Governance, risk and compliance —
built as one connected system.

Governance

We design governance operating models that make ownership explicit: board and committee structures, charters and delegation-of-authority matrices, policy hierarchies and management reporting — aligned to Saudi corporate governance requirements and sized to how your organisation actually operates.

• Governance operating model and organisational design
• Board and committee charters with delegation-of-authority matrix
• Policy hierarchy and document governance framework
• Management and board reporting architecture

Enterprise Risk

We build enterprise risk management from first principles: a risk appetite approved at board level, a taxonomy that fits your business, an assessment methodology, live registers, KRIs and reporting — grounded in ISO 31000 and COSO ERM, and embedded in decision-making rather than filed as documentation.

• Risk appetite statement with cascading tolerances
• Enterprise risk taxonomy and assessment methodology
• Risk register build-out with treatment plans and ownership
• KRI dashboards and board risk reporting

Regulatory Compliance

We turn regulatory text into an operational compliance programme: a maintained obligations register mapped to controls and owners, gap assessments against SAMA, NCA and PDPL requirements, and remediation roadmaps sequenced by supervisory risk rather than by whichever gap was found first.

• Regulatory obligations register mapped to controls and owners
• Regulatory requirements mapping and compliance readiness reviews across SAMA, NCA, PDPL and applicable sector requirements
• Prioritised remediation roadmap with effort and dependency analysis
• Compliance monitoring and regulatory-change management process

Internal Audit Advisory & Co-Sourcing

Whether you are standing up a first internal audit function or maturing an existing one, we build the full stack: charter, methodology, risk-based audit universe and plan, workpaper standards and quality assurance — aligned to the IIA's Global Internal Audit Standards and regulator expectations for the third line.

• Internal audit charter, methodology and audit manual
• Risk-based audit universe and multi-year audit plan
• Co-sourced audit execution across business and technology
• External quality assessment readiness

GRC Transformation

When risk, compliance and audit each run on their own tools and taxonomies, no one sees the whole picture. We redesign the operating model — common taxonomies, shared control libraries, integrated workflows — and implement it on GRC tooling so the three lines finally work from the same data.

• Current-state GRC maturity and fragmentation assessment
• Target operating model with unified taxonomies and workflows
• GRC platform selection, implementation and data migration
• Adoption programme with role-based training

Control Frameworks

Organisations answering to SAMA CSF, NCA ECC, PDPL and ISO 27001 at the same time often maintain four overlapping control sets. We rationalise them into a single control library mapped across every applicable framework — cutting duplicate testing and giving each control one owner and one body of evidence.

• Control inventory and duplication analysis
• Unified control library mapped across all applicable frameworks
• Control ownership model and testing calendar
• Framework-mapping maintenance process for regulatory change