Internal Controls Toolkit

Guidance

1
Table of Contents
1. Introduction.............................................................................................................................3
2. What is a Toolkit?...................................................................................................................3
3. Purpose of the Toolkit............................................................................................................3
4. How to use this Toolkit...........................................................................................................3
4.1 Stage 1: Establishment...................................................................................................4
4.2 Stage 2: On-Going operations........................................................................................4
5. Intended Scope of Application................................................................................................5
6. Policies & Templates..............................................................................................................5
7. Scalability and Tailoring of Documents..................................................................................7

2
 Internal Control Toolkit Guidance

1. Introduction
This Internal Control Toolkit (the “Toolkit”) is to support an entity throughout its lifecycle by
facilitating the adoption of key internal controls, standard policies and providing standardized
templates.

The Toolkit provides an entity with key internal controls, policies and templates that may be adopted
by newly established entities to help govern their day-to-day activities. The Toolkit addresses the key
processes and functions that are applicable to a variety of entities within the different stages of their
maturity lifecycle.

The policies and templates included within this Toolkit support the entities’ Management team in
performing their activities in a systematic and institutionalized manner, thus reducing
inconsistencies, increasing accountability, and promoting a system of behavioral governance across
the entity.

2. What is a Toolkit?
A “tool” is an instrument (e.g. guidelines, or checklist) that helps users accomplish a specific task that
contributes to meeting a specific recommendation or practice standard.

A “toolkit” is a collection of related information, resources, or tools that together can guide users of an
entity to develop a plan or organize efforts to meet specific practice standards.

Toolkits provide action-oriented guidance for governance practitioners to apply to their work.

3. Purpose of the Toolkit

The purpose of this Toolkit is to support an entity leadership in the setup and operation of their
entities. The toolkit also supports process owners, managers, and employees in their daily work,
providing key requirements per each stage of the entity’s lifecycle, background information on key
processes, specific process description, as well as templates and forms developed in alignment with
best international practices.

This toolkit is intended to:

• Define the minimum requirements and steps to be followed during each stage of the entity’s
lifecycle.
• Define the recommended requirements and steps to be followed while establishing new
entities that will support effectiveness and efficiency.
• Provide an overview of the proposed governance structure for newly established entities.
• Promote consistent good practices amongst entities.
• Provide templates & forms for key departments’ activities.

3
4. How to use this Toolkit
This Toolkit can be read in its entirety or separated by topic. Although the toolkit requirements and
topics are grouped based on the lifecycle of an entity. The Toolkit documents do not need to be read in
sequence (however, we recommend that readers pay attention to phase (1): Incubate, as it is the
preliminary stage of an entity’s lifecycle).

4.1 Stage 1: Establishment

Phase (1): Incubate

Represents the initial phase of an entity’s establishment lifecycle. This includes the development of
minimum legal and operational requirements during the establishment stage of an entity to
commence its assigned preliminary mandate.

Phase (2): Launch

Represents the internal structuring phase of the entity’s establishment lifecycle. This includes the
necessary appointments and infrastructure needed to deem the entity operational.

Phase (3): Grow

Represents the development of support functions phase of the entity’s establishment lifecycle. This
includes the customization and enhancement of the policy manuals in the Launch stage and the
development of additional policies/manuals as required. During this stage, the risk appetite and KPIs
of the entity should also be defined.

Phase (4): Accelerate

Represents the final phase in the entity’s establishment lifecycle. This includes the development of all
the necessary policies and procedures to clearly outline the roles and responsibilities of both senior
management and employees of the entity. This stage aims to achieve sustainability and accountability
within the entity.

You should consider the following guidelines when using the toolkit:

1. Review the entire toolkit thoroughly.

2. Ensure that all mandatory requirements and steps are implemented and adhered to.
3. Review all supplementary recommended requirements
4. Determine which documents, policies, and templates apply to the entity, in whole or in part.
5. Download the applicable and editable documents.
6. Customize the forms and policies to ensure they are tailored to your entity and are fit for purpose.
7. Apply your entity’s branding and logos onto the forms if you desire to do so.
8. Ensure proper implementation of the forms and policies within your operations.
9. Maintain proper documentation of the newly tailored / amended documents at the entity files.

4.2 Stage 2: On-Going operations

Phase (5): Stabilize

4
Represents the stage after which establishment has been achieved, and entity operations are on-going.
During this phase all developed internal controls (charters, policies, manuals, etc.) must be assigned a
periodic review cycle in alignment with policy stipulations and/or best practice. Accordingly, these
internal controls must be reviewed in order to facilitate continuous improvement.

5. Intended Scope of Application

This guiding toolkit applies to all new entities established. The mandatory requirements need to be
given priority and applied as per the guidance in the toolkit.

Process owners, managers, and employees who are accountable for the administration and operation
of the entity should use this document as their guiding tool in implementing their tasks and
responsibilities with professionalism and due care.

Finally, applicable policies and procedures should be communicated to all departments of the entity,
and managers should ensure compliance with these policies.

6. Policies & Templates

Each stage of the lifecycle is comprised of a set of mandatory and recommended requirements
“Controls”. The below table summarizes the policies and templates that are specific to each stage,
and aims to streamline the establishment of entities, and expediting the maturity of entities, whilst
maintaining overall accountability and proper governance:

Stage # Document
1 High-level Governance Charters
2 Senior Management authorities
3 High Level Procurement Policy
1: Incubate
4 High Level Finance Policy
5 High Level HR Policy
6 Managing Director’s KPIs Document
7 Code of Conduct
8 Organization Structure (General Template)
9 Manpower Plan
10 Job Descriptions (Illustration \Template)
11 Comprehensive DoA Matrix
2: Launch
12 Procurement Manual
13 Finance Manual
14 HR Manual
15 Marketing, communication and PR Strategy / policy
16 Budget Document
17 Governance Policies
18 Initial Risk Identification Document
3: Grow 19 Legal Policy
20 IT Policy
21 Project Management Policy
4: Accelerate 22 ERM Framework
23 Business Continuity Plan

5
 24 Subsidiary Governance policy
25 General Services Policy
Policies developed in the above phases should be reviewed in order
5: Stabilize
to facilitate continuous improvement

7. Scalability and Tailoring of Documents

The Toolkit has been designed in accordance with leading and best practices. The policies and
processes included within this toolkit have been customized and tailored for use by public and private
entities in the Kingdom of Saudi Arabia.

Whilst the envisaged entities are expected to share similar general characteristics, differences will
emerge in terms of size, industry, complexity, level of risk, and required level of control, and in some
instances due to the laws/standards that are specifically applicable to the entity. Thus, this toolkit
is a for guidance purposes and is not mandatory until approved by the appropriate
authority of the entity. This toolkit is agile in nature and allows the flexibility to amend the
requirements to be fit for purpose to each different entity.

The policies and templates included in this toolkit are intended to be evolving documents that can be
amended if and when needed. As new entities evolve, it is anticipated that existing contents may
require amendment and new content may need to be introduced.

These policies & templates should be reviewed annually by their relevant departments to ensure that
they are up to date and fit for purpose.

Amendments, enhancement to these documents, and any new manuals deemed necessary should be
executed as per the Document Changes Procedures adopted by the entity and approved in accordance
with entity’s Delegation of Authority Matrix (DoA).