Operational CORPORATE GOVERNANCE
Turn governance from policy to practice. We build the governance operating model so decisions, controls, and board reporting work every day---without slowing the business.
Why It Matters
How We Build Operational Corporate Governance
Governance Operating Model
Map the "plumbing" of governance---forums, inputs/outputs, information flows, enabling tech---so oversight and operations connect cleanly (a practical governance operating model).
Decision Rights & Delegations (DoA)
Clarify who decides what, at which level, and how cross-functional calls get made. We use pragmatic mechanisms like RAPID to speed complex decisions and minimize escalations.
Committees & Charters
Right-size board/management committees and refresh charters, interfaces, and agendas to align with strategy, risk, and performance priorities in line with OECD/ISO principles and CMA requirements.
Policy Architecture & Internal Controls
Build a usable policy framework and SOPs with embedded control points, aligned to the COSO Internal Control---Integrated Framework.
Three Lines Integration
Make the IIA Three Lines Model work in practice---management owns risk/controls; risk & compliance advise/monitor; internal audit independently assures and adds insight.
Risk, Compliance & Attestation Rhythm
Link risk registers, compliance calendars, and control attestations to the monthly/quarterly management cycle and board packs---so evidence is timely and decision-useful. (Aligned to OECD expectations on disclosure and board responsibilities.)
Board & Regulator-ready Reporting
Standardize KPIs, risk/control dashboards, incident logs, and disclosures to meet CMA expectations (English translation of the 2017 regulations, amended 2023).
Culture & Conduct Alignment
Anchor incentives, escalation norms, and tone-from-the-top to ISO 37000 purpose/values principles---so behavior matches policy.
Governance Health Check & Roadmap
Assess against OECD/ISO principles and CMA regulations; deliver quick wins (DoA cleanup, committee refresh, board-pack templates) and a longer-term enablement plan (GRC tooling, data & analytics).
What You Get
Clear decisioning
A documented DoA and decision mechanisms that speed cross-functional calls and reduce rework.
Tighter control environment
Policies/SOPs with mapped controls, aligned to COSO.
Confident oversight
A committee system and board-pack rhythm that surfaces risk and performance early, grounded in OECD/ISO principles and CMA rules.
Assurance that adds value
Three Lines operating as intended---independent yet integrated with management's risk ownership.
Regulatory readiness
Disclosures and evidence aligned to Saudi CMA Corporate Governance Regulations.