The pathway
How you actually get there, here
How you become one varies far more by country than what one does. This is the UK route. Most people take one of these ways in; the right one depends on where you're starting from.
- 1
From Senior Compliance Monitoring Specialist (L3)
2-4 years as an L3Skills to master
- You'd have mastered complex thematic reviews, drafted initial findings reports, and started mentoring junior analysts. To step up, you'd need to show you can design an entire monitoring workstream, handle more ambiguous problems, and start influencing stakeholders at a higher level.
You're ready to move on when
- Consistently delivering high-quality, complex monitoring reviews independently.
- Proactively identifying systemic control weaknesses, not just individual findings.
- Demonstrating strong communication and influence skills with business unit managers.
- Successfully mentoring 2+ junior team members and taking ownership of their development.
- 2
From Internal Audit Senior/Manager
3-5 years in a senior audit roleSkills to master
- You'd bring strong control testing and assurance skills. You'd need to adapt to the 'Second Line' perspective – focusing on proactive monitoring and credible challenge rather than just independent assurance. Understanding regulatory nuances and the specifics of compliance frameworks would be key.
You're ready to move on when
- Deep expertise in control testing methodologies and risk assessment.
- Experience managing audit engagements and leading small teams.
- A strong desire to specialise in regulatory compliance and proactive risk mitigation.
- Ability to pivot from a 'Third Line' to a 'Second Line' mindset, focusing on design and challenge.
- 3
From Risk & Control Lead (First Line)
4-6 years in a First Line risk roleSkills to master
- You'd have an excellent understanding of business processes and inherent risks. You'd need to develop a more independent, challenging mindset, moving from owning the controls to monitoring their effectiveness. Building expertise in specific compliance regulations and monitoring tools would be crucial.
You're ready to move on when
- Proven track record of designing and implementing effective controls within a business unit.
- Strong understanding of operational risks and how they manifest.
- Desire to move into an oversight/assurance function.
- Demonstrable ability to analyse and interpret regulatory requirements.