The pathway
How you actually get there, here
How you become one varies far more by country than what one does. This is the UK route. Most people take one of these ways in; the right one depends on where you're starting from.
- 1
Senior Risk & Compliance Officer (L3)
3-5 yearsSkills to master
- Leading complex reviews, mentoring junior analysts, challenging business stakeholders on control design, becoming a subject matter expert in a specific risk domain.
You're ready to move on when
- Consistently delivering high-quality risk assessments and control testing outcomes.
- Successfully leading small-to-medium sized projects or workstreams independently.
- Demonstrating strong influencing skills with business partners.
- Proactively identifying and proposing solutions to control weaknesses.
- 2
Internal Auditor (Senior/Manager level)
4-6 yearsSkills to master
- Deep understanding of control effectiveness testing, audit methodology, report writing, and stakeholder management during audit engagements. You'd bring a 'third line' perspective.
You're ready to move on when
- Proven ability to identify and articulate control deficiencies and their root causes.
- Strong track record of managing audit engagements and influencing auditees.
- Excellent understanding of governance, risk, and control processes.
- Desire to move from 'finding issues' to 'designing solutions'.
- 3
Consultant (Risk & Regulatory Advisory)
3-6 yearsSkills to master
- Experience advising multiple financial institutions on regulatory compliance, risk framework design, and remediation programmes. You'd bring broad industry exposure and problem-solving skills.
You're ready to move on when
- Experience delivering risk and compliance projects for various clients.
- Strong client-facing and presentation skills.
- Ability to quickly understand new business models and regulatory landscapes.
- Desire to focus on in-house implementation rather than external advisory.