The pathway
How you actually get there, here
How you become one varies far more by country than what one does. This is the UK route. Most people take one of these ways in; the right one depends on where you're starting from.
- 1
Operations Risk Specialist (L2) Promotion
3-5 years as an L2Skills to master
- Independent ownership of RCSAs, strong root cause analysis for routine incidents, effective stakeholder communication for basic findings.
You're ready to move on when
- Consistently delivers high-quality risk assessments with minimal supervision.
- Proactively identifies and escalates risks, not just reacts to them.
- Begins to provide informal guidance to new joiners or less experienced colleagues.
- Successfully manages the full lifecycle of routine findings from identification to closure.
- 2
Internal Audit Senior
5-7 years in Internal AuditSkills to master
- Deep understanding of control testing methodologies, report writing, and engaging with business process owners. You'll need to adapt from an assurance role to a more advisory, preventative one.
You're ready to move on when
- Experience leading audit engagements and managing junior auditors.
- Strong grasp of internal control frameworks and audit standards.
- Ability to translate audit findings into actionable risk mitigation strategies.
- Desire to move from 'finding problems' to 'helping prevent them'.
- 3
Senior Compliance Analyst
5-7 years in ComplianceSkills to master
- Understanding of regulatory requirements, policy interpretation, and compliance monitoring. You'll need to broaden your focus from purely regulatory adherence to wider operational risks.
You're ready to move on when
- Experience interpreting complex regulations and assessing compliance risks.
- Ability to work with business units to implement compliance controls.
- Strong analytical skills to identify gaps between policy and practice.
- Interest in the 'how' of operations, beyond just the 'what' of compliance.