CMA Registered Accounting Firms Saudi Arabia 2026: Verify Eligibility & Appoint an External Auditor

CMA registered accounting firms Saudi Arabia sit at the centre of every listed and pre-IPO company’s audit governance in 2026, and the pressure to appoint the right external auditor, and to prove that appointment is compliant, has never been higher. Continued Capital Market Authority (CMA) oversight and the licensing requirements of the Saudi Organization for Chartered and Professional Accountants (SOCPA) mean that boards can no longer treat auditor selection as a routine renewal. This guide walks CFOs, audit committees and company secretaries through how to verify a firm’s eligibility, confirm SOCPA licensing, apply rotation and independence rules, and run a compliant tender and appointment process from start to finish.

The regulatory claims here point back to the official CMA and SOCPA sources so your board paper stands up to scrutiny. Because specific timelines and thresholds can change, confirm current requirements directly with the CMA and SOCPA before you rely on them.

Who this is for: CFOs, audit committees, company secretaries and legal or compliance teams at Saudi listed and pre-IPO companies preparing to verify auditor eligibility and run a compliant appointment process in 2026.

1. Quick answer: Can I appoint a CMA registered auditor in 2026?

Yes, you can appoint an external auditor in 2026 provided the firm appears on the CMA Registered Accounting Firms (RAFS) registry, holds a valid SOCPA licence, and passes your independence and rotation checks. In practice, a compliant appointment rests on four confirmations before the board resolves:

• CMA RAFS registration. The firm is currently listed on the CMA RAFS registry with an active registration.
• SOCPA licensing. Both the firm and the engagement partners hold valid SOCPA licences.
• Independence. No disqualifying non-audit services, related-party links or fee dependencies exist.
• Rotation compliance. Applicable firm and partner rotation limits and cooling-off periods are respected.

Get these four right, document them, and the formal board resolution becomes a straightforward final step. The rest of this guide explains how to prove each one.

2. What the CMA RAFS is and where to verify registration

The CMA maintains the Registered Accounting Firms (RAFS) registry, the list of accounting firms and Certified Public Accountants registered to audit entities supervised by the Capital Market Authority. If a firm is not on the RAFS list, it should not be relied upon to act as the external auditor of a listed or CMA-supervised company. Verifying registration is therefore the first, non-negotiable step in appointing any of the cma registered accounting firms Saudi Arabia relies on for statutory assurance.

a) How to search the CMA RAFS (step-by-step)

Verification is quick, but it must be done deliberately and evidenced:

1. Open the CMA RAFS registry page on the official CMA website.
2. Search by the exact legal name of the firm you are evaluating, not its trading or marketing name.
3. Confirm the firm appears with an active status and a valid registration reference.
4. Check the scope of services associated with the registration to confirm it covers the audit of the entities you intend to appoint the firm for.
5. Cross-reference the CPAs or partners listed against the individuals the firm proposes to staff on your engagement.

b) Fields to capture from the CMA registered accounting firms Saudi Arabia registry

When you confirm a firm, record the following fields so the evidence is complete and reusable in your board paper:

• Firm legal name exactly as shown on the registry.
• Registration reference as shown by the CMA.
• Registration date and current status.
• Scope of services permitted under the registration.
• Named CPAs or partners associated with the firm.

c) How to archive verification

Regulators and auditors of your own governance process will expect proof that verification took place. Save a PDF snapshot of the RAFS entry, note the access date and time, and store it in the audit committee’s records alongside the SOCPA licence evidence. A dated snapshot protects the board if the registry changes after you complete your checks. Treat this archive as part of the audit trail for the appointment, not an optional courtesy.

3. SOCPA requirements that affect auditor eligibility

CMA registration establishes that a firm can audit supervised entities; SOCPA licensing establishes that the firm and its professionals are qualified and in good standing to do so. Both are required. SOCPA, the Saudi Organization for Chartered and Professional Accountants, is the professional body responsible for licensing, continuing professional development, standards, ethics and disciplinary oversight of the accounting and auditing profession in Saudi Arabia. Its requirements are the second pillar of eligibility, with a continued focus on licensing status, independence and professional development.

a) Key licence checks, firm versus individual CPAs

Licensing operates at two levels, and boards frequently confirm only one. You should verify both:

• Firm-level licence. The accounting firm itself must hold a current SOCPA licence to practise.
• Individual CPA licences. The engagement partner and signing professionals must each hold valid, in-date individual SOCPA licences.

Request copies of both and confirm their currency directly against SOCPA records rather than relying on the firm’s assurances alone.

b) Independence and non-audit services

Independence is where eligible firms most often become ineligible for a specific client. Before appointment, establish whether the firm, or any network member, currently provides, or recently provided, non-audit services that could compromise independence. Bookkeeping, valuation work feeding into the financial statements, and certain advisory engagements can all create self-review or self-interest threats. For listed and pre-IPO companies, the board should require a written independence confirmation from the firm and interrogate any relationship that could be perceived as impairing objectivity.

c) Continuing professional development and disciplinary records

Two further SOCPA-linked checks round out eligibility. First, confirm that the proposed professionals are compliant with their continuing professional development (CPD) obligations, lapsed CPD can call a licence into question. Second, request confirmation that neither the firm nor the named partners are subject to open SOCPA disciplinary proceedings or recent sanctions. A firm can be validly registered and still carry a disciplinary history that your audit committee ought to weigh before recommending appointment.

d) Then versus now: what to emphasise

The table below summarises how the compliance emphasis has shifted over recent cycles. Use it to brief board members quickly on why the verification burden has grown.

4. Practical verification checklist to confirm a firm is eligible

The following seven-step checklist turns the eligibility rules into an operational process any finance team can run. Complete every step for each shortlisted firm and file the evidence.

1. Confirm CMA RAFS registration. Search the registry, confirm active status and registration reference, and save a dated PDF snapshot.
2. Obtain the firm’s SOCPA licence. Request a copy and verify currency against SOCPA records.
3. Obtain individual CPA licences. Collect and verify licences for the proposed engagement partner and signing professionals.
4. Request the firm’s audit quality control statement. Confirm the firm operates a documented quality control system consistent with professional standards.
5. Collect independence and AML declarations. Require a written independence confirmation and any anti-money-laundering declarations the firm is obliged to provide.
6. Verify professional indemnity insurance. Request proof of current cover appropriate to the size and risk of your engagement.
7. Validate CPD and rotation history. Confirm continuing professional development compliance and obtain the firm’s history of service to your company to test rotation limits.

a) Template request email to shortlisted firms

A single, standardised request keeps your evidence consistent across bidders. Adapt the following:

“Further to your inclusion in our audit selection process, please provide, within [X] business days: (1) a copy of your current CMA RAFS registration and registration reference; (2) your firm SOCPA licence and the individual SOCPA licences of the proposed engagement partner and signing professionals; (3) your audit quality control statement; (4) a written independence confirmation addressing any current or recent non-audit services to our group; (5) evidence of professional indemnity insurance; and (6) confirmation of the continuing professional development status of the proposed team and a summary of prior audit service to our company.”

b) How to validate CPD and rotation history

Ask each firm to state, in writing, the number of consecutive years it has audited your company and the tenure of the current engagement partner. Compare this against the rotation limits discussed in the next section. Where a firm cannot evidence CPD compliance or provides an unclear rotation history, treat that as a material eligibility flag rather than a minor administrative gap.

c) Sample board resolution snippet

“RESOLVED that, following due diligence confirming CMA RAFS registration, valid SOCPA licensing and satisfactory independence and rotation assessments, the Board approves the appointment of [Firm] as external auditor for the financial year ending [date], subject to shareholder approval where required, and authorises the [Audit Committee Chair] to finalise the engagement terms.”

5. Auditor rotation and independence: what the board must check in 2026

Rotation and independence are the governance safeguards that keep auditor eligibility meaningful over time. A firm that was appropriate several years ago may now approach rotation limits or have accumulated independence threats. In 2026, boards of listed companies are expected to document their rotation position explicitly, not simply assume continuity. The precise rotation periods and cooling-off requirements applicable to your company are set by the CMA’s corporate governance framework and SOCPA rules, confirm the current thresholds against those sources rather than relying on a fixed number of years.

a) Partner and firm rotation timelines

Two distinct rotation concepts apply, and confusing them is a common error. Firm rotation concerns how long the same audit firm may serve before it must be replaced. Partner rotation concerns how long the same engagement partner may lead the audit before another partner within the firm must take over, followed by a cooling-off period before that partner can return. The audit committee should maintain a rolling record of both clocks, measured against the limits currently in force, so that a required rotation is never triggered by surprise mid-cycle.

b) Related-party and non-audit services policies

Independence threats accumulate quietly. A board should maintain a policy that governs which non-audit services the external auditor may and may not provide, and require pre-approval of any permitted service. Related-party relationships, for example, a partner with a family or financial connection to management, must be identified and either eliminated or, where permissible, safeguarded and disclosed. The strength of your policy is tested precisely at appointment and renewal.

c) How to document independence assessments

Record the independence assessment as a standing item in the appointment board paper. Capture the services provided by the firm over the relevant look-back period, the fee ratio between audit and non-audit work, the rotation status of firm and partner, and any related-party findings. A documented assessment is your evidence that the board discharged its duty, and it is exactly the record a regulator or successor auditor may later request.

6. Running a compliant audit tender and appointment process

For listed and pre-IPO companies, a defensible appointment usually flows from a structured tender rather than an informal conversation. A well-run request for proposal (RFP) both secures competitive terms and generates the evidence the board needs. In practice, a full process often runs around 60 to 90 days from RFP issue to board resolution, with renewals typically shorter; adjust the timing to your own governance calendar and filing obligations.

a) RFP checklist, mandatory clauses

Every RFP issued to prospective cma registered accounting firms Saudi Arabia should test compliance as well as commercials. Include mandatory clauses covering:

• CMA and SOCPA compliance. Confirmation of RAFS registration and current firm and individual licences.
• Independence. A declaration of independence and disclosure of any non-audit relationships.
• Fee structure. Transparent breakdown of audit fees and any assumptions.
• Sub-contracting. Whether any work will be delegated, to whom, and under what oversight.
• Confidentiality. Binding confidentiality obligations covering the tender and engagement.

b) Evaluation matrix

Score bids against a weighted matrix so the decision is objective and reviewable. The following template can be adapted to your company’s risk profile:

c) Sample 60–90 day timeline

1. Days 1–10: Audit committee approves scope, finalises the RFP and shortlist of cma registered accounting firms Saudi Arabia to invite.
2. Days 11–30: Issue the RFP; firms submit registration, licences and independence declarations.
3. Days 31–50: Evaluate bids against the matrix; conduct interviews and clarify independence.
4. Days 51–70: Complete the seven-step verification checklist and finalise the independence and rotation assessment.
5. Days 71–90: Audit committee recommends; board passes the appointment resolution; make any disclosure required to the Saudi Exchange in line with the applicable listing rules.

7. What to do if the CMA RAFS list shows no eligible firms or conflicts

Occasionally a company finds that its shortlist collapses, every candidate is conflicted, tenure-limited or otherwise ineligible. This is manageable if handled methodically rather than by relaxing standards.

a) Exception requests and documentation

If a genuine shortage exists, document the search you undertook, the firms considered and the specific reason each was ineligible. That record supports any exception request and demonstrates the board acted in good faith. Never proceed with an ineligible firm on the assumption that the gap will be forgiven later.

b) Use of international firms with local presence

Widen the search to international networks operating through a locally registered member firm. Provided that local firm appears on the CMA RAFS registry and holds valid SOCPA licensing, its international affiliation can bring additional capacity without compromising eligibility.

c) When to seek legal counsel

Where the position remains unresolved, for example, a conflict cannot be safeguarded or a rotation limit leaves no compliant candidate, seek professional guidance before acting, and consider approaching the CMA for direction. Engaging a qualified adviser early is far cheaper than remediating a defective appointment. You can find an auditor or advisory support through the GLE lawyer directory.

8. Board paper and resolution checklist for auditor appointment

The board paper is where all the preceding work is consolidated into a decision-ready document. A complete paper for appointing external auditors from among the cma registered accounting firms Saudi Arabia should contain:

• Due diligence summary. Outcome of the seven-step verification checklist for the recommended firm.
• Recommended firm. Clear recommendation with the evaluation matrix score.
• Conflict checks. Confirmation that independence and related-party checks were performed and their result.
• Independence statement. The firm’s written independence confirmation.
• Rotation assessment. Firm and partner tenure position against applicable limits.
• Timeline. Proposed engagement dates and any filing obligations.
• Draft resolution. Ready-to-adopt resolution text.

“RESOLVED that [Firm], being a CMA registered accounting firm and holder of valid SOCPA licences, is appointed as external auditor for the year ending [date]; that the Audit Committee’s due diligence, independence and rotation assessments are noted and approved; and that management is authorised to execute the engagement letter and make any filings required under the applicable listing rules and, where required, subject to shareholder approval.”

10. Next steps and call to action

Appointing external auditors from the pool of cma registered accounting firms Saudi Arabia in 2026 is entirely achievable when you follow a disciplined sequence: verify CMA RAFS registration, confirm SOCPA licensing for firm and individuals, test independence and rotation, run a scored tender, and consolidate everything into a decision-ready board paper. Assign a clear internal owner, usually the audit committee secretary, to drive the process and hold the evidence file. Start early, keep dated records at every step, and treat verification as an audit trail rather than a formality. Because rules, thresholds and rotation periods are subject to change, verify current requirements with the CMA and SOCPA before you finalise.

To go deeper, read our guide on how to choose an Accounting Services Provider Saudi Arabia (2026), explore the Accounting Services practice area for Saudi Arabia, and review Corporate Governance guidance for boards and audit committees. Where your position is complex or a compliant candidate is hard to find, seek qualified advice before you resolve.

Sources

1. Capital Market Authority (CMA), Registered Accounting Firms (RAFS)
2. Saudi Organization for Chartered and Professional Accountants (SOCPA)
3. Saudi Exchange, Listing Rules & Disclosures
4. Zakat, Tax and Customs Authority (ZATCA)