The pathway
How you actually get there, here
How you become one varies far more by country than what one does. This is the UK route. Most people take one of these ways in; the right one depends on where you're starting from.
- 1
Senior Risk Assurance Associate (Internal)
3-5 years as Senior AssociateSkills to master
- Leading end-to-end workstreams, making independent technical decisions, informal mentorship of new joiners, strong stakeholder communication on findings.
You're ready to move on when
- Consistently delivers complex assurance projects on time and to a high standard.
- Proactively identifies and resolves project roadblocks without constant supervision.
- Receives positive feedback from business stakeholders on their engagement and ability to influence.
- Has successfully mentored at least two junior analysts through a full project cycle.
- 2
Senior Internal Auditor (External Hire)
5-8 years in a Big Four or similar consulting firmSkills to master
- Adapting to our internal culture and systems, translating external audit methodologies to an in-house assurance function, building internal stakeholder relationships.
You're ready to move on when
- Proven track record of managing audit engagements for large clients.
- Strong understanding of SOX and financial reporting controls from an external perspective.
- Demonstrated ability to lead small audit teams and manage client expectations.
- Quickly grasps our company's specific business processes and risk appetite.
- 3
Financial Controls Lead (External Hire)
6-10 years in a dedicated financial controls functionSkills to master
- Bringing a 'first line' or 'second line' perspective to risk assurance, understanding control design from an operational standpoint, managing control documentation and self-assessment processes.
You're ready to move on when
- Deep expertise in designing and implementing internal controls.
- Experience with control self-assessment programmes and remediation tracking.
- Familiarity with GRC platforms from a user/administrator perspective.
- Ability to articulate the operational impact of control weaknesses.