Saudi Industrial Due Diligence: The Workforce Compliance Question Most Checklists Miss

Take a pattern that recurs. An infrastructure fund holds a position in a Saudi industrial services business. In the second quarter the operating company reports a utilisation miss. The explanation, when it eventually arrives, is that thirty-one workers lost access to a client facility because their certificates had expired, and the earliest available renewal slot was five weeks out.

Nobody modelled that. It does not appear in the financials as a compliance failure. It appears as a soft quarter.

Workforce certification sits in an awkward gap in most operational due diligence. It is too operational for the legal workstream, too regulatory for the commercial one, and too unglamorous for anyone to raise in an investment committee. Yet on Saudi industrial sites it is a direct determinant of whether revenue-generating people are allowed through the gate on any given morning.

Site access is a credential problem, not a headcount problem

On major Saudi industrial sites, and particularly those operated by or on behalf of Saudi Aramco, an individual worker cannot be badged onto site without documented evidence of specific training. The requirement attaches to the task rather than to the person's seniority. Permit handling, work in sour gas environments, lifting operations and powered access each carry their own credential, issued under its own scheme, with its own expiry.

That produces an operational obligation most investors never see in a data room: a rolling schedule of expiries across a workforce, where a lapse removes an individual's ability to earn until it is fixed.

The credentials themselves are auditable, which is the useful part. Providers publish what each programme covers, the standards it maps to and how long the resulting certificate remains valid. Tamkene Training Services, a Dammam-based provider working across Saudi Arabia's industrial sector, is a reasonable illustration of what a checkable record looks like. Its published outline for the safety oversight role names the specific standards the training aligns to, states the certificate's validity period, and sets out how a certificate can be checked without picking up the phone, in this case through a QR code and serial number that resolve to the provider's own verification portal.

That last point deserves more attention than it usually gets. A credential that can only be confirmed by emailing someone is a credential you cannot diligence at scale. If you are reviewing a workforce of four hundred, the difference between certificates you can check one at a time and a spreadsheet supplied by management is the difference between evidence and assertion. Worth being precise about one thing, though: a provider-run portal is issuer verification, not independent verification. Where a credential genuinely gates site access, the awarding body's own register is the stronger check.

Why it does not show up in a data room

Three reasons, in roughly descending order of how often they apply.

The first is categorisation. Training expenditure lands in overheads, where it looks like a small and stable cost line. Its actual significance is as a schedule and availability variable, and overhead lines are not where anyone goes looking for those.

The second is that the obligation belongs to the client, not the asset. Site access requirements are imposed by the facility operator, which means they are governed by contracts and site procedures rather than by anything in the target's own regulatory filings. If you diligence the target's licences you will not find them.

The third is that it usually works. Most operating companies in the Kingdom manage their credential registers competently, which means the risk is invisible right up until the quarter it is not.

Questions worth adding to the checklist

None of these require specialist knowledge to ask, and the quality of the answer tells you a good deal about the operating discipline underneath.

Ask to see the credential register itself rather than a summary of it. What you want to know is whether expiries are tracked centrally with lead time, or whether renewals happen when somebody is turned away at a gate.

Ask what proportion of the workforce holds credentials expiring within the next two quarters. A cluster of expiries in one window is a scheduling problem waiting to happen, and it is trivially visible once you have the register.

Ask which provider or providers hold the approvals for each credential the workforce depends on, and whether more than one provider in the region is approved for the critical ones. Single provider dependency for a credential that gates site access is a concentration risk, and it is one nobody names as such because it does not look like a supplier relationship.

Ask whether training can be delivered at the operating site rather than at a provider's centre. On-site delivery compresses the calendar and removes travel, which matters most in exactly the situation where it is needed: a block of expiries arriving at once.

Ask about language coverage across the workforce. Industrial crews in the Gulf frequently include workers whose working language is neither English nor Arabic, and pass rates suffer when instruction is delivered in a language a candidate only partly follows. Some Saudi providers deliver in English, Arabic, Urdu and Hindi as standard. A failed assessment costs the same lost days as an expired certificate.

The provider layer is thinner than it looks

Approval in the Saudi training market is scheme-specific and course-specific rather than blanket. A provider may hold government recognition from the Technical and Vocational Training Corporation and the Saudi Standards, Metrology and Quality Organization, and separately hold authorisation from international bodies such as IADC, IPAF or NEBOSH, and separately again be recognised by a particular client for a particular list of courses. Those are distinct categories, and holding one implies nothing about the others.

For an investor this matters in a specific way. When you ask an operating company which providers it uses, the answer often arrives as a list of names. The more useful version is a matrix: which credential, issued under which scheme, by which approved provider, with what alternatives if that provider loses the approval or loses capacity.

Most of the credentialing bodies maintain public registers, so the matrix is verifiable from outside the company. IPAF and NEBOSH both publish directories searchable by company name and country, and IADC lists its accredited providers.

Why this is getting more relevant, not less

Capital deployment into Saudi industrial and infrastructure assets has been running hard under the programmes set out in Saudi Arabia's official Vision 2030 framework, and the credentialed workforce required to build and then operate those assets is a constraint that sits outside most investment models. Where certification capacity is tight, expiry clusters stop being an administrative inconvenience and start showing up in utilisation.

There is nothing exotic about the risk. It is a scheduling and evidence problem with a well-understood shape, and it is cheap to diligence properly. The reason it keeps surprising people is simply that it belongs to nobody's workstream.

An hour spent on the credential register during diligence will tell you more about an industrial services business's operating discipline than another pass through the management accounts.

Frequently asked questions

Why does workforce certification matter to an investor rather than only to the operator?

Because it determines availability. On credential-gated sites, a worker without a current certificate cannot be deployed, so an expiry cluster converts directly into lost billable days. That flows through utilisation and margin without ever being labelled a compliance issue, which is precisely why it is easy to miss.

What should appear in a data room for workforce compliance?

At minimum, a credential register listing individuals, credentials held, issuing scheme and expiry date, plus the renewal calendar for the next twelve months and the list of approved providers used for each credential. If none of that exists in structured form, that absence is itself a finding.

How do you verify that a training certificate is genuine?

Start with the issuing body. Most international schemes maintain public registers of approved training centres, and several allow certificate or card verification directly. Some providers also issue certificates with a verification mechanism attached, such as a QR code linking to a check page. Certificates that can only be confirmed by asking the provider are worth sampling more heavily.

Is this specific to Saudi Arabia?

The mechanism is not, but the intensity is. Credential-gated site access is common across high-consequence industrial operations globally. What makes the Saudi market distinctive is the concentration of large operators applying strict access requirements alongside a rapid buildout, which tightens training capacity at the same moment demand for it rises.

What does remediation cost if a gap is found after completion?

Usually less in fees than in time. The course fee is rarely the constraint. The costs that matter are paid non-productive days while people are in training, travel where delivery is not on site, and the wait for an available assessment date. Budget the calendar rather than the invoice.