers.
• Undertake continuous professional development (CPD) in areas like leadership, change management, or advanced data analytics.
• Seek out opportunities to speak at industry events or publish articles, establishing yourself as a thought leader in the field.

Career Progression Pathways

Entry Paths to This Role

• Path: Lead Auditor / Audit Programme Manager (L4)
• Time: 3-5 years in previous role
• Path: Principal Consultant (Compliance/QHS) from an external firm
• Time: 5-7 years in a consulting role
• Path: Head of Quality/Compliance for a smaller organisation
• Time: 4-6 years in a similar leadership role

Career Progression From This Role

• Pathway: Director of Quality & Compliance (L6)
• Time: 3-5 years in this role

Long Term Vision Potential Roles

• Title: VP of EHSQ (Environmental, Health, Safety, Quality)
• Time: 5-8 years from current role
• Title: Chief Compliance Officer (CCO)
• Time: 7-10 years from current role
• Title: Independent Board Advisor / Consultant
• Time: 10+ years from current role

How Zavmo Delivers This Role's Development

DISCOVER Phase: Skills Gap Analysis

Zavmo maps your current competencies against all requirements in this job description through conversational assessment. We evaluate your foundation skills (communication, strategic thinking), functional skills (CRM expertise, negotiation), and readiness for career progression.

Output: Personalised skills gap heat map showing strengths and priorities, estimated time to competency, neurodiversity accommodations.

DISCUSS Phase: Personalised Learning Pathway

Based on your DISCOVER results, Zavmo creates a personalised learning plan prioritised by impact: foundation skills first, then functional skills. We adapt to your learning style, pace, and neurodiversity needs (ADHD, dyslexia, autism).

Output: Week-by-week schedule, each module linked to specific job responsibilities, checkpoints and milestones.

DELIVER Phase: Conversational Learning

Learn through conversation, not boring modules. Zavmo uses 10 conversation types (Socratic dialogue, role-play, coaching, case studies) to build competence. Practice difficult QBR presentations, negotiate tough renewals, and handle churn conversations in a safe AI environment before facing real clients.

Example: "For 'Stakeholder Mapping', Zavmo will guide you through analysing a complex enterprise account, identifying key decision-makers, and building an engagement strategy."

DEMONSTRATE Phase: Competency Assessment

Zavmo automatically builds your evidence portfolio as you learn. Every conversation, practice scenario, and application example is captured and mapped to NOS performance criteria. When ready, your portfolio supports OFQUAL qualification claims and demonstrates competence to employers.

Output: Competency matrix, evidence portfolio (downloadable), qualification readiness, career progression score.