Risk management
At ACWA Power, robust risk management is the cornerstone of our success, both at the corporate and operational levels. Our proven processes and systems enable us to achieve speed and scale with discipline and precision. Our Enterprise Risk Management (ERM) framework has been instrumental in navigating risks and uncertainties at different levels through a bottom‑up approach from site, countries, geographies and the enterprise. This not only safeguards our stakeholders’ interests but also positions ourselves to capitalise on emerging opportunities, driving sustainable growth and innovation.Abdulaziz Alateeq VP, Risk Management
Accelerating speed and scale while managing risks effectively
ACWA Power is a dynamic and visionary company with ambitious 2030 targets. In pursuit of these targets, we have implemented a robust risk management system that is embedded throughout our operations and corporate activities. This strategic approach not only ensures our sustainability but also fosters an environment where we can scale up.
Enterprise Risk Management (ERM)
At ACWA Power, ERM is a core, primary business function which enables us to proactively identify, assess, and mitigate risks throughout all our business. The areas of risk include Health, Safety, Security & Environment, Business Development, Strategy, Operations, Cyber Security & Technology, People & Culture, Financial, Legal & Compliance which may lead to financial exposure, contractual liability, business interruption and/or reputational impact and those risks relating to climate change.
Risk management reporting
In this report, we present the overarching approach and framework that underpin ACWA Power’s risk management practices. We outline the risks we identify as being materially significant to our organisation.
Oversight and management of risks
The vast scope of our business, currently spanning 13 countries, involves developing, constructing and operating capital intensive and high‑value, long‑term, critical infrastructure assets in multiple geographies, exposes us to a wide range of safety, operational, financial, legal and compliance and market risks that need to be meticulously managed to ensure reliability of supply of life‑essential water and electricity, and to achieve our current and long term business objectives.
ACWA Power’s ERM is designed to safeguard the interests of all ACWA Power stakeholders, including our customers, vendors, contractors, financial partners, employees, and shareholders. It also supports our role as a developer, investor, builder and operator of critical power generation, water desalination and green hydrogen assets.
We are committed to implementing risk management best practice by adopting sound ERM principles. This commitment has been formalised in the Company’s ERM policy, which has been endorsed by the management, Board Risk and Safety Committee (BRSC) and approved by the Board. The Company’s robust and dynamic risk management framework, presented in the summary chart below, aims to continuously identify, assess, mitigate, manage and communicate risks.
The Company’s overall risk management programme continuously monitors and reviews the principal risks relating to the Company’s business performance that could materially affect our business, financial performance, and reputation. These risks are systematically reviewed and assessed regularly to ensure we remain proactive and responsive. In addition, we also keep monitoring the external environment for geopolitical factors, economic trends and market dynamics that might impact our business such as the recent geopolitical situation in the Middle East or the Russia‑Ukraine conflict and the impact on the supply chain in Central Asia geography or the US‑China trade tensions. Risk management practices are embedded throughout the Company to reduce potential risk exposure to an acceptable risk appetite level. These risks are collated in risk profiles and are reported at geography, business unit and Company levels.
As part of our risk management culture, we started a process by which the BRSC invites the risk owners at Management Committee (MC) level to highlight and elaborate on the risks in their areas of scope and how they are managing and mitigating those risks.
Enterprise Risk Management – fundamentals
Risk appetite
Our Company’s risk appetite emphasises prudent management while allowing us to take strategic opportunities globally. Acknowledging complexities in energy and infrastructure, we address risks such as safety, market shifts, regulations, geopolitics, financial volatility, supply chain, and cybersecurity. We have a balanced approach, guided by our commitment to creating value for our stakeholders. Our Board‑approved risk appetite embraces innovation, aligns with our long‑term goals, and balances ambition with safeguarding against threats to financial stability, operational resilience, and reputation. Articulating our risk appetite reinforces responsible governance and sustainable practice, fosters stakeholder confidence and is critical to continuing our success.
The Company has developed a comprehensive Risk Appetite Framework (RAF), which is structured to promote and ensure ACWA Power’s strategy and business plan are on a Board‑approved risk adjusted basis. The RAF provides guidelines to manage, comply and monitor risk appetite statements and associated limits that the Company must follow in the pursuit of its vision and objectives. Key risk indicators are defined for each risk appetite statement and serve as an early warning to trigger corrective actions proactively.
Risk Management policy and framework
The Company has developed a robust ERM policy and framework, based on the risk appetite statements approved by our Board, with the principles delineated in ISO 31000. This holistic approach to risk management ensures identification, assessment, treatment, and monitoring of risks across all tiers of our organisation. Our ERM policy epitomises our dedication to integrating risk management into our strategic decision‑making processes, operational procedures, and corporate culture.
The ERM policy provides guidance and sets the tone from the Board regarding the management, to support the achievement of the Company’s objectives, the protection of staff and assets, and ensures financial sustainability.
Central to our ERM framework is the delineation of clear roles, responsibilities, and accountability structures, fostering effective risk management throughout the organisation. This includes designating risk owners and establishing communication channels to ensure timely and coordinated risk response.
ERM infrastructure
We have developed a robust infrastructure to support effective risk management practices across our organisation. This infrastructure encompasses various elements, including a Governance, Risk and Compliance (GRC) system as a tool for risk management, collaboration with other second lines of defence, and the establishment of clear policies and procedures.
ERM culture
ACWA Power fosters a strong risk management culture among employees through various initiatives and practices. This includes:
- Conducting a thorough risk‑orientation programme as part of the onboarding process for new employees, ensuring they understand the importance of risk management from the outset of their tenure.
- Regular risk‑management training sessions for risk owners and risk champions, promoting open communication about potential risks and encouraging proactive risk identification.
- Establishing a risk champions domain, with regular gatherings to recognise their contributions, share best practice, and promote a collaborative approach to risk management across the organisation.
- Integrating risk management into decision‑making processes and daily operations, ensuring that risks are considered at all levels of the organisation.
ERM Framework
Risk governance model
Risks are proactively identified and managed at each level of the organisation (from project companies, countries, GEOs and up to corporate functions) with the appropriate level of granularity.
Risks are reported on a regular basis to the appropriate management levels and the BRSC and the Board. The BRSC advises the Board on the Company’s risk appetite and total acceptable exposure, monitors the Company’s principal strategic, financial, operational, and business development, HSSE, People & Culture, legal & compliance risks or exposures, and advises and recommends actions to minimise such risks, future risk strategy, and provide oversight and guidance as to the overall risk management functions within the Company.
Risks and mitigating actions are reviewed on a regular basis to ensure that risk management is a continuous and iterative process, providing an accurate and timely picture of the risks and mitigating actions of the Company.
An Aligned Assurance Committee has been established to integrate the efforts of our risk, fraud, compliance, internal controls, HSSE and Internal Audit teams. The purpose of this committee is to ensure a coordinated and comprehensive approach to risk management and other assurance activities across ACWA Power. By aligning these assurance functions, the committee provides a holistic view of the organisation’s risk landscape, facilitating the effective identification, assessment, and mitigation of risks. This integration ensures that all assurance activities are performed to provide reasonable assurance on the risk landscape and gaps are identified and remediated in a timely manner.
This alignment has streamlined the assurance functions, reducing the time spent by the line function on assurance activities. Through this initiative, we are synchronising assurance activities so that multiple assurance functions can conduct their activities together or in an aligned manner, thereby increasing efficiency and minimising the time and resources required from our assets. This approach not only enhances the effectiveness of our risk management but also optimises the overall assurance process, contributing to the sustainable growth and resilience of ACWA Power.
The governance model has a comprehensive team structure and reporting flow, through project, GEO and corporate levels, and includes all business units and functions so that comprehensive risk assessments are available for the management and Board committees, which are fully able to make co‑ordinated and informed decisions.
See: Board Risk Management Committee.
Fraud Risk Management (FRM)
All organisations are exposed to the risks of fraud, corruption, misconduct, and other illegal acts. These risks can have severe consequences, including damage to reputation, financial losses, and potential legal actions. The Company is aware of these potential threats and aims to effectively address fraud risks similar to how other types of risks are managed by creating a tailored and robust programme.
The Company maintains a zero‑tolerance approach to fraud and promotes a culture of integrity at every level and established control procedures to control the risk of fraud. While fraud risks are already addressed in various policies and processes within the Company, the Company intends to embrace a more comprehensive process (in line with the leading practices) to manage the Company’s fraud risks as part of a broader FRM programme. The FRM programme includes fraud risk governance, fraud risk assessment, fraud control, investigations and corrective actions, and monitoring activities.
Risk universe
The chart below shows how risks are approached and managed within the Company. The risk management function assesses risks across the Company and clusters them logically before reporting to support risk‑informed decision‑making process. ACWA Power’s risk universe identifies internal (inner circle) and external (outer circle) risks which are categorised into four main risk areas (operational, strategic, financial and political/regulatory) as depicted by the chart. Each risk is marked by its current trend represented by arrows to denote increasing, decreasing or stable risk.
ACWA Power risk universe
The ACWA Power risk universe, shown above, identifies internal and external risks that are categorised into four main risk areas (operational, strategic, financial and political/regulatory). The trend of each risk is marked by a key‑coloured diamond to denote increasing, decreasing or stable risk.
The complete list of key risks is provided in the following tables, from page 65 onwards.
Business development
All business development projects go through a gated approval process by the Management Investment Committee (MIC) and the Board Executive Committee (BEC). Project‑related market, technical, legal and financial risks are reviewed for the required risk adjusted return.
The risk management team independently assesses and evaluates risks, as a step in the approval process. Residual risks are summarised in the form of a risk matrix with potential mitigations. Sensitivities are analysed for bid assumptions and related risks. All key risks are quantified, where feasible, in terms of rate of returns and graphically presented, including potential upsides as well. This provides reasonable assurance on the project’s risk profile and ensures informed decision making by the Management, the BEC and the Board. This process covers all investments (greenfield, brownfield and acquisitions), divestments and changes in offtake agreements, if and when applicable.
All the investments must be in compliance with Board approved Risk Appetite Statement (RAS) and Investment Principles (IP). Any RAS/IP breaches will be reported to the BRSC for information and the BEC or Board for approval.
Construction
ACWA Power’s strategic approach to construction risk management is rooted in its commitment to developing scalable investment platforms and maintaining a technologically and geographically diversified portfolio. As the risk landscape continues to evolve, particularly with a large number of projects currently under construction, the Company has implemented a comprehensive risk management framework to ensure resilience and success across its project portfolio.
Central to this approach is the proactive identification, assessment, and mitigation of potential threats throughout the project lifecycle. We remain actively engaged with its EPC contractors, encouraging thorough risk assessments that quantify financial impacts, potential schedule delays, quality issues, health and safety concerns, and reputational risks. This collaborative process, combined with the Company’s centralised expertise, enables the construction oversight team to gain critical insights and act decisively. By focusing on these key elements, the Company not only enhances its ability to deliver projects on time and within budget but also maintains its competitive edge in the dynamic construction landscape. This strategy ensures that we remain resilient and well‑positioned to capitalise on opportunities while effectively managing the complexities inherent in its diverse project portfolio.
Operations and maintenance
The Company uses centralised expertise via NOMAC, a 100% owned O&M subsidiary of ACWA Power, to optimise the operation and maintenance of our fleet of assets, which are diversified in technology and geography, and this ensures effective management and mitigation of risks associated with operational safety and reliability of supply.
Contractual risks are managed through an effective contract compliance and tracking mechanism. Operational risks are managed through robust operational and maintenance procedures including digitised condition monitoring and prediction. Supply and price risk are managed by a comprehensive and efficient global supply chain management. In addition, the Company also plays a direct role in selecting its partners, contractors and technology for its projects to ensure an optimal solution for the project while reducing the overall exposure (directly or indirectly) to identified risks.
Sustainability‑related risks
Sustainability is not merely a function within our organisation but an integral part of everything we do. We invest in and develop only economically, environmentally, and socially viable projects and manage them with integrity. For example, over 50% of the gross power capacity of our projects is based on renewable energy, and we have successfully achieved an 87% reduction in energy consumption at our seawater desalination plants.
Our approach to managing sustainability‑related risks is embedded within our ERM framework. This integrated system of policies and processes ensures that sustainability risks are not treated as separate or isolated entities but are addressed alongside other business risks. We prioritise a global risk management strategy that encompasses all aspects of our operations.
Given the nature of our project‑based activities, sustainability‑related risks are identified, assessed, and managed on a project‑by‑project basis. For each project, we develop scenarios to identify potential negative outcomes, considering such factors as climate conditions, population dynamics and regulatory requirements. We evaluate the potential impact of project‑specific risks on our overall business model, strategic objectives, and financial performance. Based on this, specific mitigation measures are designed and implemented for each project. This approach ensures that our risk management strategies are effective and responsive to each project’s unique challenges and opportunities.
See: Sustainability governance.
Health and safety
Safety is our first and foremost priority. We have comprehensive HSSE procedures for construction, operations and corporate offices. We have procedures for comprehensive analyses of potential hazards, regular safety audits, and strict adherence to local and industry laws and regulations. We prioritise ongoing employee training, conduct periodic reviews of safety protocols, and leverage incident‑reporting systems and mechanisms to address emerging risks proactively. Our commitment to maintaining a safe working environment extends to continuous improvement initiatives and collaboration with regulatory bodies to ensure compliance with evolving standards. Continuous improvement ensures that lessons learnt from incidents are identified and embedded into process safety improvements.
Our focus is on Zero Significant Harm (ZSH), a strategy that prioritises proactive management of high‑severity risks.
Supply chain
ACWA Power has robust procedures to identify and manage potential sustainability risks in the supply chain.
We conduct thorough supplier assessments, regular audits, Know Your Customer (KYC) procedures, supplier engagement and management, third‑party due diligence reviews, and integrate sustainability criteria into procurement decisions.
This proactive approach helps mitigate risks and enhance transparency, and aligns our supply chain practices with our commitment to sustainability.
| Main risk areas | Key risks | Mitigants |
|---|---|---|
| Health and Safety |
| The Board, its committees, and senior management are fully committed to creating a safety culture throughout the Company. Stringent health and safety standards, guidelines, audits, and investigations in place to implement measures aimed at eliminating future incidents on assets under operations and projects under construction, enforced by dedicated in‑house HSE department. Continually reviewing environmental regulatory risks. NOMAC’s integrated HSE and quality management system have been independently certified under the ISO 9001:2015 and ISO 14001:2015. Regular awareness sessions are conducted at sites on identified red flags and area for improvement for site teams. Regular focused campaigns are conducted across the portfolio assets and corporate offices such as Line of Fire, Fall from Heights, Worker Welfare and Mental Health. Mandatory management site safety walks. HSSE Scorecards are developed for each site and corporate to track, monitor and report the performance against the set KPIs. |
| Environmental |
| Strong social and environmental impact mitigation and management, as part of sustainability framework and strategy. Integrated O&M HSE and quality management system have been independently certified under ISO 45001:2018 which sets out the requirements for an environmental management system and to enhance its environmental performance. |
| Environmental, Social and Corporate Governance (ESG) |
| Establishing a robust framework to evaluate the impact of climate‑related risks. Set time‑bound interim and end‑state targets based on the reporting principles of the Global Reporting Initiative (GRI) and the Taskforce on Climate‑related Financial Disclosures (TCFD). Identified, selected, and prioritised material topics to ensure that the effects of climate change, as well as corporate social and governance responsibilities, are routinely considered in our business and investment decisions. No new investment for high carbon emission‑based fossil fuels, such as coal thus increasing the share of our portfolio dedicated to clean and low‑carbon power technologies. Initiatives put in place on leadership in low‑carbon products, water management, health and safety, and corporate governance. Implementation of weather forecast system to alert all the teams for any potential extreme weather events. Emergency response, crisis management and business continuity plans and procedure to be in place and updated from time to time. Collaboration with the local authorities. Prioritise preventive maintenance to reduce the risk of sudden failures during extreme weather events. |
| Country and geopolitical |
| Careful selection of new markets with a diversified portfolio in 13 countries is a strong mitigating factor which spreads such risk against individual country or regional economic risks. Further, we undertake initial due diligence to identify and analyse a broad spectrum of risks at local, regional and Company level to promptly manage its exposure and related compliances. Systematic security assessments and continuous monitoring of geopolitical developments at countries where we operate to ensure Company is well placed to respond to changes in political environments. Business Continuity and Crisis Management framework. Insurance coverage wherever available and feasible. |
| Project development |
| Identify and limit key risks during the project selection and bid development process. Regionalised construction supervision and asset management activities providing management bandwidth to integrate new projects. Allocation of management resources with responsibilities to successfully manage unforeseen challenges and associated risks. Multi‑technology capability and track record for successfully managing the diversified portfolio. The Company co‑invests in all its projects with a view to maintaining technical and operational control over the project performance. In‑house technology department with strong expertise and reference for main equipment, tested in successful commercial operation with certification from third party. The Company carries out a thorough vetting process of all its equity partners. The Company seeks to employ experienced and leading original equipment manufacturers (OEMs), as well as reputable EPC contractors which provides turnkey solutions. Build out of a strong development team the new market of green hydrogen. |
| Operations and Maintenance |
| To minimise the operational risks, the company generally entrusts the BU O&M, its wholly owned and best‑in‑class O&M subsidiary, to operate and maintain its assets for the full tenor of the offtake agreements. O&M’s contracts cover the offtake agreement terms and are indexed for inflation and indexation. The applicable penalties are capped in the contracts. O&M continues to deploy monitoring and prediction digital platforms for critical equipment by using big data and advanced pattern recognition capabilities to enhance overall performance. O&M has extensive capabilities as an O&M contractor and implements a standardised management and operational model to ensure superior control and understanding of operating assets through the life cycle, provide stable long‑term income and super‑senior cash flows. O&M has a reliable supply framework to ensure high reliability of assets. O&M’s Maintenance Energy Services (NMES), a 100 percent‑owned subsidiary, provides turnkey and specialised maintenance services, including major overhauls for the entire fleet of steam turbines, combustion turbines, generators, large pumps and other rotating equipment. |
| Fuel supply and consumption |
| Most of our fossil fuel‑based plants are contracted on tolling arrangements whereby fuel supply and cost risks are borne by offtakers. Whenever tolling arrangements are not there, the fuel supply and price risk are passed to the offtaker. Ongoing plant efficiency optimisation as part of value proposition when needed to reduce or eliminate under recovery exposures. |
| Supply Chain & Logistics |
| Conduct a comprehensive review of existing insurance coverage to identify areas of potential cost savings or opportunities for more favourable terms. Implement risk reduction measures to demonstrate proactive steps are being taken to minimise risks, thereby potentially leading to reduced premiums. Increase the insurance coverage extension duration which will reduce the volatility in the prices. Robust Business Continuity (BCM) programme is established across the Company and includes a BCM Policy, framework and a developing business impact analysis covering the identification of critical processes and dependencies, Disaster recovery plans to ensure prompt and effective responses to potential disruptions. Diversified supply chains and established redundancy measures for key resources, such as energy sources or water supply routes, to mitigate the impact of disruptions in one area. |
| Construction |
| Construction is systematically contracted on a lump‑sum turnkey basis (fixed price and scope) and date‑certain contracting approach with EPC contractor. Maximum amount of risk passed on to EPC contractor through back‑to‑back contracts implying payment of liquidated damages by the EPC for any under‑performance (i.e., delays, technology – quality, function, fit for purpose – reliability, dispatch capacity and fuel consumption). Investment‑grade EPC and its consortium partners with joint and several liability to considerably reduce the EPC default risk. Force majeure protection in offtake agreements and comprehensive insurance policies to manage time and cost adjustment. Robust EPC oversight, plant commissioning and handover processes and procedures are in place to ensure quality and performance of the plants. |
| Termination and extension |
| If the cause of termination is attributable to the offtaker, the project company will receive termination payments which in most projects cover outstanding debt repayment and equity (including a return on equity). These termination payments by the offtaker benefit from direct government credit support or other forms of contractual protection. Selection of the right technology, quality construction and reliable operations to manage performance requirements of the offtake agreement. The estimated future costs of decommissioning are reviewed annually and adjusted as appropriate. Align plants’ existing useful life to its assessed economic life and timely pursue discussions with offtaker to seek extension for assets nearing expiry as part of value creation initiatives. |
| Information technology Infrastructure |
| Defence‑in‑depth strategy around IT systems (servers, network, end‑user machines, etc.) to prevent cyberattacks, in compliance with the ISO standards at corporate‑level. Regularly review, update and evaluate all software, applications, systems, infrastructure and security which includes regular vulnerability assessment and penetration testing. Proven business continuity and disaster (natural or human‑made) recovery plans. IT security assessments and periodic IT audits conducted by skilled IT auditors to ensure effectiveness of controls on IT systems. ACWA Power has been certified under the ISO/IEC 27001. |
| People |
| Dedicated recruitment‑oriented resources to cope with high‑growth demands and nationalisation efforts by the organisation to meet targets. Talent and leadership development schemes to limit turnover and manage scarce skills. Succession planning for critical roles in the organisation and key people management processes in place as part of our talent management process. Performance‑based evaluation process to enhance internal talent growth. Values‑based organisation culture that promotes respect, inclusiveness, and diversity. |
| Project financing |
| Comprehensive project finance expertise, supported by strong relationships with lenders and financial institutions (including regional, European, U.S. and Chinese institutions) together with access to competitive cost debt and equity capital. All projects/transactions are financed on a non‑recourse or limited recourse basis in a manner to make projects bankable. A large part of costs is shared with co‑investors and the development cost (both internal and external) is reimbursed at financial close from the project. |
| Financial (market risks and other macroeconomic factors) |
| Interest rates of a large part of the project finance loans are fixed through long tenor hedges at the outset. The Company continuously monitors unhedged portion (financial liabilities) to ensure the exposure remains within acceptable limits to mitigate all asset‑liability mismatch risk where possible. Embedded inflation protection in the long‑term offtake contracts. Contracts and equity return predominantly indexed to USD or ‘hard’ currencies which provides us with a natural hedge against currency movements. Multiple sources of funding facilities have been arranged through bank loans, revolving corporate facilities, bonds, sukuks and private placements to help ensure that the Company is able to manage liquidity requirements. Leverage ratios are assessed for various growth scenarios to ensure close monitoring of such ratios and to manage funding gaps. |
| Revenue |
| Long‑term offtake contract to protect us against demand or price risk. The substantial majority of the offtakers are government‑related entities with direct government credit support or with other contractual protection. EPC performance guarantees in place to protect newly built facility against any performance shortfall. O&M has implemented a reliability of supply framework along with in‑house developed plant simulation and optimisation tool to address and enhance reliability of supply in a systematic and proactive way. Wind and solar resource studies are carried out for renewable assets based on long‑term historical average. Insurance solutions to protect our assets against unforeseeable risks or unexpected business interruptions with agreed deductible periods and minimum deductible amount. |
| Legal and regulatory |
| Systematic contractual protection against changes in laws and regulations in most of the assets. Consolidation on compliance with laws and regulations, and regular monitoring for changes to regulations across its portfolio to ensure that the effect of any changes is minimised, and compliance is continually managed. Engagement of top law and tax firms to assess our positions and recognising provisions where required. Strong corporate governance and reinforcing policy and procedures to ensure full compliance with all legal, regulatory and tax requirements. Establishment of a comprehensive Compliance Framework that protects the Company’s reputation and credibility, serves shareholders’ interests, ensures customer satisfaction and reduces litigation. |
| Governance and management |
| ‘Tone at the top’ established by its Board of Directors, Board Committees, and senior management. Internal controls, systems and procedures in conformity with the relevant sanctions, anti‑bribery, anti‑money laundering and anti‑terrorism laws. Governance framework supported by ad‑hoc control by Board Committees with significant independent member participation in each Committee. Independent internal audit function reporting to Board Audit Committee. Whistleblowing programme and process to by ensure a recognised, industry‑leading ethics and compliance culture. An integrated and comprehensive, technology‑based governance, risk management, internal control and compliance tool being implemented for better alignment and reporting to reduce risks, costs, and duplication of efforts. |