This is the story of how I managed to pass my EduQual RQF Level 3 Oral Presentation from Al-Nafi—a mix of nerves, learning curves, and the occasional existential crisis over compliance frameworks. I’ll also share the resources I used and what I learned along the way.

Before we dive in, let’s clear the basics: EduQual is a UK-regulated awarding body that provides globally recognized vocational and academic qualifications accredited by SQA-Accreditation. RQF Level 3 is roughly equivalent to A-Levels in the Cambridge system.

Back in August, I cleared Part 1 of my EduQual exam, which had 2600+ MCQs (yes, you read that right). The second part was a live oral presentation with Muhammad Faisal, scheduled for October 2nd. It was my first real interaction with a senior industry professional—and I was absolutely nervous.

The Topic That Looked Like a Compliance Spell

Here’s what landed in my inbox:

“This topic explores the application of SSAE 16 Type II audit standards alongside ISO/IEC 27001 to secure government cloud systems on Azure and GCP.”

The objectives were:

  1. Implement SSAE 16 Type II to ensure government cloud systems meet audit requirements.

  2. Use ISO/IEC 27001 to protect sensitive government data against security threats.

  3. Monitor security and compliance using Azure Security Center, GCP Security Command Center, and open-source tools like Wazuh.

When I first read it, it looked like something straight out of a compliance spell book. I had no idea what half of it meant. The email didn’t include my interview date—just a six-week deadline—so I started panicking early (very efficient of me).

Luckily, a colleague who’d already passed the exam had a similar topic and gave me a good push in the right direction.

Into the Dungeons of the Internet

So, I began preparing—by which I mean I opened my browser and dove into the dungeons of the internet. I used Gemini a lot, asking it all kinds of “what” and “why” questions to build my foundation. Then I moved on to some solid references:

  • AICPA (for SSAE 16)

  • ISMS.online (the best site I found for understanding ISO 27001)

  • Azure and GCP documentation (to see what the big players say themselves)

I started taking notes separately for each objective—simple questions, definitions, and examples. The hardest part was wrapping my head around all the acronyms: SSAE, AICPA, ISAE... it felt like a bowl of alphabet soup.

From Markdown Notes to PowerPoint Reality

After two or three weeks of studying, I started building my presentation. I wrote everything in Markdown, thinking bullet points were the way to go. My slides were clean, minimal, and... apparently too minimal.

When I finally presented, Sir Faisal wasn’t thrilled—not because my content was wrong, but because my slides looked like a government memo: no visuals, no timelines, just bullet points. Even I felt the emptiness afterward. Looking back, I should’ve made the final section on “Implementation” more visual—maybe a simple design or diagram for SIEM and logging.

Rehearsing My Words (and My Nerves)

Because I’m naturally introverted and tend to blank out under pressure, I decided to write down my entire dialogue—word for word. I rehearsed like an actor learning lines for a play about compliance.

My first run took over 25 minutes (way too long for a Level 3 presentation), so I trimmed it down. I focused on relatable examples—like comparing SOC Type I vs. Type II to a picture vs. a video recording. That analogy earned me a compliment from Sir Faisal, so that was a win.

When the actual presentation began, though, the universe had other plans. I faced two power hiccups during the session—yes, literal electricity issues. Between that and my nerves, I lost my flow and ended up choking right at the final layer of my presentation. I forgot some of my explanations there, which stung a little because that section was supposed to tie everything together. But hey, at least I recovered well enough to finish strong.

The Q&A Gauntlet

After the slides came the question round, usually around 10 questions. I tried to keep my answers short and clear, but I could tell I’d lost a bit of rhythm. Most questions went fine—until one where I was completely blank.

The question was essentially about how a user entity could implement ISO 27001 and SSAE 16 in a multi-cloud environment, and the answer involved something called the Unified Compliance Framework (UCF). I hadn’t even heard of it. A painful but fair miss.

Lessons, Laughs, and a Little Growth

Despite the hiccups, Alhamdulillah, the interview went well. I scored 80%, and the feedback was fair. I also got to ask Sir Faisal a few career-related questions afterward. At first, I didn’t love his answers, especially regarding penetration testing—it had always sounded like the “cool” job. But later, I understood his perspective. Reality and coolness don’t always overlap.

Final Thoughts

This whole experience taught me that content is important, but delivery is crucial. Knowing the topic is half the job; expressing it clearly is the other half. If you’re preparing for the same exam, don’t just memorize—understand, structure, and rehearse. Record yourself, time yourself, and don’t underestimate design—it matters.

If you’d like to check out the resources, notes, and my full presentation, they’re all on my GitHub:

And remember: no matter how complex a topic sounds at first, once you survive it—you can definitely write a blog about it.