The pathway
How you actually get there, here
How you become one varies far more by country than what one does. This is the UK route. Most people take one of these ways in; the right one depends on where you're starting from.
- 1
Lead, Audit Operations / Audit Operations Manager (Internal)
3-5 years in previous roleSkills to master
- Mastering enterprise-level GRC platform administration, leading complex audit analytics projects, managing a team of specialists, and demonstrating strong stakeholder management with senior internal teams.
You're ready to move on when
- Successfully led a major GRC system implementation or upgrade project.
- Consistently delivered on complex operational KPIs for the audit function.
- Recognised as a go-to expert for audit technology and process improvement.
- Demonstrated ability to mentor and develop team members effectively.
- 2
Senior Audit Manager / Director (from Big Four/Consulting)
5-8 years post-qualification in external audit or GRC consultingSkills to master
- Translating consulting experience into an in-house strategic leadership role, adapting to internal politics, building long-term internal relationships, and deep diving into specific financial services regulations.
You're ready to move on when
- Managed large audit engagements for financial services clients, including technology audit components.
- Advised clients on GRC strategy, internal controls, or audit transformation.
- Proven ability to manage client relationships at a senior executive level.
- Strong understanding of audit methodologies and regulatory expectations.
- 3
Head of GRC / Risk Operations (from another Financial Institution)
5-7 years in a similar leadership roleSkills to master
- Adapting to our specific organisational culture and existing technology landscape, quickly building credibility with our C-suite, and understanding the nuances of our internal audit function.
You're ready to move on when
- Successfully led a GRC or risk operations function in a comparable financial institution.
- Managed significant budgets and large teams.
- Demonstrated strategic thinking and delivered measurable improvements in risk or compliance processes.
- Strong network within the financial services industry for best practice sharing.