Manager-Internal Audit & Risk Management- Saudi Nationals

About the company

Role overview

Internal audit

• Support the annual risk-based internal audit plan and independently manage assigned audit engagements.
• Audit business functions, processes, and controls and identify improvement opportunities.
• Assess compliance with laws, regulations, and company policies.
• Prepare reports for senior management and the Board Audit Committee.
• Track implementation of audit recommendations.
• Review company-wide policies, procedures, and management practices.

Project, contract, and capital expenditure audits

• Audit the project lifecycle from origination and bidding through financial close, construction, commissioning, and handover.
• Review EPC, O&M, PPA/WPA, shareholder, and financing agreement compliance.
• Verify progress payments, variation orders, claims, change management, contingency use, and approved budgets.
• Assess governance, delegation of authority, and controls at project companies and joint ventures.

Risk management and advisory

• Support planning and execution of risk management engagements.
• Develop, implement, and maintain the ERM framework covering risk identification, assessment, mitigation, and monitoring.
• Conduct risk assessments and develop mitigation plans aligned with ERM and internal controls.
• Maintain the risk register and communicate risks to stakeholders.
• Analyze emerging risks and adapt ERM plans.
• Execute ad hoc and advisory engagements within required time and quality standards.

Qualifications and requirements

• Bachelor’s degree in accounting, finance, business administration, engineering, or a related discipline.
• Eight to ten years of relevant professional experience, including four to five years in internal audit, risk management, or external audit.
• Master’s degree or MBA is preferred.
• Big Four or leading professional services firm experience is preferred.
• Exposure to IPP/IWP structures, project SPVs, joint ventures, EPC and O&M contracts, and project finance is strongly preferred.
• Experience reporting to or presenting at an Audit Committee or equivalent forum.

Certifications and technical knowledge

• CIA certification is required, or the candidate must be actively pursuing it for completion within an agreed timeframe.
• SOCPA, CPA, ACCA, CRMA, CFE, CISA, or PMP is preferred.
• ISO 31000 risk management training is advantageous.
• Knowledge of COSO frameworks, NCA Essential Cybersecurity Controls, Saudi Companies Law, corporate governance regulations, ZATCA requirements, and IFRS as endorsed in Saudi Arabia is required.