Manager, Internal Audit & Risk Management

Aljomaih Energy and Water Company (AEW) develops, invests in, owns and operates conventional power generation, renewable power and water desalination assets in the Kingdom of Saudi Arabia and the wider region largely through project-specific special purpose vehicles (SPVs) and joint ventures with domestic and international partners.

The Internal Audit & Risk Management function provides independent and objective assurance and advisory services designed to add value and improve AEW's operations. The function reports functionally to the Board Audit Committee and administratively to the Chief Executive Officer.

This role supports the Head of Internal Audit & Risk Management across corporate functions, project companies and joint venture entities and is expected to operate credibly with senior management, external auditors, regulators, lenders and shareholder representatives.

Overview

The Manager, Internal Audit & Risk Management plays a critical role in upholding AEW's ethical, governance and operational integrity. The role plans and executes risk-based internal audits, supports the design and operation of the Enterprise Risk Management (ERM) framework, and advises management on effective risk mitigation and control improvement.

The role requires a proactive mindset, strong analytical and report-writing skills, sound judgement in sensitive situations and a working understanding of the utilities development industry - in particular conventional power, renewable power and water projects and the contractual and financing structures through which they are delivered.

Your Job Functions (Duties & Responsibilities)

Internal Audit

1. Plan & Execute: Support the Head of Internal Audit & Risk Management in developing the annual risk-based internal audit plan and independently manage and execute internal audits engagement within your assigned area of responsibility.
2. Evaluate & Improve: Conduct comprehensive audits of various business functions, processes and controls, evaluating their effectiveness and identifying areas for improvement.
3. Compliance & Reporting: Assess compliance with relevant laws, regulations and company policies, and prepare clear and concise audit reports that communicate findings, recommendations and remediation plans to senior management and the Board Audit Committee.
4. Follow-up & Monitoring: Monitor and track the implementation of agreed-upon audit recommendations, ensuring timely and effective resolution of identified issues.
5. Policies and Procedures Review: Assist in the review and improvement of company-wide policies, procedures, and management practices.

Project, Contract and Capital Expenditure Audits

1. Audit the project development lifecycle from origination and bid through to financial close, construction, commissioning and handover to operations.
2. Contract Assurance: Review compliance with EPC, O&M, PPA/WPA, shareholder and financing agreements, including obligations, milestones, liquidated damages, warranties, insurance and reporting covenants.
3. Capex & Claims: Verify progress payments, variation orders, claims, change management and contingency utilization against contractual entitlement and approved budgets.
4. SPV & JV Governance: Assess governance, delegation of authority and control arrangements at project companies and joint ventures, including access rights available to AEW under shareholder agreements.

Risk Management

1. Plan & Execute: Support the Head of Internal Audit & Risk Management in developing the annual plan to support, manage and execute risk management engagements within your assigned area of responsibility
2. ERM Framework: Collaborate with the Head of Internal Audit & Risk Management and senior management to develop, implement & maintain the company's ERM framework, encompassing risk identification, assessment, mitigation and monitoring processes.
3. Risk Assessment & Mitigation: Conduct regular risk assessments to identify and evaluate potential risks facing the company, considering likelihood, impact and cascading effects. Develop and implement effective risk mitigation plans aligned with the overall ERM strategy and internal controls framework.
4. Risk Communication & Monitoring: Maintain an updated risk register and ensure consistent communication of risks to relevant stakeholders. Integrate risk management activities with internal audit processes.
5. Emerging Risks: Analyze emerging risks and trends, proactively adapt the ERM framework and annual plans to address them.

Advisory and Ad hoc Engagement

• Ensure the smooth and effective execution of all Ad hoc or advisory engagements once assigned within expected turnaround time and quality of deliverables.

Qualifications and Requirements

• Bachelor’s degree in accounting, Finance, Business Administration, Engineering or a related discipline.
• Master's degree or MBA preferred.

• Eight to ten years of relevant professional experience, of which a minimum of four to five years in internal audit, risk management or external audit.
• Experience with a Big Four firm, leading professional services firm or similar industry is preferred.
• Demonstrated exposure to IPP/IWP structures, project SPVs, joint ventures, EPC and O&M contracts and project finance is strongly preferred.
• Track record of reporting to, or presenting at, an Audit Committee or equivalent governance forum.

Certifications

• Certified Internal Auditor (CIA) required or actively pursuing with completion within an agreed timeframe.
• One or more of the following is preferred: SOCPA, CPA, ACCA, CRMA, CFE, CISA or PMP.
• ISO 31000 risk management training is an advantage.
• COSO Internal Control - Integrated Framework (2013) and COSO Enterprise Risk Management - Integrating with Strategy and Performance (2017).
• Understanding of NCA Essential Cybersecurity Controls, Saudi Companies Law, applicable corporate governance regulations, ZATCA requirements and IFRS as endorsed in Saudi Arabia.