DRIVING A VISION

The Executive Committee is responsible for examining the Company’s business plan and projects and managing its strategies and following up on their implementation. In addition, it makes recommendations to the Board on adopting the policies of the Company and on entering into investment projects, the acquisition of companies related to its work or the development of its current activities in line with its Strategic Plan. The Committees’ responsibilities also include making recommendations to the Board regarding the annual budget, following up on the Executive Management’s commitment to the budget adopted by the Board and monitoring the financial performance of the Company and the companies in which the Company owns more than half the capital or maintains control over the Board of Directors. The Committee consists of five members:

Number of meetings: 2

The Audit Committee was formed pursuant to a resolution by the Ordinary General Assembly on 13 April 2017 and shall continue for a period of three years.

The Audit Committee supervises the business of the Company and verifies the integrity and accuracy of financial statements, reports and internal control systems. It also supervises risk management activities, approves the annual Internal Audit Plan and reviews the efficiency of the Company’s business, including adherence to the International Professional Practices Framework (IPPF) standards. For this purpose, the Committee appoints an external entity to audit the activities of the Audit Committee and the Internal Audit Department every five years.

The Committee recommends the financial and accounting policies, and recommends to the General Assembly the appointment of the External Auditor and acts as a bridge between the Auditor and the Board. The Committee also studies the appointment of the Director-General for internal audit and adopts, evaluates, and makes decisions regarding his performance indicators. The Committee is also responsible for reviewing directives of the regulatory bodies and ensuring that the Company takes the necessary measures. The Committee is developing a mechanism which allows the Company’s employees to confidentially report any violations in the financial reports.

In accordance with Article 59 of the Corporate Governance Regulations, the Committee, in order to perform its duties, may:

• Review the Company’s records and documents.
• Request any clarification or statement from the Board members or the Executive Management.
• Request that the Board calls for a General Assembly Meeting if its activities have been impeded by the Board or if the Company has suffered significant losses and damages.

Number of meetings: 5

The Committee is responsible for risk management and information security, including recommending to the Board the policies for risk management in the Company, and giving consideration to the General Risk Management Department’s recommendations on business risk analysis and identifying and maintaining an acceptable risk level, including risks relating to services and products provided by the Company and capital investment. The Committee will also study the risks of information technology systems and ensure the adequacy of such systems to conduct business, manage the mechanisms of dealing with listed securities including deposit, registry, settlement, and publishing related information. In addition, the Committee studies the Business Continuity Plan and analyzes its impact on the Company’s business. The Committee will also prepare detailed plans on risk exposure and proposed steps to manage such risks, and submit such reports to the Board of Directors. It ensures that the risk management employees are independent of the activities that may result in the Company’s exposure to risk, and raise the risk management employees’ awareness regarding the risk culture.

Number of meetings: 4

The Committee supervises the Management of the Company’s capital investments, reviews the approved investment policy, ensures its adequacy and follows up on any corrective actions. In addition, it considers the investment strategy and studies and evaluates investment proposals submitted by the Department, and takes decisions thereon. The Committee also appoints investment managers, monitors their performance, determines their fees and dismisses them. The Committee consists of three members.

Number of meetings: 4

The Committee undertakes the tasks related to the human capital of the Company and monitors the human resources strategy and related policies. The Committee should establish and evaluate performance criteria for the Chief Executive Officer and ensure that there is a long-term succession plan for the Chief Executive Officer and Executive Management and oversee its implementation. The Committee also considers the organizational structure of the Company and evaluates and develops the competencies and qualifications of the Executive Management. The Committee is also responsible for reviewing the performance of the Board and its members and recommending the appointment of independent members of the committees emanating from the Board. The Committee consists of four members.

Number of meetings: 6

The Committee oversees the functions of the Regulatory Oversight and Authorization Division which is the executive arm directly responsible for the regulatory and supervisory activities. The Committee’s tasks are consistent with the Transition and Activation of Responsibilities (TAR) Program which aims at implementing the regulatory and supervisory powers and functions of Tadawul. These functions are carried out in accordance with the provisions of the Capital Market Law, which includes several aspects such as listing securities in the market and regulating and following-up on the ongoing commitments of companies listed in the Exchange and participants in the market. Based on the TAR Program outputs, the CMA continues to regulate the offering of securities while the listing of securities and details regarding the timing and format of disclosure mechanisms are handled by Tadawul.

Among the tasks of the Committee is to study the draft regulations and rules of the market and any amendments to them, and to supervise the communication and coordination between Tadawul and the Capital Market Authority in matters relating to market regulations. Its responsibilities include studying the Division’s recommendations regarding listing applications and suspending and delisting them, approving and supervising implementation of the listing decisions in the Main Market, the Nomu – Parallel Market and the debt markets, supervising requests to move from the Nomu to the Main Market. It also approves the issued capital change requests and applications for increasing the capital of the listed companies. The Committee consists of five members.

Number of meetings: 9

These risks arise due to poor efficiency or failure of internal and external processes, individuals, systems, or external events. These include risks due to issuances, clearing companies’ transactions, market transactions, asset and deposit transactions, market regulation, HR and material assets. The Risk and Security Division reviews all operational risk sources in collaboration with the concerned departments with a view to develop suitable policies to minimize these risks.

These are the risks associated with IT resulting from the possibility of a defect in information systems or technical structure or communication errors. IT risk management is concerned with understanding the ongoing operations and processes, identifying potential risks, and assessing the possible impact of any failures to processes or the information to be derived from them. Prevention and damage mitigation strategies must take into account human factors, especially the possibility of intentional damage, in addition to accidental damage. Such strategies include reducing the Company’s responsibility for any risks, avoiding them, mitigating their adverse effects, or accommodating their consequences wholly or partially.

These are the risks arising from improper decisions by the Company’s Management, improper implementation of regulatory decisions or lack of timely decision-making, which may result in direct loss or loss of alternative opportunities. These risks may arise out of the Company violating laws and standards established by the regulatory authorities; they may be also due to the lack of a suitable strategy to achieve short-term and long-term goals.

Financial risks are current or future risks that may affect the Company’s revenues or reduce the efficiency of operating expenses. An example is the variable nature of trading commission which constitutes a large percentage of revenue. Other risks include variability in interest rates, exchange rates and the market value of stocks that may affect the return on investment. These are in addition to the liquidity, investment, insurance and financial analysis risks. A key risk mitigation strategy is to increase income not related to trading, in order to mitigate the risks arising from market variations. Also, within the ambit of financial risks are procurement and support services risks for which an approved strategy has been put in place to reduce the potential impact.

These are risks arising from technical shortcomings and threats to information assets used by the Company that affect the achievement of business objectives. Such risks include internal and external threats to information security, threats to privacy, confidentiality and integrity of data, and risks to availability of information. The Risk and Security Division defines the level of data classification in order to ensure the efficiency of the tools, processes and controls required to grant access to such data. The Division also evaluates the ability of the Company to protect classified data considering the threats posed by any unauthorized disclosure or access.

This is the risk that interrupts the Company’s operations causing a disastrous impact and resulting in significant losses in the technical structure and level of services provided. These include risks due to infrastructure breakdowns, natural disasters, issues faced by logistic support providers, and threats to personnel.

The Risk and Security Division determines the requirements for restoring the services after major disruptive events and ensures the Company’s ability to maintain the services provided to retain the credibility of the Exchange with the market and investors. The Division also works to establish controls and plans to reduce the risk of disruption of the system or public facilities to ensure the continuity of business in line with the requirements of raising the efficiency of the market.

These are the potential risks or losses resulting from a number of external factors that constitute the external environment and affect the performance and business of the Company such as economic, political, and environmental conditions, which create risks to market members, legal risks, risks to data providers and risks to vendors and suppliers.