The pathway
How you actually get there, here
How you become one varies far more by country than what one does. This is the UK route. Most people take one of these ways in; the right one depends on where you're starting from.
- 1
From Risk & Control Analyst (L1)
2-3 yearsSkills to master
- Independent control testing, basic process walkthroughs, clear issue documentation, and effective communication with operational teams.
You're ready to move on when
- Consistently meets or exceeds control test completion and accuracy targets.
- Can identify valid, actionable control issues without constant supervision.
- Receives positive feedback from operational teams on collaboration and communication.
- Demonstrates a solid understanding of core operational processes and associated risks.
- 2
From Operations Team Lead / Supervisor
3-5 yearsSkills to master
- Formal risk assessment methodologies (like COSO), structured control testing, and translating operational experience into risk language.
You're ready to move on when
- Has a deep, practical understanding of operational processes and their inherent risks.
- Has experience identifying and solving operational problems, even if not framed as 'risk management'.
- Can clearly articulate process flows and potential failure points.
- Shows a keen interest in moving from 'doing' to 'assuring' operational quality.
- 3
From Junior Internal Auditor
2-4 yearsSkills to master
- Deepening operational process knowledge, building collaborative relationships (less 'audit-y'), and focusing on proactive risk identification rather than just reactive testing.
You're ready to move on when
- Strong foundation in control testing and audit methodologies.
- Proven ability to identify control weaknesses and document findings.
- A desire to work more closely with operational teams to prevent issues, rather than just report on them.
- Can adapt their communication style from formal audit reporting to more collaborative problem-solving.