Mousa Alfaifi: Strengthening Governance, Risk Management, and Organisational Resilience

Strong governance is often built behind the scenes, through effective controls, clear accountability, structured risk management, and reliable oversight. For organisations operating in complex and safety-critical environments, these functions become particularly important. Mousa Alfaifi has built his career around this area, combining more than two decades of experience across government and aviation with expertise in internal audit, enterprise risk management, governance, compliance, and organisational excellence.

Today, Alfaifi serves as Director General of Internal Audit and Risk Management at the Jazan Region Development Strategic Office, where he is responsible for strengthening internal audit operations, risk management, regulatory compliance, and governance across the organisation.

Building Internal Audit and Risk Management Functions

At the Jazan Region Development Strategic Office, Alfaifi has played a central role in establishing the foundations of the organisation’s internal audit and risk management function.

His responsibilities include overseeing internal audit operations, leading Enterprise Risk Management initiatives, and supporting communication between management and governance stakeholders. He also serves as Secretary of the Internal Audit & Risk Committee, supporting structured reporting and coordination between the organisation and its governance bodies.

One of his key achievements has been developing the internal audit charter, policies, methodology, strategic plan, and reporting frameworks in alignment with organisational objectives and Saudi Vision 2030.

He has also led the implementation of an ISO 31000-aligned Enterprise Risk Management framework, providing a structured approach to identifying, assessing, and mitigating organisational risks.

Connecting Risk Management With Strategy

For Alfaifi, internal audit and risk management are not isolated compliance functions. His experience has centred on integrating governance and risk considerations into organisational decision-making.

Through his work with executive leadership and Audit & Risk Committees, he provides structured reporting on key risks, controls, and governance matters, with recommendations intended to support accountability and continuous improvement.

His work focuses on areas including:

• Internal Audit Leadership
• Enterprise Risk Management
• Governance Framework Design
• Audit & Risk Committee Reporting
• Regulatory Compliance
• GRC Transformation
• Business Continuity
• Quality Management
• Performance Management
• Strategic Risk Mitigation

This integrated approach allows governance functions to provide practical support to leadership while maintaining appropriate oversight.

A Career Built in Aviation

Before moving into strategic governance and risk leadership, Alfaifi spent more than two decades developing his expertise within Saudi Arabia’s aviation sector.

He began his aviation career in 2003 as an Air Traffic Controller and Operations and Safety Supervisor with Saudi Air Navigation Services and GACA, remaining in this field until 2014.

During this period, his responsibilities included aviation safety, regulatory compliance, incident investigations, risk assessments, operational oversight, and safety management.

He led and participated in investigations of air occurrences, conducted gap analyses and safety impact assessments, and supported initiatives designed to strengthen safety performance within aviation operations.

This experience provided a practical foundation in risk identification and operational control within an environment where governance, safety, and compliance are closely connected.

Expanding Into Internal Audit

In 2014, Alfaifi moved into internal audit leadership within Saudi Air Navigation Services.

Over the following decade, he led teams responsible for planning, executing, and closing internal audit activities across a broad range of organisational functions.

His audit responsibilities covered areas including:

• Operations
• Safety Management Systems
• Quality Management Systems
• Enterprise Risk Management
• Governance
• Compliance
• Security
• Crisis and Business Continuity
• System Maintenance
• Engineering Systems
• Environment, Health and Safety

This cross-functional exposure enabled him to develop a broad understanding of how operational, safety, financial, compliance, and governance risks interact within complex organisations.

Driving Organisational Excellence

Before taking his current position, Alfaifi served as GRC Head and Acting Organisational Excellence Manager at the Jazan Region Development Strategic Office.

In that role, he was responsible for governance, risk, and compliance activities while also supporting organisational performance and project execution.

His responsibilities included administering performance reporting, supporting Quality Management System implementation, developing KPI frameworks, improving internal controls, and implementing process improvement initiatives.

He also served as Acting Enterprise Project Management Office Manager, helping streamline project execution processes and improve service delivery.

Bringing Structure to Performance and Accountability

A recurring theme throughout Alfaifi’s career has been the development of systems that allow organisations to measure performance, identify weaknesses, and respond to risks in a structured manner.

His work with KPI frameworks and performance management has focused on establishing clear measures for organisational performance and accountability.

Combined with his experience in internal audit and risk management, this provides a broader view of organisational effectiveness, linking performance measurement with governance, risk, compliance, and operational improvement.

Professional Credentials and Continuous Development

Alfaifi’s professional qualifications reflect the different dimensions of his career.

His credentials include Certified Internal Auditor (CIA) from The Institute of Internal Auditors, Certified Risk Based Internal Auditor (cRBIA), Certified Fraud Examiner (CFE) from the Association of Certified Fraud Examiners, and qualifications in GRC and enterprise risk management.

He has also completed professional programmes covering ISO 31000, ISO 22301 Business Continuity Management, ISO/IEC 27001 Lead Auditing, KPI management, and internal audit leadership.

His academic background includes an Executive Master of Business Administration from King Abdulaziz University, following a Bachelor of Business Administration from the same institution. He also holds a High School Diploma in Air Traffic Control Services from the Saudi Academy of Civil Aviation.

Supporting Saudi Arabia’s Transformation Agenda

Alfaifi’s current work is closely connected to the broader requirements of organisational maturity and institutional development within Saudi Arabia.

His experience in governance, risk management, compliance, performance management, and internal audit provides a practical framework for organisations seeking to strengthen accountability while supporting strategic objectives.

At the Jazan Region Development Strategic Office, this includes aligning governance and risk management practices with organisational priorities and the wider objectives of Saudi Vision 2030.

Recognition by Arab CEOs

Arab CEOs recognises Mousa Alfaifi for his contribution to internal audit, enterprise risk management, governance, and organisational excellence across Saudi Arabia’s government and aviation sectors.

From his early career in air traffic control and aviation safety to his leadership in internal audit, GRC, and enterprise risk management, Alfaifi has developed a career centred on strengthening organisational controls, improving risk oversight, and supporting informed executive decision-making.

His experience demonstrates the importance of governance functions that do more than identify risk. When properly structured, internal audit, risk management, and compliance can provide leadership with the information and oversight needed to build stronger, more resilient organisations.