The pathway
How you actually get there, here
How you become one varies far more by country than what one does. This is the UK route. Most people take one of these ways in; the right one depends on where you're starting from.
- 1
From Mid-Level Systems Auditor (Internal)
2-3 years as a Systems Auditor (L2)Skills to master
- Leading full audit engagements, mentoring junior staff informally, taking ownership of complex findings, and presenting to mid-level management.
You're ready to move on when
- Consistently delivering high-quality audit reports with minimal manager review.
- Proactively identifying risks beyond the immediate audit scope.
- Demonstrating strong communication and negotiation skills with process owners.
- Successfully guiding new joiners or less experienced colleagues on projects.
- 2
From External Audit (Big Four/Consultancy)
5-7 years in external IT audit or GRC consultingSkills to master
- Adapting to an internal audit perspective (more focus on continuous improvement vs. just attestation), understanding our specific industry regulations, and building long-term internal relationships.
You're ready to move on when
- Experience leading audit teams and managing client engagements.
- Strong technical audit skills (ITGCs, application controls).
- Ability to quickly grasp new business processes and regulatory environments.
- A desire to move from project-based work to a more embedded, strategic role.
- 3
From Compliance/Quality Assurance Specialist
6-8 years in a dedicated CQHS compliance or quality assurance role with a strong systems focusSkills to master
- Developing formal audit methodology, objective evidence gathering, and structured reporting. Moving from 'doing' compliance to 'auditing' compliance.
You're ready to move on when
- Deep subject matter expertise in a specific CQHS domain (e.g., environmental reporting systems).
- Experience with system configuration and data analysis.
- A proven ability to identify process breakdowns and propose improvements.
- A strong desire to apply a more independent, assurance-focused lens to their work.