Internal Audit Requirements in Saudi Arabia (2026): CMA Corporate Governance Rules Explained

Internal audit requirements Saudi Arabia have moved to the top of the board agenda in 2026, as evolving financial oversight expectations reshape how listed and large private entities structure their assurance functions. The Capital Market Authority (CMA) Corporate Governance Regulations already impose detailed obligations on internal audit, from mandate and independence to reporting lines and audit committee oversight, and continuing regulatory developments add a further layer of scrutiny on internal control and audit quality. This guide sets out who must maintain an internal audit function, what the charter must contain, how outsourcing is treated, and the practical steps needed to bring a function into compliance.

It is written for CFOs, audit committee chairs, company secretaries and senior compliance teams who need clear, source-grounded answers rather than generic marketing material.

Who this is for: CFOs, audit committee chairs, company secretaries and senior finance and compliance teams at Saudi listed companies and large private entities. The purpose is to confirm CMA-mandated internal audit duties, set up or remediate an internal audit function, and decide between in-house and outsourced arrangements.

Why 2026 Matters for Internal Audit in Saudi Arabia

The regulatory environment for assurance in the Kingdom of Saudi Arabia (KSA) has tightened significantly. The CMA Corporate Governance Regulations have long required listed joint stock companies to operate an internal audit function that is independent of management and answerable to the audit committee. What has changed heading into 2026 is the elevated emphasis on financial oversight, audit quality and the interaction between internal audit, external auditors and regulators. Boards that treated internal audit as a compliance formality are now reappraising the function as a core governance control.

For companies subject to CMA rules, the practical consequence is that internal audit requirements Saudi Arabia can no longer be satisfied by a thin, under-resourced team producing occasional reports. Regulators expect a documented charter, a risk-based annual plan, functional reporting to the audit committee, and demonstrable independence. Recent policy direction reinforces those expectations by strengthening the oversight framework around financial reporting and control.

This article translates the regulatory framework into actionable guidance. It maps CMA obligations to specific charter components, explains the qualification and independence standards drawn from SOCPA and international practice, sets out the rules and risks around outsourcing, and closes with a phased 90 to 180 day remediation plan. Throughout, the emphasis is on what a board, audit committee and finance leadership actually need to do to meet internal audit requirements Saudi Arabia in the current regulatory climate.

CMA Requirements, Who Must Have Internal Audit and Core Obligations

The primary source for internal audit obligations in the listed-company context is the CMA Corporate Governance Regulations, issued and maintained by the Capital Market Authority. These Regulations establish the audit committee framework, the internal audit function and the disclosure obligations that flow from them. Any company relying on these rules should consult the current regulatory text directly, as the CMA periodically updates its governance instruments through its regulatory documents portal.

Which Entities Are in Scope (Listed vs Others)

The core mandate applies to listed joint stock companies whose shares trade on the Saudi Exchange. For these entities, maintaining an internal audit function is not optional, it is a governance requirement tied to the audit committee structure prescribed by the CMA Corporate Governance Regulations. Material subsidiaries of listed groups are typically brought within scope through the parent company’s control environment, since the audit committee’s oversight extends to the consolidated group.

Beyond listed companies, the picture is more nuanced. Large joint stock companies and entities that fall within specific CMA supervisory categories may be subject to comparable expectations, and the Companies Law administered by the Ministry of Commerce sets broader board responsibilities for corporate documentation and internal control that apply across the corporate landscape. Financial institutions face additional sector-specific requirements under the supervisory framework of the Saudi Central Bank (SAMA), which maintains its own corporate governance and internal control expectations for banks and insurers. Where a company operates in a regulated sector, those sector rules apply in addition to, not instead of, the general CMA framework.

Key Obligations: Independence, Reporting and Scope of Work

The internal audit requirements Saudi Arabia impose on in-scope entities cluster around a small number of non-negotiable principles:

• Independence. The internal audit function must be free from management interference in determining its scope, performing its work and communicating its results. Independence is protected primarily through the reporting line to the audit committee.
• Functional reporting to the audit committee. The head of internal audit reports functionally to the audit committee, which is responsible for overseeing the function, approving its plan and evaluating its performance. Administrative reporting to executive management is permitted but must not compromise the functional line.
• Risk-based scope of work. Internal audit is expected to evaluate the adequacy and effectiveness of the company’s internal control, risk management and governance processes across financial, operational and compliance domains.
• Regular reporting. The function must report to the audit committee on a periodic basis, escalate significant control deficiencies, and track the remediation of findings.
• Adequate resourcing. The company must provide sufficient budget, staffing and access rights for internal audit to discharge its mandate.

These obligations are cumulative. A company that appoints a head of internal audit but fails to give the function unrestricted access to records, or that allows management to edit audit findings before they reach the audit committee, has not met the substance of the CMA framework even if the form appears present. The audit committee bears direct responsibility for ensuring the function operates as intended.

Strengthened Financial Oversight and Its Impact on Internal Audit

Continuing developments in Saudi Arabia’s financial supervision architecture sit alongside the CMA Corporate Governance Regulations and strengthen the overall framework. The central effect for assurance professionals is to raise expectations around the quality, independence and documentation of both internal and external audit, and to sharpen the interaction between the two.

New Oversight and Reporting Expectations

The growing emphasis on financial oversight translates into heightened board-level accountability for internal control. Audit committees are expected to demonstrate not only that an internal audit function exists, but that it operates effectively, follows a documented methodology and produces reports that reach the board without dilution. In practice this drives more rigorous documentation: charters that are formally approved and reviewed, annual plans that are demonstrably risk-based, and minutes that record the audit committee’s engagement with internal audit findings. For companies working through internal audit requirements Saudi Arabia in 2026, the message is that evidence of process is now as important as the process itself.

Interaction with External Auditors and Regulators

The current framework reinforces the relationship between internal audit, the external auditor and the regulator. Internal audit is increasingly relied upon to provide assurance that supports the external audit and to give the audit committee an independent line of sight into control weaknesses that external auditors may also identify. Where the regulator seeks evidence of a functioning control environment, the internal audit function’s plans, reports and follow-up records become primary documentation. Coordination between internal and external audit, while preserving the independence of each, is therefore a practical priority.

Internal Audit Charter, Scope and Reporting Lines

The internal audit charter is the foundational governance document for the function. Under the CMA framework, the audit committee is responsible for reviewing and approving the charter, and the charter is the instrument through which the function’s mandate, authority and independence are formally established. An internal audit charter Saudi companies can rely on must be more than a template, it must reflect the actual reporting lines, access rights and resourcing the company has committed to provide.

Minimum Charter Contents

A compliant charter should address, at minimum, the following elements:

• Mandate and purpose. A statement establishing the function and its objective of providing independent, objective assurance and advisory services.
• Authority. Full, free and unrestricted access to all records, personnel, property and information necessary to perform the work.
• Scope. Coverage of internal control, risk management and governance processes across the organisation and material subsidiaries.
• Responsibilities. Preparation of a risk-based annual plan, execution of engagements, reporting of results and follow-up on remediation.
• Independence and objectivity. Confirmation that internal audit has no direct operational responsibility or authority over the activities it reviews.
• Reporting lines. Functional reporting to the audit committee and administrative reporting to executive management.
• Resourcing. Provision for adequate budget, competent staff and access to specialist skills where required.
• Quality assurance. Commitment to a quality assurance and improvement programme consistent with recognised professional standards.

Sample charter mandate clause: “The internal audit function is established by the Board and operates under the oversight of the Audit Committee to provide independent and objective assurance on the adequacy and effectiveness of the Company’s governance, risk management and internal control processes. The function shall have unrestricted access to all records, personnel and property necessary to fulfil its responsibilities.”

Reporting: Audit Committee, CEO and Board Access

The reporting architecture is what makes internal audit independence real. Functional reporting to the audit committee means the committee approves the audit plan, receives the results, and has authority over the appointment, evaluation and removal of the head of internal audit. Administrative reporting to the CEO or CFO covers day-to-day matters such as budget administration and human resources, but must never extend to editing or suppressing audit findings.

Sample reporting line clause: “The Head of Internal Audit reports functionally to the Audit Committee and administratively to the Chief Executive Officer. The Head of Internal Audit shall have direct and unrestricted access to the Chairman of the Audit Committee at all times, including the right to request private sessions without management present.”

Qualifications, Independence and Professional Standards

Meeting internal audit requirements Saudi Arabia depends not only on structure but on the competence and objectivity of the people performing the work. The Saudi Organization for Chartered and Professional Accountants (SOCPA) sets professional standards and ethics expectations for accountants in the Kingdom, and internal audit teams are expected to align with recognised professional practice, including the standards promulgated by the Institute of Internal Auditors (IIA) where applicable.

Head of Internal Audit: Minimum Qualifications

The head of internal audit should hold appropriate professional qualifications and demonstrable experience commensurate with the size and complexity of the organisation. In practice, listed companies appoint individuals with recognised professional certification, for example SOCPA membership, a chartered accountancy qualification, or the Certified Internal Auditor designation, together with sufficient seniority to engage credibly with the audit committee and executive management. The individual must have the standing to challenge management and the technical competence to evaluate financial, operational and IT controls.

Independence Safeguards and Conflicts of Interest

Independence is both structural and personal. Structurally, it flows from the reporting line to the audit committee. Personally, internal auditors must avoid conflicts of interest, they should not audit activities for which they previously held operational responsibility until sufficient time has elapsed, and they must declare any relationships that could impair objectivity. The audit committee should periodically confirm the independence of the function and of the head of internal audit, and consider whether rotation of engagement responsibilities is appropriate to preserve objectivity.

Professional Standards to Follow (SOCPA, IIA)

Internal audit teams in KSA should follow the applicable SOCPA professional standards and ethics framework, supplemented by the international professional practice standards issued by the IIA where SOCPA guidance refers to or adopts them. Adherence to these standards supports the quality assurance obligation in the charter and provides the audit committee with confidence that the function’s methodology is defensible. Continuing professional education is an expectation, not an option, auditors must maintain current knowledge of standards, regulatory developments and the risks facing their sector.

Outsourcing, Co-sourcing and Use of External Providers

Many Saudi companies, particularly those building a function from scratch or requiring specialist skills, consider whether to outsource internal audit Saudi arrangements to an external provider. The CMA framework does not prohibit outsourcing, but it makes clear that the company retains ultimate responsibility for the function regardless of how the work is delivered.

Is Outsourcing Permitted? (Regulatory Constraints)

Outsourcing and co-sourcing are permitted arrangements in many circumstances. However, the company cannot outsource its accountability. The audit committee remains responsible for approving the outsourcing policy, overseeing the provider, and ensuring that the arrangement preserves independence and the functional reporting line to the committee. A provider that also delivers other services to the company, such as tax or advisory work, may raise independence concerns that the audit committee must actively manage. The external provider must not be placed in a position of auditing its own work.

Oversight of Outsourced Providers (SLAs, Reporting)

Effective oversight of an outsourced function requires a documented service level agreement, clear scope and reporting obligations, and periodic reporting directly to the audit committee. The contract should preserve confidentiality and data protection, specify the qualifications of the provider’s team, require adherence to recognised professional standards, and reserve the company’s right to require quality assurance reviews. The audit committee should treat an outsourced provider with the same rigour as an in-house function, reviewing its plans, receiving its reports and following up on its findings.

Sample outsourcing oversight clause: “Where the internal audit function is delivered by an external provider, the provider shall report functionally to the Audit Committee, adhere to applicable professional standards, maintain the confidentiality of Company information, and submit to periodic quality assurance review. The Company retains full responsibility for the adequacy and effectiveness of the internal audit function.”

In-house vs Outsourced vs Co-sourced Internal Audit

Audit Committee Responsibilities and Alignment with Internal Audit

The audit committee is the governance body through which internal audit requirements Saudi Arabia are given effect. Under the CMA Corporate Governance Regulations, the committee’s duties in respect of internal audit are extensive and cannot be delegated back to executive management. The audit committee requirements KSA impose make the committee directly accountable for the effectiveness of the function.

Audit Committee Checklist (What to Request from Internal Audit)

To discharge its oversight, the audit committee should routinely request and review:

• The internal audit charter, reviewed and re-approved at least annually.
• The risk-based annual audit plan, with the rationale for coverage and any resource constraints.
• Engagement reports, including significant findings, root causes and recommendations.
• Management remediation status, tracking overdue actions and unresolved high-risk findings.
• An assessment of the function’s independence and resourcing, confirming it can operate without restriction.
• Quality assurance results, internal and external assessments of the function’s performance.

Typical Meeting Cadence and Reporting Templates

The audit committee should meet regularly enough to maintain effective oversight, quarterly meetings are common practice for listed companies, with additional sessions where significant issues arise. At least once a year the committee should hold a private session with the head of internal audit, without management present, to allow candid discussion of any pressure on the function. Standardised reporting templates, covering plan progress, findings by risk rating and remediation ageing, help the committee compare performance across periods and demonstrate consistent oversight to regulators. Companies building this discipline should also consider a dedicated audit committee charter that codifies these responsibilities.

Practical Remediation Checklist and 90–180 Day Implementation Plan

For companies that discover their arrangements fall short of internal audit requirements Saudi Arabia, a phased remediation plan makes the task manageable and defensible. The following sequence assigns responsibility across the board, audit committee and CFO.

Quick Wins (First 30 Days)

• Board and audit committee formally approve or update the internal audit charter.
• Confirm the functional reporting line to the audit committee in writing.
• Document the current state, existing plans, reports, resourcing and any gaps against CMA obligations.
• Assign accountability: the audit committee chair owns oversight; the CFO supports administratively.

Medium Term (30–90 Days) and Longer Term (90–180 Days)

• 30–90 days: Decide on the delivery model (in-house, outsourced or co-sourced); recruit or appoint the head of internal audit; establish access rights, budget and reporting templates; and set the meeting cadence.
• 90–180 days: Complete a risk assessment and approve a risk-based annual audit plan; execute the first engagements; establish the remediation tracking process; implement independence declarations; and design the quality assurance and improvement programme.

This timeline is practical guidance rather than a statutory deadline; the appropriate pace depends on company size, complexity and the extent of the existing shortfall. What matters is that each step is documented and that the audit committee can evidence its engagement throughout.

Sample Internal Audit Charter Excerpts and Templates

The clauses below provide starting-point language for the three most critical charter provisions. They should be adapted to the company’s structure and reviewed by qualified professionals before adoption.

• Mandate: “The internal audit function provides independent, objective assurance and advisory services designed to add value and improve the Company’s operations, evaluating the effectiveness of governance, risk management and internal control.”
• Reporting line: “The Head of Internal Audit reports functionally to the Audit Committee and administratively to executive management, with direct and unrestricted access to the Chairman of the Audit Committee.”
• Outsourcing oversight: “Any externally sourced internal audit services shall operate under the oversight of the Audit Committee, adhere to applicable professional standards, and preserve independence and confidentiality; the Company retains full accountability for the function.”

Companies may also wish to prepare a standardised 90–180 day remediation checklist and an audit committee reporting template to support consistent oversight across reporting periods.

Conclusion

Meeting internal audit requirements Saudi Arabia in 2026 is no longer a box-ticking exercise. The CMA Corporate Governance Regulations mandate an independent internal audit function reporting functionally to the audit committee, and the Kingdom’s strengthening financial oversight framework raises the bar on documentation, quality and oversight. Companies that establish a clear charter, appoint competent and independent personnel, manage outsourcing arrangements carefully, and empower their audit committee will satisfy both the letter and the substance of the framework. This article is general guidance and not a substitute for tailored legal advice; companies should seek professional support to review their charters, remediation plans and governance arrangements against the current regulations.

Sources

1. Capital Market Authority (CMA), Corporate Governance Regulations
2. Saudi Organization for Chartered and Professional Accountants (SOCPA)
3. Saudi Central Bank (SAMA), Corporate Governance and Internal Control Guidance
4. Ministry of Commerce, Companies Law
5. Umm al-Qura, Official Gazette