Corporate governance
From individual decisions to a documented, auditable institutional system.
- Group governance framework
- Board and committee charters
- Delegation of authority matrix
- Board performance evaluation
Governance, Compliance and Risk Management Services
A methodology grounded in international reference frameworks — ISO 37301 · ISO 31000 · COSO ERM and the IIA Three Lines Model — fully aligned with Saudi regulations in force.
Madinah — Kingdom of Saudi Arabia
25+
Years of combined experience
50+
Professional engagements
4
Core service lines
10+
Sectors served
About us
Innovestment Capital — a Saudi house of expertise in governance, compliance and financial advisory, serving multi-entity groups and their boards.
Vision
To be the driving strategic partner in the Kingdom for designing and developing governance, compliance and risk management systems, through integrated solutions built on international best practice and aligned with national regulatory requirements.
Mission
To enable boards and executive management to build effective, sustainable governance and compliance systems through specialised advisory services and practical, implementable solutions that raise performance and create lasting value for all stakeholders.
Compliance is not a regulatory cost — it is a control that protects value: it reduces fines and legal exposure, shortens the decision cycle, and strengthens the group's qualification standing with government entities and strategic clients.
Regulatory challenges
The most recurrent gaps we observe across our engagements with multi-entity groups.
Fragmented authorities
The absence of an approved delegation-of-authority matrix leads to decisions outside the statutory framework and conflict between holding and subsidiaries.
Weak control documentation
Decisions recorded without adequate minutes and attachments make it hard to evidence compliance before regulators.
Zakat and tax compliance
Uncontrolled treatments in returns and e-invoicing turn into assessments and penalties.
Cross-border risk
Operating across several countries raises sanctions, transfer pricing and customs compliance risk.
Succession and ownership
Concentrated-ownership groups need a framework that separates ownership from management and safeguards decision continuity.
Business continuity
Without impact analysis and tested recovery plans, critical operations remain unprotected.
Our service ecosystem — four service lines
An integrated package approved at holding level and cascaded to subsidiaries, with a named responsible partner and independent technical quality review before every delivery.
Regulatory compliance
A compliance programme built on ISO 37301 requirements with a full lifecycle.
- Regulatory obligations register
- Policies and procedures
- Annual compliance calendar
- Monitoring and evidence
Risk management and internal audit
Establishing, operating and measuring the effectiveness of second and third line functions.
- Enterprise risk register
- Risk-based audit plan
- Periodic audit committee reporting
- Business continuity
Financial and advisory services
Supporting growth, funding and restructuring decisions with documented quantitative evidence.
- Corporate finance
- Islamic finance
- Asset and investment management
- Financial due diligence
International references and the regulatory framework
International frameworks define the method and Saudi regulations define the obligation — our deliverables combine both in a single board-approvable document.
COSO ERM 2017
Enterprise risk management framework linked to strategy and performance.
ISO 37301:2021
The international standard for compliance management systems and their lifecycle.
ISO 31000
Principles and guidelines for risk management at group level.
Three Lines (IIA)
The 2020 Institute of Internal Auditors model for allocating control roles.
Companies Law
Issued by Royal Decree M/132 of 2022 and its implementing regulations, governing the holding company and its subsidiaries.
Corporate Governance Regulations
Board, committee and disclosure requirements issued by the Capital Market Authority.
Zakat, Tax and Customs
Zakat and tax returns and e-invoicing across both phases.
Local content
Local Content and Government Procurement Authority regulation and qualification requirements.
Human resources and safety
Ministry of Human Resources requirements, Nitaqat and occupational safety conditions.
Anti-money laundering
Counterparty due diligence and international sanctions screening before contracting.
The Three Lines Model
Who owns the risk, who monitors it, and who independently assures control effectiveness.
First line
Operating departments
Own the risk and apply controls in day-to-day operations.
Second line
Compliance and risk management
Set the framework, monitor compliance and report to management.
Third line
Internal audit
Independent assurance on governance and control effectiveness to the audit committee.
The board and audit committee are the highest oversight body, relying on independent assurance from the third line and the external auditor under the IIA model (2020).
Engagement methodology
Five phases with defined deliverables and formal approval points at the end of each phase.
- 1
Diagnosis
Assess the current state and identify statutory and control gaps.
- 2
Design
Build the frameworks, policies and matrices suited to the group structure.
- 3
Approval
Present deliverables to the board and committees for formal approval.
- 4
Implementation
Cascade to subsidiaries with training and knowledge transfer.
- 5
Assurance
Control testing, evidence packs and quarterly reviews.
A suggested duration of 4–6 months for the foundational phase, followed by annual operational support with quarterly reviews before the audit committee.