Chief Governance, Risk & Compliance Officer and Board Secretary at a diversified Saudi holding group Founder of Perficio Limited, SA Advisory and Zemam
I turn what a board decides into systems that can prove it was carried out.
Thirty years spent between the engine room and the boardroom. I began as a computer engineer building process automation platforms for European banks, and I now author group strategy, governance frameworks and enterprise risk architecture for a diversified Saudi conglomerate. The two halves are not separate careers. Governance only holds when it is designed into the system, not written on top of it.
Five layers. Governance does not usually fail at the top or the bottom, but somewhere in the middle, where the thread quietly drops.
Since 1992Across the UK, KSA, the GCC, Turkey, Egypt and EMEA
280Group processes mapped to 108 named owners
106Enterprise risks tracked at board level
36+Professionals led on a single valuation engagement
Executive ArchitectSigns for the system, and can read its design.
The idea
The executive architect
Most executives commission the system. Most engineers build it. The gap between those two people is where transformations quietly fail, because the one who signs cannot read the design and the one who designs was never in the room where the intent was set. I have spent thirty years standing in both places, and that is the whole of my argument.
The technologist
Builds the thing, and makes it work
I began as a computer engineer and never stopped reading the design. In the early 2000s I built a case management platform with its own query language, which is where my instinct for compliance as an engineering problem actually came from. Nothing I have written since has been theoretical.
36 codebases consolidated into one. The platform is still in production more than two decades later.
The leader
Gets teams to deliver
Large delivery organisations do not respond to instruction alone. They respond to a leader who can answer the hard technical question in the room and then take the decision. I have run development houses, multi-disciplinary advisory teams, and now a distributed network of process owners across a group.
120 engineers, 36 professionals, 108 process owners. Three different kinds of team, each delivered.
The strategist
Writes the strategy, then stays to deliver it
Strategy written by a visiting firm leaves with the firm. I designed and facilitated the executive summit, drew the directions out of the people who would have to live with them, wrote the document in-house, and then took ownership of the initiatives that came out of it.
A group's first formal strategy, 2025 to 2030. Six directions, eighteen executives, two of the eleven initiatives led personally.
The architect
Designs complete systems, not components
A control that works in isolation and fails at the seam is not a control. I design whole systems: the target operating model, the governance architecture, the ERP estate and the approval logic that runs through all of it, so that the joins are designed rather than discovered.
A 90,000 square metre university and hospital, designed end to end. IT strategy, operating model and vendor architecture, delivered 13 per cent under budget.
The business analyst
Automates the process, then measures whether it worked
Automating a broken process only makes it fail faster, so the work starts with reengineering and ends with measurement. I map what actually happens, redesign it, put it into the system, and then instrument it so performance is observable rather than asserted.
280 processes mapped to named owners. A national performance dashboard across 146 state enterprises, and a 24 per cent efficiency gain for an international airline.
What I practise
Four disciplines that only work together
Most people in governance arrive through law or audit. I arrived through computer engineering and process design, which is why my frameworks tend to end up inside systems rather than inside binders.
Governance, risk and compliance
Building the architecture that lets a board govern a group it cannot personally inspect. Corporate governance manuals, delegated authority, three lines of defence, and enterprise risk frameworks that track real exposures rather than theoretical ones.
Corporate governance
ISO 31000 ERM
COSO internal control
Authority matrices
Policy architecture
Board reporting
Process automation
Redesigning the work before automating it. I act as lead functional designer, which means I own the business logic and hold the line between what the organisation actually does and what the code is about to assume it does.
Business process reengineering
Workflow design
Oracle Cloud ERP
BPM and RPA platforms
Continuous control monitoring
Applied artificial intelligence
AI put to work where the stakes are real, and constrained where they are highest. My governing rule is that no machine output reaches a register without a recorded human decision attached to a named, qualified person.
AI-native product design
Decision intelligence
Automated control testing
Agentic orchestration
Arabic-first systems
Strategy, authored and executed
Writing the strategy and then staying to deliver it. I have designed and facilitated executive summits, authored group strategies in-house, and led the initiatives that came out of them through to operational reality.
Group strategy authorship
Executive facilitation
Target operating models
Investment appraisal
Transformation delivery
The career record
Thirty years, entered as a register
Each entry opens to show what was actually built, and the outcome it produced. Filter by discipline to follow one thread across the whole span.
The span, 1992 to today
Employed and engagedBoard, independent and ventures
1992200020102020Today
Twelve entries across thirty-four years, in three lanes. Hover over a segment to read it, or select one to open its entry.
Show
Chief Governance, Risk and Compliance OfficerJuly 2026 to present
Board Secretary, holding company and subsidiariesApril 2026 to present
Head of Group Total Quality ManagementDecember 2024 to July 2026
Serve as secretary to the boards of the holding company and each of its subsidiaries, convening meetings, setting agendas, recording resolutions and maintaining the statutory record. The seat closes the loop on everything else: the governance framework and the body it was written for now share one custodian.
Authored the group's first formal strategy, covering 2025 to 2030, after designing and facilitating a two-day executive summit with eighteen senior leaders. Six strategic directions emerged: industrial excellence, brand growth, market expansion, investment diversification, innovation, and governance and talent.
Wrote the Corporate Governance Manual, the Board of Directors Policy and the Code of Conduct, then digitised the approved authority matrix directly into approval workflows so the limits execute rather than merely exist.
Built the group-wide policy and procedure framework during the quality mandate, and continue to own policy review under the governance mandate.
Designed an enterprise risk management framework aligned to ISO 31000, now tracking 106 distinct enterprise risks at board level.
Mapped 280 operational processes across the holding company and its subsidiaries to 108 named process owners, establishing accountability where none had been formally assigned.
Architected a commercial pivot from make-to-stock to make-to-order manufacturing, drafting the legal and operational frameworks and negotiating tier-one co-packing agreements with Nestlé, Carlsberg, Rauch, Binzagr CO-RO and Bavaria. The contracts contributed an estimated SAR 95 million in new revenue.
Authored a SAR 23 million capital expenditure feasibility for localised manufacturing in Oman, projecting a 158 per cent return and a payback of 1.7 years, alongside more than thirty new policies and procedures.
Lead two of the group's eleven major strategic initiatives, focused on digital capability and operational resilience.
GovernanceAutomationAIStrategy
Authored the product architecture, the financial models and the capital allocation logic, and secured initial funding.
Built a platform that automates internal control testing, procedure adoption and audit evidence, while holding a hard constraint: machine output never reaches a register without a recorded human decision behind it.
Designed maker-checker and two-approver rules as database constraints rather than interface conventions, so accountability cannot be configured away.
Led the architecture for Arabic-first, sovereign-hosted deployment, including a dual model serving both shared and customer-tenant installations.
AIAutomationGovernance
Lead functional designer for the group's Oracle Cloud ERP programme, running an annual implementation budget of SAR 26 million.
Established the internal controls department from nothing, anchored on the COSO framework. Inventory loss fell by 15 per cent, worth roughly SAR 32 million a year.
Delivered Oracle Fusion Cloud Procurement first time right, automating more than 4,000 supplier accounts and SAR 1.5 to 2 billion of annual non-trade procurement.
Architected a touchless reconciliation system on Oracle Cloud EPM, matching 240 corporate bank accounts against 3,800 point-of-sale terminals across more than 200 stores.
Implemented Oracle Retail Merchandising Foundation Cloud, automating restocking logic across 30,000 stock keeping units.
Integrated the group's e-commerce platform, then carrying around 500,000 monthly active users, with legacy retail core systems in real time and without interrupting trading.
Sustained delivery through six to seven months of pandemic lockdown on a fully virtual model, with no slippage to scope or timeline.
AutomationGovernance
Held the board seat carrying formal responsibility for internal control, a designated mandate under Turkish capital markets practice rather than a general directorship.
Established the governance processes, group strategy and standard operating procedures for the portfolio, digitising reporting lines in the process.
Investor return on the portfolio improved threefold following the redesign.
Registered with the Istanbul Trade Registry under number 110697-5. The firm was renamed Maqasid Gayrimenkul ve Girişim Sermayesi Portföy Yönetimi A.Ş. in May 2022 following Capital Markets Board approval.
GovernanceStrategy
Advised on long-term strategy, IT operations and financial control for clients in Europe, the Middle East and beyond.
Verified the financial feasibility of venture investments, including several technology start-ups, on behalf of prospective investors.
Lectured at university level on system security, information forensics and database design.
StrategyGovernance
Formulated corporate governance, process improvement and internal audit frameworks deployed across 146 state-owned enterprises.
Architected a unified national performance dashboard, linking enterprise-level results to sovereign economic targets.
GovernanceStrategyAutomation
Advisory across business planning, feasibility assessment and control design for clients in several sectors.
Created and enforced company-wide controls over revenue and expenditure to protect client assets.
Led a team producing an investment map for MENA markets, built around local standards and commercial culture rather than imported assumptions.
Built a suite of diagnostic instruments grounded in human performance improvement practice, covering organisational diagnosis, performer self-assessment and manager assessment.
StrategyGovernance
Led a delivery team of more than 36 professionals and three specialist subcontractors on the asset valuation for a state-owned utility privatisation. Delivered on time and on budget.
Designed the IT strategy and target operating model for a private university and its 300-bed teaching hospital, a greenfield complex of 90,000 square metres. Architectural optimisation and vendor consolidation produced a 13 per cent saving against budget.
Directed internal risk management for the Saudi firm and supervised due diligence engagements.
Designed a risk management system that reduced engagement risk by 8 per cent and lifted compliance adherence by 37 per cent.
Contributed to institutional strategy work for a national industrial development fund.
StrategyGovernance
Returned to the firm I had left in 1998, this time at executive level and with a mandate to change how it built software.
Led a development organisation of more than 120 engineers, project managers and administrators across the Egyptian development centre.
Drove the methodological shift from custom C, C# and Visual Basic project delivery to standardised Java product delivery on agile practice. Difficult, contested, and ultimately adopted as the firm's global blueprint.
That shift enabled the launch of the ETHIX Islamic banking suite in 2010, still in active use by major Islamic banking institutions.
Oversaw the development and automation of Islamic banking delivery channels, and directed the architecture and design of the firm's internal workflow subsystem.
AutomationStrategy
Senior Technical ArchitectJune 2003 to March 2007
Senior Consultant and ArchitectApril 2001 to June 2003
Professional Services ConsultantSeptember 1998 to April 2001
Arrived as a workflow consultant and left as a principal architect. The turning point was the Sampo Varma insurance workflow system, where I acted as technical project manager and workflow architect leading a team of seven. Its delivery is what gave rise to the idea for eFIRST Process.
As senior architect on eFIRST Process, defined the specification for the process engine, the business rules engine and the business intelligence layer. The platform is still in service today under its successor's name.
Started the initiative to reengineer the legacy FloWare product, written in C, onto EJB, then led its integration into eFIRST Process as the process engine. Served as the J2EE authority in a team of five architects and developers, and led the consolidation of 36 codebases, being three databases across twelve operating systems, onto one unified Java codebase.
Led delivery for corporate and public sector clients across Europe and North America, including the ticket refund process for a major international airline, multiple case management for a national tribunals service on J2EE, and legacy integration for a national children's charity.
As database consultant on an archival platform, built tooling to manage more than 10 gigabytes of daily storage retained across media for up to ten years, at a time when that was a serious constraint.
Delivered a 24 per cent efficiency gain for an international airline through reengineering combined with automation across legacy enterprise systems.
Automation
Began in technical customer support and pre-sales, then moved deliberately into the harder problems: workflow platforms, storage management, Informix database administration at versions 5 and 7, UNIX administration, networking and hardware.
Became the firm's Informix database administrator and its specialist in workflow systems, the two disciplines that set the direction of everything that followed.
Delivered training courses on UNIX, Informix and the workflow product suite, and evaluated emerging products across workflow, document imaging and client-server architecture.
Concurrently held a workflow consultancy to the Information Centre and Decision Support Department of a Council of Ministers, from 1996 to 1998, covering workflow design, system monitoring and tuning, and contingency and capacity planning. A first encounter with governance at the level of the state.
AutomationGovernance
Carried the full lifecycle for document imaging and management engagements: the initial study and evaluation, the system configuration and design, and the technical support after the sale. An unusually complete view of a deal for someone that early in a career.
Learning the commercial side and the engineering side at the same time turned out to matter more than either alone, and it is the habit the rest of this record is built on.
Automation
Value added
Three decades, and what each stretch was worth
The same record read forwards, with the value attached. Each stage carries what was achieved and what the organisation got for it.
1992 to 1994
Documents, from the first job
International Computer Aided Design Systems
Straight out of a computer engineering degree and into document imaging, carrying the whole lifecycle: the initial study, the system design and configuration, and the technical support after the sale. Engineering and commercial judgment learned together rather than in sequence.
The habit that everything since has rested on: never design a system without having had to sell it, and never sell one without having had to make it work.
1994 to 1998
Where the specialism formed
International Turnkey Systems, Kuwait City
Entered as a support engineer and left as the firm's Informix database administrator and its workflow systems specialist. Along the way, delivered training on UNIX, Informix and the workflow suite, and advised the information centre of a Council of Ministers on workflow design, tuning and capacity planning.
Two disciplines acquired that set the direction of the next thirty years: the database underneath and the workflow on top. The government advisory work was the first sight of governance at the level of a state.
1998 to 2007
The platform years
BancTec International, Berkshire, now Exela Technologies
Three roles in nine years, from workflow consultant to principal architect. An insurance workflow system delivered with a team of seven gave rise to the idea for eFIRST Process, on which I then defined the process engine, the business rules engine and the intelligence layer. Reengineered the legacy FloWare product from C onto EJB and integrated it as the engine.
Thirty-six codebases, being three databases across twelve operating systems, consolidated onto one. Maintenance cost and time to market both fell sharply, and the platform is still in production more than twenty-five years later. A 24 per cent efficiency gain delivered for an international airline.
2007 to 2008
From projects to products
International Turnkey Systems, Kuwait City
One of three executives mandated to move a development organisation of more than 120 people away from bespoke project delivery and onto a standardised, product-based model. A contested shift, and the right one.
The change enabled the ETHIX Islamic banking suite, launched in 2010 and still in active use by major institutions, and was adopted as the firm's global blueprint.
2008 to 2011
Advisory at scale
KPMG, Riyadh
Led 36 professionals and three specialist subcontractors on the asset valuation for a state utility privatisation. Designed the IT strategy and target operating model for a 90,000 square metre university and teaching hospital, and directed internal risk management for the Saudi firm.
Delivered on time and on budget, with a 13 per cent saving on the university programme through architectural optimisation and vendor consolidation. Engagement risk down 8 per cent, compliance adherence up 37 per cent.
2013
Governance at national scale
Government department, Middle East
Formulated the corporate governance, process improvement and internal audit frameworks deployed across the state-owned enterprise portfolio, and architected a unified national performance dashboard.
One line of sight from enterprise performance to sovereign economic targets, across 146 state-owned enterprises.
2019 to 2022
The board seat
Maqasid Portföy Yönetimi A.Ş., Istanbul
Board member carrying formal responsibility for internal control. Established the governance processes, group strategy and standard operating procedures for the portfolio, and digitised the reporting lines.
Investor return on the portfolio improved threefold following the redesign.
2020 to 2024
Controls at retail scale
Panda Retail Company, Jeddah
Lead functional designer on the Oracle Cloud ERP programme at SAR 12 billion of revenue, and founder of the internal controls department, built from nothing on COSO foundations.
Inventory loss down 15 per cent, worth roughly SAR 32 million a year. Procurement of SAR 1.5 to 2 billion automated across more than 4,000 supplier accounts. Twenty per cent workforce optimisation through the removal of redundant manual tasks.
2024 to 2026
Writing the group's rules
Head of Group Total Quality Management
Authored the first formal group strategy for 2025 to 2030, the Corporate Governance Manual, the Board of Directors Policy and the Code of Conduct. Digitised the approved authority matrix into approval workflows and designed the ISO 31000 risk framework.
An estimated SAR 5 to 12 million in external advisory fees avoided by writing the strategy in-house. A commercial pivot into tier-one co-packing contributing an estimated SAR 95 million in new revenue. 106 enterprise risks brought under board visibility and 280 processes given named owners.
2026 to present
Custodian of the framework
Board Secretary in April, Chief Governance, Risk and Compliance Officer in July
Appointed secretary to the boards of the holding company and every subsidiary, then to the group's governance, risk and compliance mandate. The frameworks written over the preceding two years now sit with the person responsible for the board that adopted them.
The governance architecture and the body it was written for share a single custodian, which is what closes the loop between what a board intends and what can later be proved.
Selected work
Things that were built, and what they changed
A shorter list, chosen because each one required something to be designed rather than administered.
Group strategy
A conglomerate's first formal strategy
No group strategy had ever been written. I designed and facilitated a two-day executive summit, drew out six strategic directions from eighteen senior leaders, and wrote the document in-house. Delivering it internally avoided a substantial external advisory spend and, more importantly, kept the intent with the people who held it.
6Strategic directions
18Executives convened
2025–30Horizon
Governance architecture
An authority matrix that executes itself
A delegated authority matrix in a document is a statement of hope. I digitised the board-approved matrix directly into approval workflows, so that limits are enforced at the moment of decision rather than discovered afterwards in an audit. Continuous control monitoring replaced the periodic post-mortem.
280Processes mapped
108Named owners
106Risks tracked
Enterprise automation
Touchless reconciliation at retail scale
Reconciling hundreds of bank accounts against thousands of tills had been a monthly manual exercise. Built on Oracle Cloud EPM, the system now matches 240 corporate accounts against 3,800 point-of-sale terminals across more than 200 stores without human intervention, and surfaces only the exceptions.
3,800POS terminals
240Bank accounts
200+Stores
Internal control
An internal controls function built from zero
Saudi Arabia's largest retailer had no dedicated internal controls department. I established one on COSO foundations, set the testing programme, and embedded controls into the ERP rather than layering them over it. Inventory shrinkage fell measurably within the first cycles.
15%Reduction in inventory loss
~SAR 32MAnnual value recovered
Product architecture
An AI platform that refuses to decide for you
Most governance software treats AI output as an answer. This one treats it as a proposal. Nothing enters a register without a recorded human decision attached to a named person whose competence and authority are on file, with maker-checker and two-approver rules enforced in the database rather than the interface.
Arabic-firstBuilt for the region, not translated
SovereignHosted in-Kingdom
Platform engineering
Thirty-six codebases reduced to one
eFIRST Process had fragmented into 36 separate codebases, being three databases across twelve operating systems, each maintained independently. I led the architectural migration onto a single unified Java codebase. The platform survived the consolidation and is still in service two decades later.
36 → 1Codebases
25+ yrsStill in production
Ventures and affiliations
Where else I work
Three independent ventures alongside an academic appointment and a board seat, each addressing a different part of the same problem: how institutions keep their intent intact.
Perficio Limited
Founder
Business advisory, United Kingdom, established 2006
An independent advisory firm working across three practices: human performance consulting grounded in evidence-based practice, governance, risk and compliance, and transnational education and academic partnerships. Perficio is Latin for to complete, which is the point. Strategy is half the work.
An Arabic-first, sovereign-hosted governance platform for corporate groups holding several entities, built for family businesses at the moments that test them: conversion, listing preparation, succession. Its defining rule is enforced human accountability. Every approval records who decided, whether they were qualified, and which article of law it rests on.
A Qatar-registered advisory firm applying artificial intelligence and large-scale data analysis to the healthcare and education sectors, alongside a conventional advisory practice covering governance, risk and compliance, process automation, change management and programme delivery. The regional counterpart to the same engineering-led method applied everywhere else in this profile.
Leading a Pearson-approved centre delivering internationally recognised BTEC qualifications, with an accompanying business-facing arm in the United Kingdom. The work spans centre governance, quality assurance against awarding body standards, and the conversion of curriculum into deliverable programmes.
Board member carrying formal responsibility for internal control at Turkey's first independent portfolio management firm operating wholly in interest-free finance. The governance redesign, strategy work and digitised reporting lines delivered here produced a threefold improvement in investor return. The firm was restructured into real estate and venture capital portfolio management in 2022.
King Fahd University of Petroleum and Minerals, Dhahran
Chartered IT Professional
The Chartered Institute for IT, United Kingdom, 2007
Member, British Computer Society
MBCS
Management Certified Professional
London, 2004
Frameworks and standards
Governance and risk
ISO 31000, COSO internal control and ICFR, three lines of defence, corporate governance codes
Quality and process
Total quality management, ISO quality standards, business process reengineering, human performance improvement
Technology
Oracle Cloud Financials, Procurement, EPM and Retail Merchandising. BPM and RPA platform architecture. Agentic AI orchestration.
Reach and delivery
Languages
Arabic, native. English, fluent. Training and facilitation delivered in both.
Nationality and base
British citizen. Based in Jeddah, Saudi Arabia, with a secondary base in Berkshire, United Kingdom.
Sectors
Family conglomerates, FMCG and manufacturing, retail, banking and Islamic finance, public sector and healthcare, higher education
Start a conversation
I am interested in board and advisory appointments, governance and transformation mandates, and speaking or training engagements in Arabic or English. If a problem sits between strategy and execution, that is usually where I am most useful.
