Strategic outcomes with operating weight.
Internal audit is not a checklist exercise; it is an EBITDA defense instrument. Below is the audited record of capital protected, balance-sheet leakage recouped, and high-stakes case studies structured around business problems rather than compliance paperwork.
Kitopi — 100% population testing during 340% volume surge
$127M M&A due diligence — undisclosed legal & contract liabilities
McDonald's KSA — whistleblower intake & tender collusion triage
Continuous controls monitoring replacing 20-invoice sample blindspots
Client names and proprietary identifiers are anonymised. Figures and outcomes reflect real work while protecting confidentiality obligations.
Selected mandates.
M&A Capital Protection & High-Stakes Due Diligence
"SAR 15M unrecorded exposure identified — $127M capital defended — Acquisition terms restructured prior to close"
A diversified GCC conglomerate was in the final stages of a major acquisition within the hospitality and F&B sector. The deal involved a committed capital of $127M, but the existing due diligence relied on standard seller disclosures and limited sampling.
As Group Director of Internal Audit, my mandate was to perform a final layer of independent operational and financial due diligence to validate the target's internal control environment and uncover any contingent liabilities.
I deployed a full-population forensic review across the target's supplier agreements, lease commitments, and litigation filings. Instead of relying on the seller's curated disclosure schedule, we indexed and cross-matched every active contract clause against historical claims and regulatory filings.
The audit uncovered SAR 15M in previously undisclosed litigation exposure and significant regulatory non-compliance issues. This discovery provided the executive team with critical leverage to renegotiate deal terms, protecting the entire $127M in capital from post-acquisition shocks.
"Standard M&A due diligence relies on sampled vendor files and seller warranties, which routinely miss off-balance-sheet exposures. Running full-population contract forensics defends acquisition EBITDA before capital is committed."
Audit 4.0: Shifting to 100% Population Testing
"AED 7.7M financial recovery & defense — 100% aggregator remittance reconciliation — Clean SOX 404 / ICFR opinion"
A hyper-growth tech unicorn operating 100+ locations across 8 countries was experiencing a 340% surge in transaction volumes. The existing audit methodology relied on 5-15% manual sampling, leaving significant gaps in fraud detection.
Replace retrospective 20-sample audits with automated continuous controls monitoring across multi-market food-tech transactions without disrupting kitchen fulfillment velocity.
Built automated telemetry pipelines reconciling store point-of-sale till receipts directly against third-party delivery aggregator remittance schemas (Talabat, Deliveroo, Jahez, Hungerstation). Deployed exception-clustering scripts to isolate ghost orders, commission overcharges, recipe yield variances, and off-cycle payroll edits across 100% of transactions.
Identified and captured AED 7.7M in total financial impact (AED 3.2M recovered from aggregator over-deductions and billing leakages; AED 4.5M protected). Delivered a clean first-time external audit opinion with zero material weaknesses and secured board-approved funding for enterprise telemetry.
"A 20-invoice sample cannot detect systemic commission leakages hidden across millions of aggregator order lines. Continuous controls monitoring automates transactional telemetry, freeing audit to focus on the physical operational boundaries—recipe yields, stock waste, and kitchen craft—where sensors and code cannot substitute for human presence."
IPO Readiness & Governance Architecture
"Zero material weaknesses on initial ICFR audit — 175+ controls codified — Board and Audit Committee governance operationalized for prospectus"
A high-growth technology platform operating across 7 jurisdictions was targeting a major stock market listing. The organization had no formal internal audit function, no documented ICOFR framework, and significant governance gaps.
As Strategic Advisor, I was mandated to oversee the end-to-end IPO readiness programme, ensuring full compliance with regional corporate governance codes and establishing a board-grade control environment within 18 months.
I led seven integrated workstreams, including the build-out of a 175+ control ICOFR framework and the design of a group-wide whistleblowing and ethics programme. I established the Audit Committee charters and reporting protocols aligned to listing requirements.
Delivered a clean, first-time external audit opinion on ICOFR. Successfully aligned board and committee structures with regional market regulations across all jurisdictions, providing the governance foundation required for the listing prospectus.
"Pre-IPO governance collapses when treated as retrospective compliance theater. Designing deterministic control gates across order-to-cash, inventory accounting, and month-end financial close produces clean audit opinions while preserving operating momentum."
Data Analytics & Continuous Monitoring Training
"60% reduction in sample fieldwork testing cycle — Automated POS-to-inventory reconciliation deployed — 100% population coverage across QSR store network"
A leading Quick Service Restaurant (QSR) player in KSA relied on manual sampling for audits, limiting coverage and leading to high false positives. The traditional, compliance-centric audit team lacked the technical capability to automate testing.
Equip frontline internal auditors to write and execute automated data tests against raw ERP ledgers and point-of-sale datasets, eliminating reliance on manual spreadsheet sampling.
Trained the audit team on direct ERP query extraction (Oracle/SAP), scripting continuous controls monitoring in Python, and building deterministic anomaly models to reconcile point-of-sale till receipts against store inventory consumption and vendor disbursements.
The team built internal automated tests across vendor disbursements and store recipe yields, eliminating manual 25-sample vouchers, cutting fieldwork testing cycles by 60%, and surfacing recurrent inventory and billing variances directly to the Audit Committee.
"Auditors who rely on manual samples are blind to systemic operational leakage. Training teams to interrogate raw transaction populations bridges the gap between store-level till receipts and board-level financial integrity."
Broader engagement range.
A tighter cross-section of advisory and audit work across GCC and international markets.
KSA Real Estate Forensic Audit
Monitoring SAR 500M+ Capex/OpEx across residential and commercial portfolios.
Recovered SAR 3.2M annually via automated risk engine.
Executive Financial Dashboards
Real-time board-level visibility into capital leaks and variance analysis.
Automated monthly board variance reporting across multi-entity P&L and balance-sheet ledgers.
Tadawul Nomu Listing Readiness
Coordinated ICOFR and regulatory submissions for KSA healthcare subsidiary.
Successful governance structuring for parallel market listing.
Enterprise Risk Management (8 Countries)
Designed and implemented COSO ERM 2017 / ISO 31000 framework.
50+ risks mapped; 28 KRIs live across 8 jurisdictions.
Tools built for the audit community.
Production-grade applications released under MIT license for internal audit, risk, and compliance teams worldwide.
Corporate Whistleblower Lite
A lightweight, self-hosted whistleblowing platform. Anonymous reporting, file uploads, role-based dashboards for Internal Audit and CEO, audit trail, and SQLite database — deploys in minutes, not hours.
Eliminates dependency on SaaS whistleblowing vendors. Complete data sovereignty with zero external API calls.