Senior CQHS Internal Auditor

Role Purpose & Context

Role Summary

As a Senior CQHS Internal Auditor, you'll be leading our audit engagements from start to finish. This means you'll plan the audit, manage the day-to-day work, supervise our junior team members, and then draft the final report. You're not just executing; you're orchestrating. You'll be the one making sure we're focusing on the right risks, especially when it comes to quality, health, safety, and environmental compliance across our operations. Your work directly impacts our ability to avoid hefty fines, prevent accidents, and maintain our reputation for quality. When you do this well, our control environment gets stronger, and our business leaders can sleep a bit easier knowing risks are being managed. If it's not done well, we could face regulatory breaches, operational disruptions, or even serious safety incidents. The tricky part is often getting busy operational teams to see the value in what we do and to provide the information we need, sometimes under tight deadlines. The reward? Knowing you've genuinely helped protect our colleagues, our customers, and the company's future.

Reporting Structure

• Reports to: Lead CQHS Auditor
• Direct reports: None, but you'll mentor 1-2 junior auditors or associates on specific engagements.
• Matrix relationships: Senior Internal Audit Analyst (CQHS), Senior Compliance Auditor, Senior Quality Systems Auditor, Lead Assurance Professional (CQHS),

Key Stakeholders

Internal:

• Lead CQHS Auditor and other Senior Auditors
• Business Unit Managers (e.g., Head of Operations, Quality Manager, EHS Lead)
• Legal and Compliance Teams
• Risk Management Function
• Junior Internal Audit team members

External:

• External Auditors (providing support and information)
• Regulatory bodies (indirectly, through ensuring compliance)

Organisational Impact

Scope: You're directly responsible for ensuring the effectiveness of controls that protect our organisation from significant compliance breaches, quality failures, and health & safety incidents. Your findings and recommendations help shape operational improvements and reduce our overall risk exposure, which, frankly, saves us money and keeps people safe.

Performance Metrics

Quantitative Metrics

1. Metric: Audit Project Delivery within Budget
2. Desc: The percentage of audits you lead that are completed within the allocated budget (both time and resources).
3. Target: 90% of audits within ±10% of budgeted hours
4. Freq: Per audit engagement, reviewed quarterly
5. Example: If an audit was budgeted for 120 hours and you complete it in 115 hours, that's a win. If it takes 150 hours due to unforeseen issues, we'll need a clear explanation, but it still counts towards the metric.
6. Metric: Finding Acceptance Rate
7. Desc: The percentage of your draft audit findings that management accepts without significant changes to the condition, cause, or consequence.
8. Target: 80% acceptance rate
9. Freq: Per audit report, reviewed quarterly
10. Example: You present 10 findings in a draft report. If 8 are accepted as-is and 2 require minor wording tweaks (not changing the core issue), that's 80% acceptance. If management disputes the core issue on 3, you're below target.
11. Metric: Remediation Plan Progress Tracking
12. Desc: The effectiveness of your follow-up on management's agreed-upon remediation plans for your audit findings.
13. Target: 90% of high-risk remediation plans tracked to closure by due date
14. Freq: Ongoing, reviewed monthly
15. Example: You've identified a critical safety control gap. Management agrees to fix it by 30 June. You'll need to chase them, get evidence, and confirm it's fixed by that date. If it slips, we need to know why and what the new plan is.
16. Metric: Junior Auditor Mentorship & Development
17. Desc: The successful onboarding and development of junior auditors or associates working on your engagements.
18. Target: Successfully mentor 1-2 junior auditors per year, evidenced by their improved work quality and positive feedback.
19. Freq: Annually, through performance reviews and 360-degree feedback
20. Example: You guide a new associate through their first PBC list and walkthrough. By the end of the audit, they're independently drafting basic test steps and can explain their work. That's a clear sign of good mentorship.

Qualitative Metrics

1. Metric: Stakeholder Engagement & Collaboration
2. Desc: How well you build rapport and work with auditees, even when delivering tough news. It's about being seen as a partner, not just the 'internal police'.
3. Evidence: Auditees proactively reach out for advice; positive feedback in post-audit surveys (yes, we do those); willingness of business units to share information openly; you're invited to pre-audit discussions, not just dropped in.
4. Metric: Clarity and Impact of Communication
5. Desc: Your ability to explain complex audit findings and their implications clearly, concisely, and in a way that resonates with different audiences (from the shop floor to senior management).
6. Evidence: Audit reports are easy to read and understand; management 'gets it' quickly during closing meetings; you can simplify technical jargon into plain English; your recommendations are practical and actionable, not just academic.
7. Metric: Proactive Risk Identification
8. Desc: Your knack for spotting potential risks or control weaknesses that weren't explicitly on the audit plan, but are critical to the business.
9. Evidence: You bring new, relevant risks to the attention of the Lead Auditor or management during an engagement; you suggest adjustments to the audit scope based on new information; you're thinking beyond the immediate task.
10. Metric: Professional Judgement & Skepticism
11. Desc: Your ability to apply sound judgement in complex situations, challenge assumptions respectfully, and maintain a healthy level of professional skepticism throughout the audit process.
12. Evidence: You push back appropriately when evidence doesn't stack up; you can justify your conclusions with solid reasoning; you don't take things at face value, especially when the stakes are high; you identify and flag potential conflicts of interest.

Primary Traits

• Trait: Professional Skepticism
• Manifestation: You're the person who always asks 'How do we *know* that?' or 'Can you show me the evidence?' You don't just accept 'that's how we've always done it' as a valid control explanation. You'll independently verify information, even if it means digging a bit deeper, rather than taking things at face value. Frankly, you're a bit of a polite cynic when it comes to controls.
• Benefit: This trait is the absolute bedrock of auditing, especially in CQHS. Without it, you're just a process checker, not an auditor. It's what allows you to uncover a falsified safety log, realise a critical quality check is being 'pencil-whipped', or spot a compliance gap that everyone else has missed. Our job is to provide independent assurance, and that means not being afraid to challenge.
• Trait: Diplomatic Tenacity
• Manifestation: You're great at following up on overdue evidence requests without coming across as aggressive or annoying. You can respectfully challenge a senior executive's explanation when it simply doesn't match the evidence you've found. You'll hold firm on the risk rating of a finding, even when there's pushback, but you'll do it in a way that keeps the relationship intact. It's about being firm but fair, always.
• Benefit: Auditors constantly need information from people who are often busy, sometimes defensive, or occasionally uncooperative. This trait lets you build rapport and get what you need to complete the audit without burning bridges or being seen as the 'enemy'. You need to be able to push for the truth without causing a major incident, which is a real art.
• Trait: Structured Thinking
• Manifestation: You're excellent at breaking down a massive regulation, like the HSE's Control of Substances Hazardous to Health (COSHH) regulations, into manageable, auditable components. You can create a logical Risk and Control Matrix (RACM) from a messy, narrative process document. You'll clearly link a specific control failure back to a major business risk, making it clear why it matters.
• Benefit: CQHS is a world of complex, interconnected processes, regulations, and standards. The ability to bring order to this chaos is absolutely essential. It helps you develop a logical audit plan, execute it efficiently, and communicate your findings in a way that makes immediate sense to leadership. Without this, you'd just be swimming in an ocean of information with no compass.

Supporting Traits

• Trait: Inquisitive
• Desc: You have a genuine, almost childlike curiosity about how things actually work, not just how they're supposed to work. You love to ask 'why?' until you get to the real answer.
• Trait: Resilient
• Desc: You can handle confrontation, pushback, and sometimes bad news (both giving and receiving it) professionally. You don't take things personally and can bounce back quickly.
• Trait: Ethical
• Desc: You have an unwavering commitment to integrity and doing the right thing, even when under pressure or when it's unpopular. Your moral compass is always pointing true north.
• Trait: Articulate
• Desc: You can explain complex technical issues, regulatory requirements, and audit findings clearly and concisely to people who aren't auditors or technical experts. You're a great translator.

Primary Motivators

1. Motivator: Making a Tangible Difference
2. Daily: You'll feel a real sense of accomplishment when your audit findings lead to a genuine improvement in safety procedures or a critical compliance gap being closed. You want your work to actually matter, not just sit on a shelf.
3. Motivator: Solving Complex Puzzles
4. Daily: You love the challenge of piecing together disparate pieces of evidence, interviewing different people, and digging through data to uncover the root cause of an issue. It's like being a detective every day.
5. Motivator: Ensuring Fairness and Integrity
6. Daily: You're driven by the desire to ensure processes are followed fairly, rules are adhered to, and that the company operates with the highest level of integrity. You're a guardian of good governance.

Potential Demotivators

Honestly, this role isn't for everyone. You'll often find yourself chasing people for information, and sometimes they'll 'slow-walk' you, waiting until the last minute to provide what you need, which can really compress your testing timeline. You might also present a clear, high-risk finding, only to face pressure from senior management to downgrade it to 'medium' before it ever gets to the Audit Committee. That can be incredibly frustrating if you're passionate about the truth.

Common Frustrations

1. The 'Internal Police' Stigma: Constantly fighting the perception that you're there to get people in trouble, rather than to improve the process and protect the company.
2. Repeat Findings: Presenting the same finding you wrote last year because management agreed to a remediation plan but never actually implemented it.
3. Documentation vs. Reality: Spending days auditing a process based on the official procedure, only to discover in a walkthrough that 'nobody actually does it that way' on the shop floor.
4. Scope Creep: An audit of a simple process uncovers a major, unexpected issue, and suddenly your two-week engagement balloons into a two-month investigation that you're not staffed for.
5. The 'Value-Add' Pressure: The constant expectation to provide 'value-add' business insights on top of the core assurance work, often with no extra time or resources, which can feel like an impossible ask.

What Role Doesn't Offer

1. A quiet, predictable routine with no surprises. Auditing is inherently about finding the unexpected.
2. Immediate, universal popularity. You're often asking tough questions, which isn't always a recipe for being everyone's favourite person.
3. A direct path to operational leadership. While you'll learn a lot about operations, this role is about assurance, not running the business day-to-day.

ADHD Positives

1. The varied nature of audit engagements (different processes, different teams, different risks) can be really engaging and prevent boredom.
2. The need for intense focus during fieldwork and detailed analysis can be a strength, allowing for deep dives into specific issues.
3. The problem-solving aspect, especially uncovering root causes, can be highly stimulating and rewarding.

ADHD Challenges and Accommodations

1. Managing multiple audit projects and deadlines simultaneously can be challenging; we use structured project management tools and offer regular check-ins to help keep you on track.
2. Detailed documentation requirements can feel tedious; we use templates and offer tools to streamline this, and you can pair with juniors for support.
3. Long meetings can be difficult; we encourage breaks, active participation, and providing agendas in advance so you know what to expect.

Dyslexia Positives

1. Strong verbal communication skills, especially during walkthroughs and interviews, are highly valued.
2. Excellent spatial reasoning and 'big picture' thinking can help identify systemic issues that others might miss.
3. The ability to connect seemingly unrelated pieces of information is a real asset in root cause analysis.

Dyslexia Challenges and Accommodations

1. Extensive report writing and review notes can be demanding; we offer proofreading support, use structured templates, and encourage dictation software.
2. Reading dense regulatory documents can be tough; we use summarisation tools (like AI, more on that below) and provide verbal briefings.
3. Detailed workpaper documentation requires precision; we use clear templates, offer spell-check and grammar tools, and allow for peer review.

Autism Positives

1. A strong adherence to processes, rules, and regulations is a significant advantage in compliance auditing.
2. Exceptional attention to detail, especially in identifying inconsistencies or anomalies in data and documentation, is crucial.
3. The ability to maintain professional skepticism and focus on objective evidence, rather than social dynamics, is highly valued.

Autism Challenges and Accommodations

1. Navigating complex social dynamics during interviews or negotiations with auditees can be challenging; we offer coaching, clear communication guidelines, and opportunities for written communication where appropriate.
2. Unexpected changes in audit scope or timelines can be disruptive; we aim for clear planning and provide as much advance notice as possible for changes.
3. Sensory overload in busy office environments; we offer noise-cancelling headphones, flexible working arrangements, and quiet spaces for focused work.

Key Responsibilities

Experience Levels Responsibilities

1. Level: Senior CQHS Internal Auditor (OFQUAL Level 6-7)
2. Responsibilities: Lead individual audit engagements end-to-end, from planning and risk assessment through to reporting and follow-up. This means you're the main point of contact for the auditee during the engagement.
3. Develop comprehensive audit programmes and detailed test plans for each engagement, making sure we're covering the highest risks and meeting our objectives. You'll need to think critically about what to test and how.
4. Supervise and mentor 1-2 junior auditors or associates during fieldwork. You'll review their work, provide constructive feedback, and help them develop their skills. Think of yourself as their guide on the audit journey.
5. Execute complex audit testing procedures yourself, especially for higher-risk or more nuanced areas. This isn't just delegating; you'll still be getting your hands dirty with the data and evidence.
6. Conduct in-depth process walkthroughs with business owners, mapping out how things actually work and identifying key control points and potential weaknesses. You'll be asking a lot of 'how' and 'why' questions.
7. Draft clear, concise, and commercially relevant audit findings using the '5 C's' (Criteria, Condition, Cause, Consequence, Corrective Action). You'll then validate these findings with management to ensure factual accuracy and buy-in.
8. Present your audit findings and recommendations to business unit management during closing meetings. This often involves some polite negotiation and a good dose of diplomatic tenacity to ensure the message lands correctly.
9. Track and follow up on the implementation of agreed-upon remediation plans, making sure that management actually fixes the issues you've identified. This can involve a fair bit of chasing, honestly.
10. Supervision: You'll have bi-weekly check-ins with your Lead CQHS Auditor for strategic alignment and to discuss any complex issues. For the day-to-day execution of your audits, you're largely autonomous, but you'll know when to flag something that needs a second opinion.
11. Decision: You have full technical decision-making authority within the scope of your assigned audit engagements (e.g., selecting specific testing methodologies, determining sample sizes, drafting finding severity). You'll recommend changes to audit scope or budget if significant issues arise, but these need approval from your Lead Auditor. For anything above a £5K impact, you'll consult your Lead. You're responsible for the quality of your workpapers and the findings you report.
12. Success: Success here means delivering high-quality audit reports on time and within budget, with findings that are accepted by management and lead to real improvements. It also means effectively developing the junior team members working with you, helping them grow into confident auditors.

Decision-Making Authority

• Type: Audit Scope Definition
• Entry: Proposes minor adjustments to scope for individual test steps, reviewed by Senior Auditor.
• Mid: Proposes adjustments to a section of the audit scope based on preliminary findings, reviewed by Senior Auditor.
• Senior: Defines the detailed scope for an entire audit engagement, including key areas of focus and exclusions, in consultation with the Lead Auditor.
• Type: Audit Finding Severity Rating
• Entry: Identifies potential issues and suggests a severity rating, which is then reviewed and confirmed by the Senior Auditor.
• Mid: Assesses the severity of individual findings based on established criteria and proposes a rating, which is reviewed by the Senior Auditor.
• Senior: Determines the final severity rating for all findings within an engagement, justifying the rationale to management and the Lead Auditor.
• Type: Remediation Plan Approval
• Entry: Documents management's proposed remediation actions for review by Senior Auditor.
• Mid: Evaluates proposed remediation plans for feasibility and effectiveness, suggesting improvements to management, and then presents to Senior Auditor for approval.
• Senior: Approves the final remediation plans with management, ensuring they adequately address the identified risks, and tracks their implementation.
• Type: Methodology & Tool Selection
• Entry: Uses pre-defined tools and methodologies as instructed by the Senior Auditor.
• Mid: Selects appropriate tools and methodologies for routine testing procedures within established guidelines.
• Senior: Chooses the most effective audit methodologies and tools for complex or non-routine engagements, justifying the choice to the Lead Auditor if it's a significant departure from standard practice.

Competency Requirements

Foundation Skills (Transferable)

These are the bedrock skills that every Senior Auditor needs, regardless of the specific audit area. They're about how you think, how you communicate, and how you get things done effectively.

• Category: Communication & Influence
• Skills: Active Listening: Genuinely hearing what auditees are saying (and not saying) during interviews and walkthroughs, picking up on nuances and underlying concerns.
• Clear & Concise Writing: Drafting audit reports and findings that are easy to understand, impactful, and free of jargon, even when dealing with complex technical or regulatory issues.
• Presentation Skills: Confidently presenting audit findings and recommendations to various levels of management, being able to articulate the 'so what' and handle tough questions.
• Negotiation & Persuasion: Effectively discussing and agreeing on audit findings and remediation plans with auditees, sometimes needing to hold firm on your position while maintaining a good relationship.
• Category: Problem-Solving & Analytical Thinking
• Skills: Critical Thinking: Analysing complex processes and data to identify underlying control weaknesses, root causes, and potential risks, rather than just spotting symptoms.
• Root Cause Analysis (RCA): Applying structured techniques (like 5 Whys or Fishbone diagrams) to get beyond the immediate issue and understand why a control failed.
• Risk Assessment: Evaluating the likelihood and impact of identified risks, prioritising them, and linking them back to business objectives and regulatory requirements.
• Data Interpretation: Drawing meaningful conclusions from various data sources (numerical, textual, observational) to support audit findings and recommendations.
• Category: Adaptability & Resilience
• Skills: Managing Ambiguity: Comfortably working in situations where information is incomplete or processes aren't perfectly defined, and still being able to form sound judgements.
• Handling Pressure: Maintaining composure and effectiveness when facing tight deadlines, unexpected challenges, or difficult conversations with auditees.
• Flexibility: Adjusting audit plans and approaches in response to new information, changing business priorities, or emerging risks.
• Constructive Feedback: Both giving and receiving feedback effectively, using it to improve your own work and to develop junior team members.
• Category: Leadership & Mentorship
• Skills: Project Management: Planning, organising, and overseeing audit engagements from start to finish, ensuring they stay on track and deliver quality outcomes.
• Team Guidance: Providing clear direction, support, and coaching to junior auditors, helping them understand their tasks and grow their capabilities.
• Delegation: Assigning tasks effectively to junior team members, ensuring they have the right level of challenge and support.
• Conflict Resolution: Mediating minor disagreements or misunderstandings within the audit team or with auditees to keep things moving forward constructively.

Functional Skills (Role-Specific Technical)

These are the specific methodologies, technical abilities, and industry knowledge you'll need to excel in a CQHS internal audit role at a senior level. It's about knowing the 'how' and the 'what' of our specific domain.

Technical Competencies

• Skill: Risk-Based Auditing
• Desc: The core methodology of focusing audit resources on the areas of highest inherent risk to the organisation, rather than just a 'check-the-box' compliance approach. You'll be designing audits based on risk.
• Level: Advanced
• Skill: COSO Framework Application
• Desc: A deep understanding of the Committee of Sponsoring Organizations (COSO) framework for internal control and the ability to map CQHS processes (e.g., incident management, quality control) to its five components and seventeen principles. You'll use this as your control bible.
• Level: Advanced
• Skill: ISO Standards Auditing (9001, 14001, 45001)
• Desc: Expert knowledge of the requirements for Quality (ISO 9001), Environmental (ISO 14001), and Occupational Health & Safety (ISO 45001) management systems. You'll be able to audit for conformance and identify systemic non-conformities.
• Level: Advanced
• Skill: Process Mapping & Walkthroughs
• Desc: The skill of deconstructing a complex operational process (e.g., hazardous material handling, product recall procedure) through interviews and observation, documenting the flow, and identifying key control points and potential failure modes. You'll be the one doing these.
• Level: Advanced
• Skill: Audit Report Writing & Issue Validation
• Desc: The ability to articulate complex findings clearly, concisely, and commercially. This includes drafting findings with the five C's (Criteria, Condition, Cause, Consequence, Corrective Action) and validating them with management to ensure factual accuracy. Your reports need to be impactful.
• Level: Advanced

Digital Tools

• Tool: GRC Platform (e.g., Intelex, LogicGate, ServiceNow GRC)
• Level: Advanced
• Usage: Configuring audit modules, building risk and control matrices (RACMs), designing automated workflows for issue tracking, and training business users on how to interact with the system for evidence requests and remediation tracking.
• Tool: Audit Analytics (e.g., Galvanize/Diligent, IDEA)
• Level: Expert
• Usage: Writing complex custom scripts from scratch to identify anomalies, performing Benford's analysis on expense reports related to CQHS spend, or joining disparate datasets for deeper analysis of incident trends or compliance breaches.
• Tool: EHS/QMS Software (e.g., Enablon, Cority, MasterControl)
• Level: Advanced
• Usage: Auditing the system's configuration and access controls, identifying gaps between system capabilities and regulatory requirements, and extracting detailed data for testing (e.g., CAPA records, incident reports, permit documentation).
• Tool: Data Visualization (e.g., Power BI, Tableau)
• Level: Advanced
• Usage: Building interactive dashboards to visualise audit findings for management, showing trends in control failures, overdue remediation plans, or hotspots for safety incidents. You'll make the data tell a story.
• Tool: Advanced Excel (Power Query, Power Pivot, VBA)
• Level: Advanced
• Usage: Using Power Query to clean and transform messy data from legacy systems for audit analysis, building data models in Power Pivot for complex calculations, and debugging simple VBA macros for data manipulation.

Industry Knowledge

• Area: CQHS Regulatory Landscape (UK & EU)
• Desc: A solid understanding of key UK and EU regulations related to health and safety (e.g., HSE legislation), environmental protection (e.g., EPA, WEEE, RoHS), and quality management. You'll need to know what 'good' looks like in these areas.
• Area: Operational Processes & Risks
• Desc: Familiarity with various operational processes within manufacturing, logistics, or service delivery environments, and the inherent CQHS risks associated with them (e.g., hazardous waste disposal, machinery safety, food hygiene, data privacy in health records).
• Area: Internal Control Principles
• Desc: A deep grasp of internal control principles and how they apply to prevent, detect, and correct errors or non-compliance in CQHS processes. You'll be looking for where controls break down.

Regulatory Compliance Regulations

• Reg: Health and Safety at Work etc. Act 1974 (UK)
• Usage: Applying the principles to audit an organisation's safety management system, risk assessments, and incident reporting, identifying gaps against legal duties.
• Reg: Environmental Permitting Regulations (England and Wales) 2016
• Usage: Auditing compliance with specific environmental permits, waste management procedures, and pollution control measures.
• Reg: Control of Substances Hazardous to Health (COSHH) Regulations 2002 (UK)
• Usage: Assessing the effectiveness of controls around the handling, storage, and disposal of hazardous substances, including risk assessments and employee training.
• Reg: General Data Protection Regulation (GDPR) (EU & UK)
• Usage: Understanding how GDPR impacts the handling of personal data within CQHS processes (e.g., employee health records, incident reports containing personal information) and auditing for compliance.

Essential Prerequisites

• At least 5 years of experience in internal audit, external audit (with a focus on operational/compliance audits), or a dedicated Compliance, Quality, Health & Safety role.
• Proven experience leading audit engagements or significant workstreams, including planning, fieldwork, and reporting.
• A solid understanding of risk-based auditing methodologies and internal control frameworks (e.g., COSO).
• Demonstrable experience with at least one GRC platform and strong analytical skills using tools like Excel (Power Query/Pivot) or basic audit analytics software.
• Excellent written and verbal communication skills, with a knack for explaining complex issues clearly to non-technical audiences.

Career Pathway Context

We're looking for someone who isn't just good at following a checklist, but who can actually design the checklist, lead the team using it, and then explain what it all means. You'll have built up your audit muscles and are ready to take on more responsibility and autonomy.

Qualifications & Credentials

Emerging Foundation Skills

• Skill: Advanced Data Storytelling & Visualisation
• Why: Auditors are increasingly expected to do more than just present facts; they need to tell a compelling story with data that resonates with busy executives. Static reports are out; interactive, insightful dashboards are in. This is critical within 12 months.
• Concepts: [{'concept_name': 'Narrative Structure in Data', 'description': 'Learning how to build a logical flow from data points to insights to recommendations, much like a good story.'}, {'concept_name': 'Choosing the Right Visualisation', 'description': 'Understanding which chart type best communicates a specific message (e.g., trend, comparison, distribution) and avoiding misleading visuals.'}, {'concept_name': 'Interactive Dashboard Design', 'description': 'Designing dashboards that allow users to explore data themselves, answering their own questions without needing to ask you.'}, {'concept_name': 'Ethical Data Presentation', 'description': "Ensuring visualisations are accurate, unbiased, and don't inadvertently misrepresent the data."}]
• Prepare: This month: Start experimenting with advanced features in Power BI or Tableau. Try building a dashboard for a past audit finding.
• Month 2: Take an online course on data storytelling. There are loads of free ones on platforms like Coursera or edX.
• Month 3: Present a complex audit finding using only visuals and a narrative, rather than bullet points, to your Lead Auditor for feedback.
• Month 4: Seek opportunities to present data in a more engaging, visual way in team meetings or smaller stakeholder sessions.
• QuickWin: When you're drafting your next audit report, challenge yourself to replace at least one paragraph of text with a well-designed chart or infographic that tells the same story more effectively.

Advancing Technical Skills

• Skill: Prompt Engineering & LLM Integration for Audit
• Why: Competitors are already using Large Language Models (LLMs) to draft reports or summarise regulations in a fraction of the time it used to take. Auditors who figure this out will outproduce their peers, allowing for more time on critical thinking. This is critical within 6 months—it's already here.
• Concepts: [{'concept_name': 'Context Windows and Token Limits', 'description': 'Understanding how much information an LLM can process at once and how to manage it effectively for audit documents.'}, {'concept_name': 'Temperature Settings for Different Tasks', 'description': 'Knowing when to use more creative (higher temperature) versus more factual (lower temperature) outputs for audit tasks.'}, {'concept_name': 'RAG Architectures for Proprietary Data', 'description': 'Learning how to securely feed internal audit policies, workpaper templates, or specific company data into an LLM for more accurate, context-specific outputs without compromising confidentiality.'}, {'concept_name': 'Output Validation and Hallucination Detection', 'description': "Crucially, understanding that LLMs can 'make things up' and developing robust methods to verify every piece of information they generate for audit purposes."}]
• Prepare: This week: Set up a secure, company-approved LLM (like a private instance of ChatGPT or Claude) and use it to draft email summaries or meeting notes for your current audit.
• This month: Experiment with using an LLM to summarise a new regulatory update or to draft a first pass at a simple audit finding, then compare it to your own writing.
• Month 2: Explore how to use prompt chaining to break down complex audit questions into smaller, LLM-manageable steps.
• Month 3: Document your productivity gains and any challenges, then share your learnings with the wider audit team.
• QuickWin: Start using an LLM today to generate alternative wordings for your audit findings or to brainstorm potential root causes. It's a low-risk way to get started and see immediate benefits.
• Skill: Auditing Cloud Environments & IoT Devices
• Why: Our operational technology and data storage are increasingly moving to the cloud and integrating with IoT devices (e.g., sensors for environmental monitoring, smart safety equipment). You'll need to know how to audit these new, complex environments for CQHS risks. This is important within 12-18 months.
• Concepts: [{'concept_name': 'Cloud Security Frameworks (e.g., CSA CCM)', 'description': 'Understanding the specific control considerations for data stored and processed in cloud environments relevant to CQHS data (e.g., health records, incident data).'}, {'concept_name': 'IoT Device Lifecycle Auditing', 'description': 'Auditing the security, data integrity, and privacy controls from device deployment to decommissioning for sensors and smart equipment.'}, {'concept_name': 'Data Flow Mapping in Cloud/IoT', 'description': 'Tracing how CQHS-related data moves through cloud services and IoT networks to identify potential vulnerabilities or compliance gaps.'}, {'concept_name': 'Third-Party Cloud Provider Assurance', 'description': 'Understanding how to review and rely on assurance reports (e.g., SOC 2) from our cloud service providers.'}]
• Prepare: This month: Read up on basic cloud computing concepts (AWS/Azure fundamentals) and how they relate to data storage and security.
• Month 2: Take an introductory course on IoT security or cloud auditing. Many vendors offer free entry-level certifications.
• Month 3: Shadow a member of our IT security team to understand how they manage cloud environments or IoT devices.
• Month 4: Propose a mini-audit or risk assessment of a small cloud-based CQHS system or an IoT deployment within the company.
• QuickWin: Familiarise yourself with the basic architecture of our company's cloud deployments and identify any CQHS data that resides there. Start asking questions about its security.

Education Requirements

• Level: Minimum
• Req: A Bachelor's degree (or equivalent OFQUAL Level 6 qualification) in Accounting, Finance, Business, Engineering, Environmental Science, Occupational Health & Safety, or a related field.
• Alts: We're pragmatic here. If you've got significant, demonstrable experience (8+ years) in a relevant audit or CQHS role, especially with recognised professional certifications, we're happy to consider that as equivalent.
• Level: Preferred
• Req: A Master's degree (or equivalent OFQUAL Level 7 qualification) in a relevant discipline, or a professional qualification like the CIA (Certified Internal Auditor).
• Alts: While not strictly required, these show a commitment to the profession and a deeper theoretical understanding, which is always a plus.

Experience Requirements

You'll need at least 5-8 years of progressive experience in internal audit, external audit (with a focus on operational or compliance audits), or a dedicated Compliance, Quality, Health & Safety role. This should include demonstrable experience leading audit engagements or significant workstreams, managing junior team members, and drafting comprehensive audit reports. We're looking for someone who's been in the trenches and knows how to run an audit from start to finish.

Preferred Certifications

• Cert: Certified Internal Auditor (CIA)
• Prod: Institute of Internal Auditors (IIA)
• Usage: This is the gold standard for internal auditors, demonstrating a broad understanding of the profession's principles and practices. It tells us you're serious about this career.
• Cert: Certified Information Systems Auditor (CISA)
• Prod: ISACA
• Usage: Given the increasing reliance on IT systems for CQHS data and controls, a CISA shows you can audit those critical systems effectively. It's becoming more and more valuable.
• Cert: ISO Lead Auditor (e.g., ISO 9001, ISO 14001, ISO 45001)
• Prod: Various accredited bodies (e.g., IRCA)
• Usage: This certification proves you can lead audits against specific quality, environmental, or health & safety management system standards, which is a big part of what we do here.
• Cert: Certified Compliance & Ethics Professional (CCEP)
• Prod: Society of Corporate Compliance and Ethics (SCCE)
• Usage: Demonstrates a solid understanding of compliance programme management, risk assessment, and ethical considerations, which are all highly relevant to our work.

Recommended Activities

• Regularly attend industry webinars and conferences focused on CQHS regulations and best practices (e.g., IIA UK & Ireland events, IOSH conferences, IEMA events).
• Participate in professional networking groups for auditors or CQHS professionals to share insights and learn from peers.
• Take online courses or workshops on advanced data analytics, AI applications in audit, or specific regulatory updates.
• Seek out internal projects or secondments that expose you to different operational areas or complex risk scenarios within the company.

Career Progression Pathways

Entry Paths to This Role

• Path: Mid-Level CQHS Internal Auditor (L2)
• Time: 2-3 years
• Path: External Audit Senior (Operational/Compliance Focus)
• Time: 3-5 years
• Path: Senior Compliance or Quality Analyst
• Time: 4-6 years

Career Progression From This Role

• Pathway: Lead CQHS Auditor (L4)
• Time: 3-5 years

Long Term Vision Potential Roles

• Title: Internal Audit Manager (CQHS) (L5)
• Time: 5-8 years
• Title: Director of Internal Audit (L6)
• Time: 8-12 years
• Title: Chief Audit Executive (CAE) (L7)
• Time: 12-15+ years
• Title: Head of Regulatory Compliance (Specialist Path)
• Time: 5-10 years

How Zavmo Delivers This Role's Development

DISCOVER Phase: Skills Gap Analysis

Zavmo maps your current competencies against all requirements in this job description through conversational assessment. We evaluate your foundation skills (communication, strategic thinking), functional skills (CRM expertise, negotiation), and readiness for career progression.

Output: Personalised skills gap heat map showing strengths and priorities, estimated time to competency, neurodiversity accommodations.

DISCUSS Phase: Personalised Learning Pathway

Based on your DISCOVER results, Zavmo creates a personalised learning plan prioritised by impact: foundation skills first, then functional skills. We adapt to your learning style, pace, and neurodiversity needs (ADHD, dyslexia, autism).

Output: Week-by-week schedule, each module linked to specific job responsibilities, checkpoints and milestones.

DELIVER Phase: Conversational Learning

Learn through conversation, not boring modules. Zavmo uses 10 conversation types (Socratic dialogue, role-play, coaching, case studies) to build competence. Practice difficult QBR presentations, negotiate tough renewals, and handle churn conversations in a safe AI environment before facing real clients.

Example: "For 'Stakeholder Mapping', Zavmo will guide you through analysing a complex enterprise account, identifying key decision-makers, and building an engagement strategy."

DEMONSTRATE Phase: Competency Assessment

Zavmo automatically builds your evidence portfolio as you learn. Every conversation, practice scenario, and application example is captured and mapped to NOS performance criteria. When ready, your portfolio supports OFQUAL qualification claims and demonstrates competence to employers.

Output: Competency matrix, evidence portfolio (downloadable), qualification readiness, career progression score.