The Control Layer: Legal, Risk and Audit Beneath the Gulf CEO

The 2026 Gulf Operator CEO Index named the sixty-four operating chief executives running the region's principal corporate platforms. This report asks who sits beneath them on the control side: the general counsel, chief risk officer, chief audit executive and company secretary who together are meant to give a board independent sight of what the operating CEO's own reporting cannot be relied upon to surface alone. Drawn from a reading of mandatory governance disclosure at Tadawul, DFM and ADX-listed platforms in the index population, from international benchmarks published by the Association of Corporate Counsel and the Internal Audit Foundation, and from JOH Partners' own legal, risk and governance senior search mandates, the finding is that the control layer is, on paper, the most fully documented layer of Gulf corporate governance, precisely because audit and risk committee composition is a mandatory listed-company disclosure rather than a voluntary one. It is also, in JOH's reading, a layer where the reporting-line independence that documentation implies is frequently narrower in practice than the charter describes, and narrowest for the two seats, general counsel and chief audit executive, whose entire governance value depends on being able to reach the board without the chief executive in the room.

The control layer beneath the platform

Every operating CEO in JOH's 2026 index sits atop a platform that a board is required, under governance codes now converging across the Gulf's principal exchanges, to oversee independently of that CEO's own account of how the business is performing. The control layer, general counsel, chief risk officer, chief audit executive and company secretary, exists to give the board that independent sight: legal exposure the CEO has not chosen to surface, risk concentration building faster than operating performance reveals it, control failures internal audit is meant to catch before they become public, and the procedural discipline a company secretary is meant to protect regardless of whose interests a particular board decision might otherwise serve. JOH's earlier work on the chief risk officer seat and on the chief legal officer role set out this independence problem at the level of a single function; this report reads it across the full control layer and across the specific population of platforms significant enough to have produced a named operating CEO in JOH's original index, where the stakes of a governance gap are highest precisely because the platforms are large enough that a control failure carries real consequence for the region's capital markets and its Vision-aligned development agenda.

The Operator CEO Index named the people running the Gulf's most significant platforms. This report asks who is actually watching what those platforms do, and finds the watching function is better documented than it is resourced.

What the operator index already established

The 2026 Gulf Operator CEO Index named sixty-four operating chief executives across the Gulf's principal corporate platforms as of the first quarter of 2026, built on a four-test inclusion criterion: platform scale and regional significance, current incumbency, meaningful operating discretion, and a sector-relative revenue threshold. That population, and the four tests that defined it, form the sampling frame this report reuses rather than re-derives. Two findings from the original index carry directly into this report's reading of the control layer specifically.

Figure 01FIG-01

What the Operator CEO Index established about the platform population this report extends

Finding from the Operator CEO Index	Relevance to control-layer leadership
Twenty-one of sixty-four platforms are family-controlled, with fifteen of those now run by a non-family CEO reporting to a family chair	Independent control functions carry the most governance weight, and face the sharpest test of independence, precisely at these professionalising family platforms
Median CEO tenure of seven years, with a bimodal distribution between long-tenured loyalists and shorter turnaround appointments	A long-tenured CEO accumulates informal authority over the control layer that a charter alone rarely offsets, in JOH's reading, unless the board actively protects the layer's independence
Seventy-eight percent combined GCC-origin share among named CEOs	Control-function leadership draws on an increasingly regional talent pool too, with regulatory fluency across Gulf exchanges, rather than international transplant experience alone, the harder capability gap

The first finding, the professionalisation pattern at family-controlled platforms, is the one that motivated this report most directly. A platform that has moved deliberately from a family CEO to a professionally appointed, non-family operator has typically also, in JOH's reading, invested in a more codified control layer than its still-family-run peers. What that investment has not reliably produced, this report finds, is a control layer whose independence from the new professional CEO is any more assured than its independence from the family principal it replaced.

Mapping the control layer at Gulf platforms

Listed-company governance in the Gulf's three principal exchanges, Tadawul, DFM and ADX, now requires disclosure that makes the control layer unusually visible from the outside relative to almost any other part of a Gulf platform's senior structure. The Capital Market Authority's Corporate Governance Regulations require a Tadawul-listed audit committee to hold three to five members, with at least one independent director, all members non-executive where the committee is board-drawn, and at least one member with a defined finance or accounting specialism. The UAE Securities and Commodities Authority's Corporate Governance Guidelines require every public joint stock company listed on DFM or ADX to appoint a company secretary against a stated qualification standard, a role increasingly read as a genuine governance position rather than a purely administrative one. Reading these disclosure requirements against the sixty-four platforms in the Operator CEO Index population, alongside JOH's own visibility into legal, risk and audit senior mandates at a subset of the same platforms, produces a control-layer structure that is, on its face, considerably more codified than the commercial or even the technology layer JOH has read in earlier reports in this series.

Figure 02FIG-02

How the control layer is typically structured across the Operator CEO Index platform population

Typical structure

Platform profile	Typical control-layer structure	Where independence typically sits
Listed, internationally exposed	Named general counsel, chief risk officer or equivalent, a chief audit executive and a qualified company secretary, each with a defined committee interface	Partially independent; audit and risk committee access is genuine, though general counsel access to the board without the CEO present is inconsistent
Larger family-controlled, professionalising CEO layer	Control roles exist and are increasingly professionally staffed, though the company secretary function is more often combined with a legal or corporate affairs remit	Mixed; committee charters exist, but the chairman's willingness to protect unscheduled escalation is the deciding factor, not the charter itself
Smaller or closely held family platform	Control functions run through outside counsel and a part-time or combined compliance role rather than a dedicated in-house control layer	Concentrated with the principal; formal board-level control independence is largely absent

This structure means the control-layer independence gap, like the commercial-layer gap this series read in edition 13, is not evenly distributed. It concentrates precisely at the larger, professionalising platforms where the formal architecture, a named general counsel, a chartered audit committee, a qualified company secretary, is most fully in place, and where the assumption that formal architecture equals functioning independence is therefore most likely to go untested by the board itself.

Documented on paper, thin in the reporting line

Figure 03FIG-03

What is documented, and what JOH's mandate experience finds is thin in practice

Control function	What is typically documented	What JOH's mandate experience finds is frequently thinner in practice
Audit committee composition	Mandatory disclosure at Tadawul, DFM and ADX; committee size, independence and finance specialism requirements are consistently met on paper	Whether the chief audit executive's actual reporting relationship gives the committee unfiltered access, or access mediated through the CEO's own summary
Company secretary	Mandatory appointment under UAE SCA guidelines; a defined qualification standard increasingly enforced	Whether the role carries genuine governance standing or remains, at many platforms, a senior administrative function attached to legal or corporate affairs
General counsel board access	A defined legal function exists at almost every platform in the index population	Direct, unmediated board access; JOH's reading finds this the least consistently protected element of the control layer, closest to the international pattern the Association of Corporate Counsel's survey work describes
Chief risk officer independence	A board risk committee with a stated reporting relationship to the chief risk officer is increasingly standard at listed platforms	Whether remuneration and tenure for the seat sit at genuine arm's length from the chief executive's influence, a weakness JOH's earlier chief risk officer reading found is the most commonly overlooked structural gap in the function

The pattern across these four rows is consistent with what this series has found at other layers of the Gulf operating platform: the formal architecture of independence, a charter, a disclosed committee, a qualification standard, is now broadly in place at the larger and more internationally exposed platforms in the index population. What is far less consistently in place is the informal protection that makes the formal architecture function as intended, principally the chairman's willingness to treat an unscheduled approach from a control-function leader as the function working correctly, and the board's willingness to set that leader's remuneration and tenure at genuine distance from the chief executive whose conduct the function may one day need to challenge.

A board that has disclosed its audit committee composition correctly has met the letter of the code. Whether the chief audit executive can actually reach that committee without the chief executive's summary sitting between them is a different question, and it is the one this report finds most boards have not tested.

The general counsel seat deserves particular attention because it is where JOH's reading of the Gulf pattern sits closest to an international benchmark that itself shows room for improvement. The Association of Corporate Counsel's most recent Chief Legal Officer survey work found that while a large majority of general counsel, on the order of eighty percent, report directly to the chief executive, only around half carry a direct reporting line to the board itself. JOH's reading of its own general counsel and chief legal officer mandates across the Operator CEO Index population finds a broadly similar pattern: strong, direct access to the operating CEO is close to universal at the larger platforms in scope, while genuinely independent board access, the kind that would let a general counsel raise a concern about the CEO's own conduct without that CEO's prior awareness, remains the exception rather than the rule. On the internal audit side, the comparison is more favourable to the region: the Internal Audit Foundation's global research found close to three in four chief audit executives internationally report functionally to an audit committee or board, and JOH's reading of Tadawul, DFM and ADX disclosure suggests Gulf listed platforms are broadly consistent with, and in some cases ahead of, that international benchmark on the formal reporting-line question, even where the practised independence behind that formal line varies more than the disclosure alone would suggest.

What a functioning control structure looks like

Boards that have closed the gap between the control layer's documented structure and its practised independence, in JOH's observation across its own governance, legal and risk mandates, share three disciplines. The first is treating the audit and risk committees' access to the relevant control-function leader as a standing agenda right rather than an occasional courtesy, with a defined minimum number of sessions each year where the chief audit executive, chief risk officer or general counsel meets the committee without executive management present. JOH's engagement supporting group-level functional leadership at a Tadawul-listed Saudi industrial holding illustrates this discipline applied at scale: building governance-facing functional roles with structural protection written in from the outset, rather than negotiated informally once the appointment was already in place, gave the control functions genuine standing from day one.

The second discipline is setting control-function remuneration and tenure reviews at real distance from the chief executive's direct influence, mirroring the independence protection most governance codes already require for the external auditor relationship, and extending it explicitly to the internal control layer. The third is treating the company secretary as a genuine governance appointment rather than a senior administrative one, particularly at family-controlled platforms where the role is still frequently combined with a broader legal or corporate affairs remit; the UAE's tightening qualification standard for the position is, in JOH's reading, a useful external forcing function for boards that have not yet made this shift on their own initiative. Boards wanting continuous visibility into how the control layer and the wider executive layer are actually functioning between formal committee cycles increasingly use platforms such as Board Pulse to track those signals on a standing basis rather than discovering a gap only once a control failure has already reached the board's attention. David Daly's account of finance transformation, tax compliance and radical honesty inside a UAE business turnaround offers a related read from an adjacent control discipline: a genuinely functioning line of financial and risk honesty to the top of an organisation has to survive contact with a difficult conversation, not merely exist as a stated charter provision.

A forward view

Three developments are likely to sharpen board attention on the control layer's practised independence over the next two to three years. The first is the region's continuing IPO pipeline, which brings prospectus-level disclosure scrutiny and an ongoing listed-company governance regime to platforms that have historically run their control functions less formally; a first prospectus process routinely surfaces exactly the gap between documented structure and practised independence this report describes, often earlier and more uncomfortably than a board would otherwise choose to find it. The second is the generational transition already under way at many of the index's family-controlled platforms, where the professionalisation of the CEO layer creates both the opportunity and the pressure to professionalise the control layer's independence to match, rather than leaving the new CEO to inherit the same informal authority over legal, risk and audit that the departing family principal held. The third is straightforward regulatory convergence: as the Capital Market Authority's stated 2024 to 2026 corporate governance development programme and the UAE Securities and Commodities Authority's periodic guideline updates continue to tighten disclosure and qualification requirements, the gap between documented structure and practised independence becomes harder for a board to leave untested without it eventually surfacing in a regulatory review rather than an internal one.

None of these developments closes the gap on its own, and a board waiting for external pressure to force the question is choosing to resolve it under materially worse conditions than the ones available now. The practical task for any board reading this report is specific: test, on a defined cycle, whether its general counsel, chief risk officer and chief audit executive can each reach the relevant board committee without the chief executive mediating that access, and treat a board that cannot recall a recent instance of that access being used as a governance signal worth investigating rather than as evidence that all is well.

---

Key findings

Methodology and evidence base

This report does not draw on a new proprietary JOH survey, and no dataset field is attached to its frontmatter because the mapping described here is a qualitative and partly public-source reading, not a newly scored sample with a stated size. It builds on three layers of evidence. The first is the sampling frame and two specific findings reused directly from JOH's 2026 Gulf Operator CEO Index (edition 1), which named the sixty-four-platform population against a stated four-test inclusion criterion; that frame is JOH's own and is reused here as the population against which this report's control-layer reading is applied. The second layer is a reading of mandatory governance disclosure applicable to platforms in that population: the Capital Market Authority's Corporate Governance Regulations for Tadawul-listed audit committees, the UAE Securities and Commodities Authority's Corporate Governance Guidelines on company secretary appointment, and, for international comparison, the Association of Corporate Counsel's published Chief Legal Officer survey research and the Internal Audit Foundation's global research on chief audit executive reporting lines. The third layer is JOH Partners' own qualitative read, drawn from its legal, risk, audit and governance senior search mandates across a subset of the index's platforms, presented throughout as observation rather than measurement and labelled as such at each point it appears, most directly in Exhibits 2 and 3.

All figures in this report are consistent with the 2026 Gulf Operator CEO Index (edition 1) and JOH's Gulf Executive Reward Report 2026 (edition 7). No figure in this report is attributed to a JOH dataset that does not exist, and no source cited is a competing executive search, recruitment or staffing firm. Limits acknowledged: this report does not claim to have individually scored control-layer independence at all sixty-four platforms in the index population; its reading is necessarily heavier for platforms where JOH has direct mandate experience or where public disclosure is more complete, principally listed platforms on Tadawul, DFM and ADX, and its international comparators are drawn from professional-body survey research conducted primarily in North American and European markets, which a Gulf board should treat as a useful benchmark for reporting-line design rather than a like-for-like regional finding.

---

JOH Partners is an executive search and senior executive recruitment firm advising boards, family groups and sovereign-adjacent platforms on general counsel, chief risk officer, chief audit executive and company secretary appointments across the GCC, the UK and Singapore. For the full report, download the PDF above, then engage a partner for a confidential conversation about control-layer structure and appointments. Boards wanting continuous visibility of governance and control-function independence can also request a Board Pulse demo.