Do Saudi Smes Need a Statutory Audit? a Guide to Audit Obligations in Saudi Arabia

Statutory audit requirements Saudi Arabia sit at the centre of the compliance planning agenda for every small and medium enterprise in the Kingdom. For SME owners and finance directors, the practical question is deceptively simple but commercially significant: does your company have to appoint an external auditor, or does an exemption apply? This guide answers that question in plain language, explains how the applicable tests work, sets out the common exemptions, and provides a step-by-step roadmap for the next 90 to 180 days. Throughout, we point you to the primary legal and regulatory sources so you can verify each point against the official texts before acting.

Because the audit and corporate-reporting framework in the Kingdom continues to evolve, you should always confirm the current position against the official texts before relying on it.

Quick summary, Do Saudi SMEs need a statutory audit? (TL;DR)

If you only read one section, read this one. The following bullets capture the key facts on statutory audit requirements Saudi Arabia SMEs should know, with immediate actions grouped by timeframe.

• Who is caught. Companies structured as joint stock companies, and entities that are separately required to be audited by another regulator (for example the Capital Market Authority for listed companies, or the Saudi Central Bank for regulated financial institutions), must appoint a licensed statutory auditor. Under the Companies Law, limited liability companies are also generally required to appoint an auditor.
• Who may be exempt. Certain smaller or dormant entities, and certain branches or entities audited under sector-specific rules, may fall outside particular obligations, but any exemption should be documented, not assumed.
• Within 30 days. Assess your legal form, turnover, total assets and headcount, and confirm whether any sector regulator already imposes an audit obligation.
• Within 90 days. If you are caught, pass a resolution, tender and appoint a Saudi Organization for Chartered and Professional Accountants (SOCPA) licensed auditor, and gather your core financial records.
• Within 180 days. Complete your reporting setup, reconcile Zakat and VAT positions, and finalise financial statements ready for the audit engagement.

The detailed sections below expand each point and provide comparison tables, checklists and worked examples.

Who must appoint a statutory auditor in Saudi Arabia?

The starting point for understanding statutory audit requirements Saudi Arabia imposes is that the obligation flows from two distinct sources. The first is Saudi company law, the Companies Law issued by Royal Decree, which sets out which categories of entity must appoint an auditor. The second is the body of sector-specific regulation, administered by regulators such as the Capital Market Authority (CMA) and the Saudi Central Bank (SAMA), which can impose an audit obligation regardless of a company’s size.

Under the Companies Law framework, joint stock companies must appoint one or more auditors, and limited liability companies are generally required to appoint an auditor as well. The practical effect is that many SMEs that assumed they were outside the audit obligation should revisit their position rather than rely on historic practice, particularly as digital-reporting and record-keeping expectations continue to tighten across the Kingdom.

Entities explicitly covered

Certain entities are subject to a statutory audit irrespective of their size. These include:

• Listed companies. Companies with securities admitted to trading on the Saudi Exchange (Tadawul) are subject to mandatory audit under CMA rules, which sit alongside, and are not displaced by, company law.
• Regulated financial institutions. Banks, insurers, finance companies and other entities supervised by the Saudi Central Bank are required to be audited under their sector licensing conditions.
• Joint stock companies. Entities structured as joint stock companies are, as a class, required to appoint one or more external auditors under the Companies Law.
• Entities with public-interest characteristics. Companies that manage third-party funds, hold public deposits or otherwise carry public-interest features fall within scope by virtue of their activity rather than their balance sheet.

For these entities, the question is not whether an audit is required but how to run the engagement efficiently. If your company falls into any of these categories, treat the audit obligation as settled and move directly to the preparation roadmap below.

Entities covered by their legal form and size

A large group of SMEs is caught by their legal form. Limited liability companies are generally required under the Companies Law to appoint an auditor, so most incorporated SMEs of any meaningful scale will need one. Sole proprietorships and certain very small or dormant structures may sit outside particular requirements, but the analysis depends on legal form, activity and applicable regulator rules.

Because outcomes turn on legal form, activity and sector, an SME that is comfortably small but holds a regulated licence, or that has grown its activities, may still be caught. This is where many owners misjudge their position, and it is the reason the analysis should be revisited annually rather than once. The exact obligations and any size-based tests should be confirmed against the current Companies Law and its implementing regulations, together with any relevant regulator rules. The next section explains how the analysis fits together.

Statutory audit requirements Saudi Arabia: legal form and applicable tests

Determining your obligation correctly is the single most important step in assessing whether you need an auditor. The analysis turns on your legal form, whether any sector regulator applies, and, where relevant, any size-based criteria in the applicable rules. The interaction between company law, prior practice and sector-specific requirements determines the outcome for any given SME.

Before applying any test, confirm which financial year is being assessed. The obligation is assessed by reference to a company’s completed financial year, so a business that changes its status mid-year should plan on the basis that the audit requirement will apply to the year in which the change occurs. Owners should confirm the precise triggers against the current statutory language.

Obligations and application, how they fit together

How to apply the analysis for group companies and branches

Group structures complicate the picture. Where an SME is part of a group, consolidated reporting obligations may apply, meaning the turnover, assets and headcount of related entities are relevant. A holding company that individually looks small can still carry audit obligations once its subsidiaries are considered. Wholly-owned branches of foreign companies present a further wrinkle: the branch’s own position matters, but so too may the reporting obligations of the overseas parent.

Consider three worked examples to illustrate how the analysis applies in practice:

• Example 1, trading company. A Riyadh trading LLC is generally required under the Companies Law to appoint an auditor by virtue of its legal form. Little further analysis is needed; it must appoint an auditor.
• Example 2, asset-heavy start-up. A technology company with modest turnover but significant capitalised assets and a growing team should not assume it is outside the audit regime on the basis of low sales alone; its legal form and any applicable rules govern.
• Example 3, small group. A holding company that individually looks small but owns two operating subsidiaries may face consolidated reporting and audit obligations once the group is considered.

Because misjudging the analysis is a common cause of accidental non-compliance, SMEs uncertain about their position should take advice before concluding they are exempt.

Common exemptions and special cases for SMEs

Exemptions are narrower and more evidence-based than many owners expect. Understanding the audit exemptions Saudi companies can rely on is essential, because claiming an exemption you do not qualify for carries the same enforcement risk as failing to appoint an auditor at all. The following categories are the most relevant to SMEs, and each should be confirmed against the current rules.

• Certain small or unincorporated structures. Some very small or unincorporated businesses may sit outside particular audit obligations, but this depends on legal form and activity.
• Entities audited under sector-specific laws. Where a specialised regulator already imposes an audit obligation, the sector framework governs, and there is no need to duplicate the engagement.
• Certain branches and representative offices. Some wholly-owned foreign branches and non-trading representative offices may fall outside a general audit obligation, depending on their activity and the reporting done at parent level.
• Dormant or pre-trading entities. Companies that are genuinely dormant or have not yet commenced trading may sit outside some obligations, though this position must be reassessed as soon as activity begins.

How to claim an exemption and the documentation needed

Exemption is a conclusion you must be able to defend, not a default. To rely on an exemption, an SME should maintain a contemporaneous record showing the figures and legal analysis on which it relied. At a minimum this file should contain:

• Year-end management accounts evidencing turnover and total assets.
• Payroll or HR records evidencing the average employee headcount for the year.
• A short board minute or director’s memorandum recording the exemption assessment, its legal basis and its date.
• Confirmation that no sector regulator imposes an overriding audit obligation.

Keeping this documentation means that if the position is later questioned by the Ministry of Commerce or another authority, you can demonstrate a reasoned assessment rather than an assumption.

Practical next steps for SME owners (90-day and 180-day roadmap)

Once you have determined that statutory audit requirements Saudi Arabia rules apply to your company, the priority shifts to execution. A structured timeline reduces cost, avoids last-minute scrambling and gives your chosen auditor a clean set of records to work from. The following roadmap breaks the work into three phases.

0–30 days: assess and decide

• Confirm your legal form and whether any sector regulator imposes an audit obligation.
• Review turnover, assets and headcount for your most recent completed financial year.
• If you conclude you are exempt, prepare and retain the exemption documentation described above.
• If you are caught, notify your board and begin the auditor selection process immediately.

30–90 days: appoint and prepare

• Pass the appropriate corporate resolution appointing a SOCPA-licensed statutory auditor.
• Agree and sign an engagement letter that defines scope, timing and fees.
• Assemble core financial records: trial balance, general ledger, bank statements and reconciliations.
• Begin reconciling Zakat and VAT positions so that tax adjustments do not derail the timetable.

90–180 days: report and embed

• Complete your reporting setup to meet applicable electronic filing expectations.
• Finalise financial statements under the applicable IFRS-based framework endorsed by SOCPA.
• Support the auditor through fieldwork and respond promptly to queries.
• Review any management-letter points and put remediation actions in place for the following year.

Who to appoint and how to tender

Choosing the right auditor matters as much as appointing one on time. Look for a firm licensed by SOCPA with genuine SME experience, a clear fee basis and the capacity to meet your reporting deadline. Where you have a choice, run a short competitive tender: request proposals from two or three firms, compare scope and fees on a like-for-like basis, and confirm each firm’s independence position before appointing. A structured tender protects you on price and quality.

How SMEs should prepare: documents, timelines and common audit pitfalls

Preparation determines both the cost and the duration of your engagement. A well-prepared SME can complete a statutory audit far more quickly than a poorly prepared one, which can incur higher fees as the auditor chases missing records. The single biggest driver of cost is document readiness.

Documents auditors will typically request

• Year-end trial balance and general ledger.
• Bank statements and bank reconciliations for all accounts.
• Fixed-asset register with additions, disposals and depreciation.
• Accounts receivable and payable ageing analyses.
• Inventory records and stock-count documentation.
• Zakat and VAT returns with supporting workings and reconciliations.
• Payroll records and employee headcount data.
• Board minutes, contracts and key legal documents.

Assembling these before the auditor begins, rather than in response to requests, is the fastest way to compress the timeline.

Sample timelines and common pitfalls

A well-organised SME with clean records can expect a relatively short engagement. A company with incomplete reconciliations or a first-time audit should allow considerably more time. The most frequent pitfalls that extend the timetable are:

• Unreconciled Zakat and VAT. Differences between filed returns and the ledger are among the most common findings and often require adjustment before the accounts can be signed.
• Missing fixed-asset records. An incomplete asset register forces the auditor to reconstruct history, adding time and cost.
• Unsupported related-party balances. Intercompany and shareholder balances without documentation attract scrutiny.
• Late appointment. Engaging an auditor close to the reporting deadline leaves no room to resolve issues.

Avoiding these pitfalls is largely a matter of housekeeping done in advance. SMEs that treat audit readiness as a year-round discipline rather than an annual event consistently report lower fees and faster completion.

External auditor appointment process and independence obligations

The appointment of an external auditor is a formal corporate act, not a casual procurement decision. Getting the process right protects the validity of the engagement and ensures the auditor can act independently. Under the framework administered by SOCPA, only licensed practitioners may perform a statutory audit, and independence rules constrain the non-audit services a firm can provide to the same client.

The appointment steps for an SME are broadly as follows:

1. The shareholders, or the board, depending on the company’s constitution and the Companies Law, resolve to appoint a named SOCPA-licensed firm.
2. The company and the auditor agree scope, timing and fees, recorded in a signed engagement letter.
3. The auditor confirms its independence and completes its client acceptance procedures.
4. The engagement proceeds, culminating in a signed audit report.

On fees, SME statutory audits are typically priced by reference to the size and complexity of the business and the state of its records. A company with clean, reconciled accounts will generally pay less than one whose records require remedial work, which is a further reason to invest in preparation before the tender stage.

What to include in an engagement letter

A clear engagement letter avoids disputes later. At a minimum it should set out:

• The scope of the audit and the reporting framework to be applied.
• The respective responsibilities of management and the auditor.
• The agreed timeline, including fieldwork dates and the target report date.
• The fee basis and any assumptions about the condition of records.
• The auditor’s independence confirmation and any limits on non-audit services.

Penalties, enforcement and what happens if you don’t comply

Non-compliance with statutory audit requirements Saudi Arabia imposes is not a low-risk gamble. Failure to appoint a statutory auditor when required, or to prepare and file financial statements as required, can expose both the company and its directors to consequences. While the precise penalties should be confirmed against the current Companies Law, its implementing regulations and relevant regulator rules, the enforcement toolkit typically includes:

• Administrative fines. Financial penalties for failing to appoint an auditor or to prepare and file accounts on time.
• Director and management liability. Potential exposure for those who allow the company to operate in breach of its reporting obligations.
• Registry consequences. Interaction with the Ministry of Commerce and the commercial registry, which can affect a company’s standing and its ability to complete corporate filings.
• Restrictions on activity. Measures that can limit a company’s ability to complete certain corporate actions or renew licences until the position is regularised.

Tax exposure compounds the picture. Where an audit uncovers Zakat or VAT that has been under-declared, the Zakat, Tax and Customs Authority (ZATCA) may levy penalties on the shortfall, so audit adjustments frequently carry a direct tax cost. Companies that identify a breach should move quickly to appoint an auditor and remediate, as prompt voluntary correction is generally viewed more favourably than a position discovered by the authorities.

Comparison: statutory audit vs voluntary review engagement for SMEs

Some SMEs that are not required to be audited still commission assurance work voluntarily, often at the request of a lender, investor or supplier. It helps to understand the difference between a full statutory audit and a lighter review engagement.

The rule of thumb is simple: if you are required to be audited, a review engagement is not a substitute, you need a full statutory audit. If you are genuinely exempt but a stakeholder wants comfort, a review may be a proportionate and cost-effective choice.

Conclusion and next steps

Statutory audit requirements Saudi Arabia affect a wide group of SMEs, principally because most incorporated companies are required to appoint an auditor under the Companies Law, and because sector regulators impose their own obligations. The disciplined response is to confirm your legal form and assess your position against the current rules, check whether any sector regulator imposes an obligation, document any exemption you rely on, and, if you are caught, appoint a SOCPA-licensed auditor and prepare your records within the 90 to 180 day window set out above. Doing this early protects your directors, avoids penalties and keeps audit fees down.

If you are uncertain whether the statutory audit requirements Saudi Arabia imposes apply to your company, seek a compliance review before the reporting deadline rather than after it.

Sources

1. Saudi Organization for Chartered and Professional Accountants (SOCPA)
2. Capital Market Authority (CMA)
3. Zakat, Tax and Customs Authority (ZATCA)
4. Ministry of Commerce (Kingdom of Saudi Arabia)