Chief Audit Executive (CAE)

Role Purpose & Context

Role Summary

The Chief Audit Executive (CAE) is here to give the Board and CEO an honest, unbiased view of how well we're actually managing our biggest risks. You'll set the overall strategy for internal audit, making sure our programmes cover everything from financial controls to environmental safety, and that we're always looking ahead for new threats. This isn't about ticking boxes; it's about providing deep, strategic insights that help shape our company's direction and protect our shareholders' interests. Frankly, if you do your job well, the Board sleeps better at night, and we avoid major scandals or regulatory fines. If you don't, well, the consequences can be catastrophic for the business. The challenge? Navigating complex corporate politics and getting powerful executives to act on uncomfortable truths. The reward? Knowing you're a critical guardian of our organisation's integrity and long-term success.

Reporting Structure

• Reports to: Board Audit Committee and administratively to the CEO
• Direct reports: Typically 3-5 Director-level reports, overseeing a function of 100s-1000s indirectly
• Matrix relationships: Group Chief Auditor, Head of Enterprise Assurance, VP Internal Audit (Board Level),

Key Stakeholders

Internal:

• Board Audit Committee
• Chief Executive Officer (CEO)
• Chief Financial Officer (CFO)
• Chief Risk Officer (CRO)
• General Counsel
• Executive Leadership Team (ELT)
• Heads of Business Units

External:

• External Auditors
• Regulatory Bodies (e.g., HSE, EPA, FCA)
• Investors and Shareholders
• Industry Associations
• Legal Counsel

Organisational Impact

Scope: This role directly shapes the enterprise's governance, risk management, and control environment. Your assessments and recommendations impact strategic decision-making, capital allocation, regulatory compliance, and ultimately, our public reputation and market valuation. You're essentially the company's conscience, ensuring we operate ethically and effectively on a global scale.

Performance Metrics

Quantitative Metrics

1. Metric: Annual Audit Plan Completion Rate
2. Desc: Percentage of the Board-approved annual audit plan that's actually delivered.
3. Target: 100% (or with Board-approved adjustments)
4. Freq: Quarterly and Annually
5. Example: If the Board approved 25 audits for the year, you delivered all 25, or formally agreed with the Board to shift priorities for two, completing 23 and substituting two new high-priority ones.
6. Metric: High-Risk Finding Remediation Rate
7. Desc: Percentage of critical and high-risk audit findings that are fully remediated by their agreed-upon due dates.
8. Target: >95%
9. Freq: Quarterly
10. Example: Of 30 high-risk findings identified in the last year, 29 have been closed out with verified evidence of remediation, demonstrating management's commitment to fixing serious issues.
11. Metric: External Auditor Reliance
12. Desc: The extent to which our external auditors can rely on Internal Audit's work, reducing their own scope and fees.
13. Target: Significant reliance, resulting in >15% reduction in external audit fees for control testing.
14. Freq: Annually (post-external audit)
15. Example: External auditors reduced their control testing scope by 20% this year, directly attributing this to the quality and coverage of Internal Audit's work on key financial and operational controls, saving us £250,000.
16. Metric: Cost Savings / Value Realisation
17. Desc: Quantifiable financial benefits (e.g., reduced fines, improved efficiency, avoided losses) directly attributable to Internal Audit recommendations.
18. Target: Identify and track £5M+ in value annually.
19. Freq: Annually
20. Example: Following an audit of our hazardous waste disposal processes, your team identified control gaps that, if unaddressed, could have led to £7M in regulatory fines and clean-up costs. Management implemented your recommendations, avoiding these potential costs.

Qualitative Metrics

1. Metric: Board and Executive Confidence
2. Desc: The level of trust and confidence the Board Audit Committee and Executive Leadership Team place in Internal Audit's assessments and recommendations.
3. Evidence: Regular invitations to strategic planning sessions; proactive consultation on major business initiatives; Board members seeking your independent opinion on critical risks; positive feedback in annual Board effectiveness surveys regarding Internal Audit's contributions.
4. Metric: Effectiveness of Risk Culture
5. Desc: How well the organisation understands and manages risk, influenced by Internal Audit's insights and challenge.
6. Evidence: Senior leaders proactively raising control issues; management demonstrating a clear understanding of their control responsibilities; reduced instances of 'surprise' major incidents; audit findings leading to systemic process improvements rather than just quick fixes.
7. Metric: Proactive Risk Identification
8. Desc: Internal Audit's ability to identify emerging risks and control weaknesses before they become major problems.
9. Evidence: Audit plan consistently includes audits of new technologies, regulations, or business models; early warnings provided to the Board on potential compliance breaches or safety hazards; audit reports highlighting future-looking risks, not just historical issues.
10. Metric: Influence on Governance & Control Frameworks
11. Desc: The extent to which Internal Audit's recommendations lead to improvements in the company's overall governance and control structures.
12. Evidence: Direct input into the design of new policies and procedures; participation in enterprise-wide risk management committees; recommendations leading to changes in organisational structure or reporting lines to improve oversight.

Primary Traits

• Trait: Unwavering Integrity and Independence
• Manifestation: You're the person who'll stand firm on a critical finding, even when the CEO or a powerful business unit head is pushing back hard. You'll ensure audit reports reflect the unvarnished truth, regardless of how uncomfortable it might be for some. Your decisions are always based on evidence and what's right for the company, not on who's asking or what's politically expedient. Honestly, you're the ultimate guardian of our ethical compass.
• Benefit: The CAE's role is fundamentally about trust. If the Board, regulators, or investors ever doubt your independence or integrity, the entire internal audit function loses its value. You're the last line of defence against internal failures and external scrutiny, and that requires absolute moral courage.
• Trait: Strategic Acumen & Enterprise Vision
• Manifestation: You don't just see individual control weaknesses; you see how they connect to the company's overall strategy, market position, and long-term viability. You'll anticipate emerging risks—like new global regulations or shifts in supply chains—and proactively adjust the audit plan. This means you're thinking three to five years ahead, not just about the next quarter's audits. You're able to translate complex regulatory changes into clear, actionable risks for the Board.
• Benefit: At this level, it's not enough to be a good auditor. You need to be a strategic partner to the Board and executive team. Your insights must help them navigate a complex, ever-changing landscape, ensuring our governance and controls support our strategic objectives, rather than hindering them. Without this, you're just reporting history.
• Trait: Diplomatic Influence & Executive Presence
• Manifestation: You can walk into a Board meeting, present a challenging audit finding, and leave with a clear commitment for action, all while maintaining respect and rapport. You're able to influence senior leaders without direct authority over them, using clear, concise communication and compelling evidence. This isn't about being aggressive; it's about being authoritative, credible, and persuasive. You're the kind of leader who can get a room full of C-suite executives to agree on a difficult path forward.
• Benefit: The CAE operates at the highest echelons of the company. You'll constantly be dealing with highly intelligent, often strong-willed individuals. Your ability to build relationships, communicate complex issues simply, and influence decisions is paramount. If you can't get buy-in, even the most brilliant audit findings will gather dust.

Supporting Traits

• Trait: Resilient under Pressure
• Desc: You'll face immense pressure from all sides—tight deadlines, difficult findings, and sometimes, resistance from powerful executives. You need to keep a cool head, maintain objectivity, and continue to perform effectively, even when the stakes are incredibly high.
• Trait: Visionary Leadership
• Desc: You're not just managing a team; you're building a world-class internal audit function. This means inspiring your team, fostering a culture of continuous improvement, and attracting top talent. You'll define what 'great' looks like for audit here.
• Trait: Exceptional Communicator (Verbal & Written)
• Desc: You can distil incredibly complex issues into clear, concise, and impactful messages for a Board audience. Your audit reports are not just accurate; they're compelling, easy to understand, and drive action. You'll also be a master at listening, picking up on nuances and unspoken concerns.
• Trait: Politically Astute
• Desc: You understand the unwritten rules of corporate dynamics. You can read a room, anticipate objections, and navigate complex interpersonal relationships to achieve audit objectives without creating unnecessary conflict. This isn't about being political, but about understanding the landscape.

Primary Motivators

1. Motivator: Protecting Enterprise Value
2. Daily: You'll be driven by the knowledge that your work directly safeguards the company's assets, reputation, and long-term sustainability. This shows up in your relentless pursuit of control improvements and your commitment to identifying and mitigating major risks.
3. Motivator: Shaping Organisational Governance
4. Daily: You thrive on influencing the highest levels of corporate governance. You'll enjoy seeing your recommendations lead to fundamental changes in how the company is run, improving oversight and accountability. This means you're genuinely excited about presenting to the Board and challenging the status quo.
5. Motivator: Building a High-Performing Team
6. Daily: You'll get immense satisfaction from mentoring and developing a team of audit professionals, seeing them grow into future leaders. You're passionate about fostering a culture of excellence, curiosity, and integrity within your department.

Potential Demotivators

Honestly, this role isn't for everyone. You'll sometimes feel like you're the bearer of bad news, and not everyone will be thrilled to see you. Expect to deal with significant political pressure to soften findings or delay remediation. You might identify critical issues that, for various reasons (cost, politics), take far too long to fix, or worse, don't get fixed at all. You'll have to manage a large team with diverse personalities and skill sets, which can be draining. If you need constant external validation or prefer to avoid confrontation, you'll find this role incredibly challenging.

Common Frustrations

1. Executive resistance to implementing critical audit recommendations, especially when they're costly or disruptive.
2. The perception that Internal Audit is a cost centre or 'internal police' rather than a strategic partner.
3. Navigating complex corporate politics and power dynamics to get the right outcomes.
4. The sheer volume and complexity of global regulations and emerging risks, making it a constant race to keep up.
5. Managing a large, geographically dispersed team, ensuring consistency and quality across all engagements.

What Role Doesn't Offer

1. A quiet, predictable routine—expect constant shifts in priorities and urgent, high-stakes issues.
2. The ability to always be 'liked' by everyone; sometimes you have to deliver uncomfortable truths.
3. Direct operational control; your power comes from influence and assurance, not direct management of business units.
4. Immediate gratification for every finding; systemic change often takes a long time.

ADHD Positives

1. The fast-paced, high-stakes nature of C-suite audit can be incredibly engaging, providing constant novelty and intellectual stimulation.
2. The ability to rapidly connect disparate pieces of information and identify patterns across the enterprise can be a significant strength in strategic risk assessment.
3. High energy levels can be beneficial for managing multiple, complex initiatives and maintaining oversight of a large audit function.

ADHD Challenges and Accommodations

1. The need for meticulous, long-term strategic planning and oversight might require structured support for organisation and follow-through. We can provide executive coaching focused on strategic execution.
2. Extensive, detailed board reporting and documentation could be tedious; we can use AI tools for first drafts and have dedicated support staff for final formatting and proofreading.
3. Managing a large, diverse team requires consistent communication and delegation, which might benefit from clear frameworks and regular check-ins to maintain focus.

Dyslexia Positives

1. Often brings exceptional 'big picture' thinking, which is crucial for enterprise-level risk identification and strategic planning.
2. Strong verbal communication skills can be a huge asset in Board presentations and influencing executive stakeholders.
3. Excellent problem-solving abilities, especially for complex, non-linear issues, are highly valued in this role.

Dyslexia Challenges and Accommodations

1. Producing lengthy, highly polished written reports for the Board and regulators can be challenging. We can offer dedicated editorial support, proofreading services, and advanced grammar/spell-checking software.
2. Reading dense regulatory documents can be time-consuming; AI summarisation tools and audio-to-text options can help. We're open to using visual aids and diagrams extensively in reports and presentations.
3. Ensuring clarity and precision in written communications is vital; we'll encourage using plain language training and peer review processes.

Autism Positives

1. A strong adherence to logic, facts, and integrity aligns perfectly with the core principles of internal audit and maintaining independence.
2. The ability to identify patterns, inconsistencies, and systemic flaws in complex processes is invaluable for high-level assurance.
3. Exceptional focus on detail, even at an enterprise level, can uncover critical risks that others miss. A preference for clear, direct communication can cut through corporate jargon.

Autism Challenges and Accommodations

1. Navigating complex, often unspoken, corporate political dynamics and social cues can be taxing. We'll provide clear expectations for stakeholder engagement and offer executive coaching on political navigation.
2. The need for frequent, high-stakes social interactions (Board meetings, executive committees) might require structured preparation and debriefing. We can agree on specific communication channels and meeting structures.
3. Unexpected changes in strategic direction or priorities could be unsettling. We'll aim for transparent communication of strategic shifts and provide ample time for adaptation where possible.

Key Responsibilities

Experience Levels Responsibilities

1. Level: Chief Audit Executive (CAE)
2. Responsibilities: Define and champion the enterprise-wide internal audit strategy, making sure it aligns with our business objectives and covers our biggest risks (financial, operational, compliance, quality, health, and safety).
3. Provide independent, objective assurance to the Board Audit Committee and Executive Leadership Team on the effectiveness of our governance, risk management processes, and internal controls.
4. Oversee the development and execution of the annual audit plan, ensuring it's risk-based, comprehensive, and adaptable to emerging threats and regulatory changes.
5. Manage and develop a large, geographically dispersed internal audit function (hundreds of people, give or take), fostering a culture of integrity, professional scepticism, and continuous improvement.
6. Build and maintain strong, credible relationships with the Board, CEO, CFO, General Counsel, and other executive leaders, acting as a trusted advisor on control matters.
7. Serve as the primary liaison with external auditors and regulatory bodies, ensuring effective coordination, information sharing, and appropriate responses to their findings.
8. Lead investigations into significant control breakdowns, fraud, or ethical breaches, ensuring thoroughness, objectivity, and appropriate reporting to the Board.
9. Champion the use of advanced audit analytics, AI, and automation within the internal audit function to improve efficiency, coverage, and insights.
10. Report quarterly to the Board Audit Committee on audit results, significant risks, remediation progress, and the overall health of the control environment. Expect tough questions.
11. Supervision: You'll operate with full autonomy within the mandate set by the Board Audit Committee. Your performance is reviewed against strategic objectives and the effectiveness of the overall control environment, with regular alignment meetings with the CEO and Board Chair.
12. Decision: Full strategic authority for the Internal Audit function, including budget allocation (typically £10M+), organisational design of the audit team, hiring and firing of direct reports, and approval of all audit reports and findings. You'll make recommendations to the Board on enterprise-level control frameworks and risk appetite. Decisions with company-wide P&L impact (e.g., major system changes driven by audit findings) require Board approval.
13. Success: A robust, effective control environment that protects the company from significant loss or reputational damage. A Board and executive team that consistently trusts and values Internal Audit's insights. A high-performing, ethical audit team. Zero 'surprise' major control failures or regulatory breaches that Internal Audit should have identified.

Decision-Making Authority

• Type: Annual Audit Plan Approval
• Entry: N/A
• Mid: N/A
• Senior: Propose audit scope and methodology for specific engagements to Audit Manager.
• Type: Significant Audit Finding Escalation
• Entry: Identify potential findings and escalate to Senior Auditor.
• Mid: Draft findings, validate with auditee, and escalate to Audit Manager for review.
• Senior: Finalise findings with auditee, determine risk rating, and present to Director for approval.
• Type: Internal Audit Budget Allocation
• Entry: N/A
• Mid: N/A
• Senior: Provide input on resource needs for specific engagements.

Competency Requirements

Foundation Skills (Transferable)

At the C-suite level, your foundation skills are less about doing and more about leading, influencing, and envisioning. These are the meta-skills that allow you to effectively steer a large function and provide strategic counsel to the Board.

• Category: Strategic Leadership & Vision
• Skills: Enterprise-level strategic thinking: The ability to see beyond the immediate, anticipating future risks and opportunities, and aligning the audit function to support long-term business goals.
• Organisational transformation: Leading significant change initiatives within the audit function (e.g., adopting new technologies, restructuring teams) and influencing broader organisational change.
• Executive decision-making: Making high-stakes decisions with incomplete information, often under pressure, and taking accountability for the outcomes.
• Category: Influence & Communication at Board Level
• Skills: Board-level presentation: Articulating complex issues, risks, and recommendations clearly and concisely to a non-technical Board audience, handling challenging questions with gravitas.
• Executive stakeholder management: Building and maintaining trust and rapport with the CEO, CFO, General Counsel, and other C-suite executives, often navigating competing priorities and political landscapes.
• Negotiation and conflict resolution: Skillfully resolving disagreements over audit findings or remediation plans with senior leaders, achieving positive outcomes without damaging relationships.
• Category: Ethical Leadership & Integrity
• Skills: Upholding independence: Ensuring the internal audit function remains objective and free from undue influence, even when dealing with highly sensitive issues or powerful individuals.
• Fostering an ethical culture: Setting the tone from the top for integrity, transparency, and accountability within the audit function and influencing the broader organisation's ethical behaviour.
• Crisis management: Leading the audit response during major incidents (e.g., fraud, regulatory breaches), ensuring thorough investigation and appropriate reporting.
• Category: Talent & Organisational Development
• Skills: Building high-performing teams: Attracting, developing, and retaining top audit talent, including a strong leadership pipeline for your direct reports.
• Organisational design: Structuring the internal audit function to be agile, effective, and responsive to the company's evolving risk profile and global footprint.
• Mentorship and coaching: Providing strategic guidance and development opportunities for your senior leaders, helping them grow into future executive roles.

Functional Skills (Role-Specific Technical)

These are the specific methodologies, frameworks, and technical capabilities you'll need to command at an expert level to effectively lead a global internal audit function, especially within the Compliance, Quality, Health, and Safety domain.

Technical Competencies

• Skill: Enterprise Risk Management (ERM) Frameworks
• Desc: Expert knowledge of leading ERM frameworks (e.g., COSO ERM, ISO 31000) and the ability to integrate internal audit's work with the company's overall risk management strategy. You'll be advising the Board on the adequacy of our ERM programme.
• Level: Expert
• Skill: Advanced Governance Models
• Desc: Deep understanding of corporate governance best practices, Board responsibilities, and the role of various committees (Audit, Risk, ESG). You'll be a key advisor on how to optimise our governance structures.
• Level: Expert
• Skill: Global Regulatory Interpretation & Foresight
• Desc: The ability to not just understand complex global CQHS regulations (e.g., GDPR, OSHA, ISO standards, environmental laws) but to anticipate future regulatory trends and their strategic impact on the business. You'll advise the Board on potential compliance exposures.
• Level: Expert
• Skill: Audit Methodology Design & Optimisation
• Desc: Expertise in designing and continuously improving internal audit methodologies, including risk assessment models, audit programme development, and reporting standards, ensuring they are efficient, effective, and aligned with professional standards (e.g., IIA IPPF).
• Level: Expert
• Skill: Data Analytics & AI Strategy for Audit
• Desc: While you won't be writing code, you need to set the strategy for how data analytics and AI are used across the audit function. This includes defining data governance for audit, championing new technologies, and ensuring your team has the capabilities to use them for continuous auditing and anomaly detection.
• Level: Advanced

Digital Tools

• Tool: GRC Platform (e.g., Intelex, LogicGate, ServiceNow GRC)
• Level: Strategic
• Usage: Leading the selection, implementation, and strategic integration of the enterprise GRC platform. You'll define the overarching data architecture and ensure the platform provides holistic risk and control insights for the Board. You'll use it to monitor enterprise-wide risk dashboards.
• Tool: Audit Analytics (e.g., Galvanize/Diligent, IDEA)
• Level: Architect
• Usage: Setting the vision and strategy for continuous auditing and monitoring across the enterprise. You'll define the data governance standards for audit analytics and ensure the tools are effectively deployed to identify systemic risks and control breakdowns.
• Tool: EHS/QMS Software (e.g., Enablon, Cority, MasterControl)
• Level: Strategic
• Usage: Assessing the suitability and effectiveness of the organisation's EHS/QMS platforms from an assurance perspective. You'll provide the Board with an independent view on whether these systems adequately support our compliance and safety objectives, and where the gaps are.
• Tool: Data Visualization (e.g., Power BI, Tableau)
• Level: Strategic
• Usage: Designing and championing the use of executive-level risk dashboards for the Board Audit Committee. You'll ensure these dashboards provide a clear, real-time view of the control environment and key risk indicators, enabling informed strategic decisions.
• Tool: Collaboration & Communication Suites (e.g., MS Teams, SharePoint, Zoom)
• Level: Expert
• Usage: Setting the policy and standards for secure electronic workpaper retention and global team collaboration. You'll use these tools for high-stakes executive meetings, Board presentations, and managing your global leadership team.

Industry Knowledge

• Area: Global CQHS Regulatory Landscape
• Desc: Comprehensive understanding of the global regulatory environment impacting Compliance, Quality, Health, and Safety across all geographies where we operate. This includes deep knowledge of emerging regulations and their potential impact.
• Area: Industry-Specific Risks & Best Practices
• Desc: Expert knowledge of the specific operational, compliance, and safety risks inherent to our industry sector, as well as leading best practices for managing these risks. You'll be expected to benchmark our controls against industry leaders.
• Area: Geopolitical & Macroeconomic Risk Factors
• Desc: Understanding how global economic trends, political instability, and supply chain disruptions can create new compliance, quality, or safety risks for our enterprise. You'll integrate these considerations into the audit plan.

Regulatory Compliance Regulations

• Reg: Global Data Privacy Regulations (e.g., GDPR, CCPA)
• Usage: Providing assurance to the Board on the effectiveness of controls protecting personal data across the enterprise, including assessing privacy by design in new systems and responding to major data breaches.
• Reg: Anti-Bribery & Corruption Laws (e.g., UK Bribery Act, FCPA)
• Usage: Overseeing audits of our global anti-bribery and corruption programmes, ensuring controls are robust, training is effective, and investigations into potential breaches are thorough and independent.
• Reg: Environmental, Social, and Governance (ESG) Reporting Standards
• Usage: Leading the development of audit programmes to provide assurance over our ESG data and reporting, ensuring accuracy and compliance with evolving global standards and investor expectations.
• Reg: Industry-Specific Health & Safety Regulations (e.g., OSHA, HSE)
• Usage: Ensuring our audit programmes effectively assess compliance with all relevant health and safety regulations, identifying systemic weaknesses that could lead to serious incidents or regulatory penalties.
• Reg: ISO Management System Standards (e.g., ISO 9001, 14001, 45001)
• Usage: Providing assurance on the effectiveness of our Quality, Environmental, and Occupational Health & Safety management systems, ensuring they meet ISO requirements and drive continuous improvement.

Essential Prerequisites

• Extensive experience (20+ years) in internal audit, external audit, risk management, or a related assurance function, with at least 5-7 years at a Director or similar senior leadership level.
• Proven track record of successfully leading and transforming large, complex, and geographically dispersed audit teams.
• Demonstrated ability to engage, influence, and present to Board Audit Committees and Executive Leadership Teams on high-stakes governance and control matters.
• Deep expertise in enterprise risk management frameworks (e.g., COSO ERM) and their practical application.
• A strong understanding of global regulatory environments, particularly those impacting Compliance, Quality, Health, and Safety.
• Experience managing significant budgets and strategic vendor relationships within an assurance function.

Career Pathway Context

To even be considered for this role, you'll have already mastered the art of leading audit functions at a Director level, probably across multiple business units or geographies. You'll have a proven history of navigating complex organisational challenges and delivering impactful assurance. This isn't a role where you learn the ropes; it's where you define them.

Qualifications & Credentials

Emerging Foundation Skills

• Skill: Geopolitical Risk & Supply Chain Assurance
• Why: Global supply chains are increasingly complex and vulnerable to geopolitical events, climate change, and trade wars. Boards need assurance that these critical dependencies are resilient and compliant with evolving international standards and sanctions.
• Concepts: [{'concept_name': 'Supply Chain Mapping & Visibility', 'description': 'Understanding the full end-to-end supply chain, identifying critical nodes and single points of failure, and assessing the transparency of sub-tier suppliers.'}, {'concept_name': 'Geopolitical Scenario Planning', 'description': "Developing audit programmes that test the company's preparedness for various geopolitical disruptions (e.g., sanctions, trade barriers, regional conflicts)."}, {'concept_name': 'ESG Due Diligence in Supply Chain', 'description': 'Assessing the effectiveness of controls related to ethical sourcing, labour practices, and environmental impact across the entire supply chain.'}, {'concept_name': 'Cyber Resilience in Supply Chain', 'description': 'Auditing third-party cyber security controls and data protection measures within critical suppliers.'}]
• Prepare: This quarter: Engage with our Head of Supply Chain and Chief Risk Officer to understand their top 3 geopolitical and supply chain concerns.
• Next 6 months: Commission an internal audit deep dive into a critical, high-risk segment of our supply chain, focusing on resilience and compliance.
• Next 12 months: Develop a framework for continuous assurance over supply chain risks, integrating data from various sources.
• Ongoing: Read widely on global economics, geopolitics, and international trade relations to anticipate future impacts.
• QuickWin: Start attending executive briefings on supply chain resilience. Ask pointed questions about supplier dependencies and geopolitical exposure in Board meetings. Encourage your team to include supply chain elements in all relevant operational audits.
• Skill: ESG Assurance & Impact Measurement
• Why: Investors, regulators, and customers are demanding increasingly robust and verifiable ESG performance. The Board needs independent assurance over the accuracy of ESG data and the effectiveness of controls supporting our sustainability commitments. This is rapidly moving beyond 'nice to have' to 'must have'.
• Concepts: [{'concept_name': 'ESG Reporting Frameworks (e.g., TCFD, SASB, GRI)', 'description': 'Understanding the leading frameworks for reporting on environmental, social, and governance metrics and how they apply to our business.'}, {'concept_name': 'Greenwashing Risk', 'description': 'Identifying and auditing controls designed to prevent misrepresentation or exaggeration of our environmental and social impact.'}, {'concept_name': 'Carbon Accounting & Verification', 'description': 'Assessing the accuracy and completeness of our carbon emissions data and the processes used to collect and report it.'}, {'concept_name': 'Social Impact Metrics & Controls', 'description': 'Auditing the effectiveness of controls related to diversity, equity, inclusion, labour practices, and community engagement.'}]
• Prepare: This quarter: Engage with our Head of Sustainability and Investor Relations to understand our current ESG reporting landscape and investor expectations.
• Next 6 months: Develop an initial audit programme to provide limited assurance over a key ESG metric (e.g., Scope 1 emissions or diversity statistics).
• Next 12 months: Build internal capabilities within your team to conduct more comprehensive ESG audits, potentially leveraging external specialists.
• Ongoing: Stay abreast of evolving ESG regulations and reporting requirements globally, and integrate them into our risk assessment.
• QuickWin: Ensure your audit plan includes a review of the processes used to collect and report our most material ESG data points. Ask the Board how they envision Internal Audit's role in ESG assurance.

Advancing Technical Skills

• Skill: AI/ML Governance & Audit
• Why: As our company increasingly uses AI and Machine Learning in operations, product development, and decision-making, the Board needs assurance that these systems are ethical, unbiased, secure, and compliant. Auditing AI models presents unique challenges.
• Concepts: [{'concept_name': 'AI Ethics & Bias Detection', 'description': 'Understanding how to audit for algorithmic bias, fairness, and transparency in AI models.'}, {'concept_name': 'AI Model Explainability (XAI)', 'description': 'Assessing the ability to understand and interpret the decisions made by AI systems, crucial for accountability.'}, {'concept_name': 'AI Data Governance & Security', 'description': 'Auditing the controls around the data used to train AI models, including privacy, security, and data quality.'}, {'concept_name': 'Regulatory Compliance for AI', 'description': 'Understanding emerging regulations specific to AI (e.g., EU AI Act, national guidelines) and their impact on our operations.'}]
• Prepare: This quarter: Engage with our Head of Data Science and Legal team to understand our current and planned AI deployments and associated risks.
• Next 6 months: Develop an initial audit framework for AI governance, focusing on a high-risk AI application within the company.
• Next 12 months: Invest in training for your audit leaders on AI auditing techniques and consider hiring specialist AI auditors.
• Ongoing: Follow leading industry discussions and regulatory developments around AI ethics and governance.
• QuickWin: Ensure your audit plan includes a review of the governance processes around any significant AI projects. Ask management about their 'AI risk register'.
• Skill: Cyber Security Audit Oversight (Advanced)
• Why: Cyber threats are constantly evolving, and a major breach can be catastrophic. As CAE, you need to ensure your audit function provides robust assurance over the company's cyber security posture, including resilience against sophisticated attacks and effective incident response.
• Concepts: [{'concept_name': 'Advanced Threat Detection & Response', 'description': 'Understanding the latest techniques for identifying and responding to advanced persistent threats (APTs) and zero-day exploits.'}, {'concept_name': 'Cloud Security Architecture & Controls', 'description': 'Auditing security controls in complex multi-cloud environments, including identity and access management, data encryption, and network segmentation.'}, {'concept_name': 'Operational Technology (OT) Security', 'description': 'Assessing cyber security risks and controls in industrial control systems (ICS) and other operational technology environments, particularly relevant for CQHS.'}, {'concept_name': 'Supply Chain Cyber Risk', 'description': 'Auditing the cyber security posture of critical third-party vendors and supply chain partners.'}]
• Prepare: This quarter: Regularly meet with our CISO to understand the top cyber risks and the effectiveness of our current defences.
• Next 6 months: Ensure your audit plan includes a comprehensive review of our cyber incident response plan and our cloud security architecture.
• Next 12 months: Consider bringing in specialist cyber audit expertise, either internally or through co-sourcing arrangements, to enhance capabilities.
• Ongoing: Stay informed on the latest cyber security trends, major breaches, and evolving threat landscapes.
• QuickWin: Ensure the Board Audit Committee receives regular, clear updates on our cyber security posture and any significant audit findings in this area. Challenge the CISO on our resilience.

Education Requirements

• Level: Minimum
• Req: A Bachelor's degree in Accounting, Finance, Business Administration, Computer Science, or a related field.
• Alts: Exceptional professional experience (25+ years) in a senior audit or risk leadership role, demonstrating equivalent knowledge and capabilities, could be considered.
• Level: Preferred
• Req: A Master's degree (e.g., MBA, MSc in Finance, MSc in Cyber Security) from a reputable institution.
• Alts: N/A

Experience Requirements

You'll need at least 20 years of progressive experience in internal audit, external audit, risk management, or a related assurance function. This must include a minimum of 7-10 years in a senior leadership role (e.g., Director of Internal Audit, Head of Risk for a major business unit) within a large, complex, and ideally, global organisation. You'll have a proven track record of successfully managing large teams, presenting to Boards, and influencing executive-level decision-making. Experience in the Compliance, Quality, Health, and Safety sectors is absolutely essential.

Preferred Certifications

• Cert: Certified Information Systems Auditor (CISA)
• Prod: ISACA
• Usage: Demonstrates expertise in IT audit, which is crucial given the increasing reliance on technology and data in our operations and controls.
• Cert: Certified Fraud Examiner (CFE)
• Prod: ACFE
• Usage: Highlights expertise in fraud detection and investigation, which is a critical aspect of the CAE's oversight responsibilities.
• Cert: Relevant CQHS Certifications (e.g., NEBOSH Diploma, ISO Lead Auditor)
• Prod: Various (e.g., NEBOSH, BSI)
• Usage: Demonstrates deep, practical knowledge of Compliance, Quality, Health, and Safety management systems and regulations, which is core to this department.

Recommended Activities

• Active participation in global professional bodies (e.g., IIA, ISACA, ACCA), including serving on committees or speaking at conferences.
• Regular engagement with executive education programmes focused on corporate governance, strategic leadership, and emerging technologies (e.g., AI, cybersecurity).
• Mentoring rising audit talent, both within your organisation and externally, to foster the next generation of leaders.
• Staying current with thought leadership and research in internal audit, risk management, and relevant industry sectors.

Career Progression Pathways

Entry Paths to This Role

• Path: Director of Internal Audit (Large Global Organisation)
• Time: 5-7 years at Director level
• Path: Head of Risk / Chief Risk Officer (CRO)
• Time: 5-10 years in a CRO or senior risk leadership role
• Path: Senior Partner / Practice Leader (Big Four Audit Firm)
• Time: 10+ years at Partner level

Career Progression From This Role

• Pathway: Board Member / Non-Executive Director (NED)
• Time: 3-5 years post-CAE
• Pathway: Chief Risk Officer (CRO) / Chief Compliance Officer (CCO)
• Time: 2-4 years post-CAE

Long Term Vision Potential Roles

• Title: Independent Consultant / Advisor to Boards
• Time: 5-10 years post-CAE
• Title: Academic / Research Fellow in Governance & Risk
• Time: 5-10 years post-CAE
• Title: CEO of a Smaller / Growth Company
• Time: 5-10 years post-CAE

How Zavmo Delivers This Role's Development

DISCOVER Phase: Skills Gap Analysis

Zavmo maps your current competencies against all requirements in this job description through conversational assessment. We evaluate your foundation skills (communication, strategic thinking), functional skills (CRM expertise, negotiation), and readiness for career progression.

Output: Personalised skills gap heat map showing strengths and priorities, estimated time to competency, neurodiversity accommodations.

DISCUSS Phase: Personalised Learning Pathway

Based on your DISCOVER results, Zavmo creates a personalised learning plan prioritised by impact: foundation skills first, then functional skills. We adapt to your learning style, pace, and neurodiversity needs (ADHD, dyslexia, autism).

Output: Week-by-week schedule, each module linked to specific job responsibilities, checkpoints and milestones.

DELIVER Phase: Conversational Learning

Learn through conversation, not boring modules. Zavmo uses 10 conversation types (Socratic dialogue, role-play, coaching, case studies) to build competence. Practice difficult QBR presentations, negotiate tough renewals, and handle churn conversations in a safe AI environment before facing real clients.

Example: "For 'Stakeholder Mapping', Zavmo will guide you through analysing a complex enterprise account, identifying key decision-makers, and building an engagement strategy."

DEMONSTRATE Phase: Competency Assessment

Zavmo automatically builds your evidence portfolio as you learn. Every conversation, practice scenario, and application example is captured and mapped to NOS performance criteria. When ready, your portfolio supports OFQUAL qualification claims and demonstrates competence to employers.

Output: Competency matrix, evidence portfolio (downloadable), qualification readiness, career progression score.