For a company listed on Tadawul, corporate governance is not a statement of intent published in the annual report. It is set by the Capital Market Authority through the Corporate Governance Regulations, and the audit committee is one of the parts the CMA is most specific about.
For a Chief Audit Executive, the relevant question is narrower than "are we compliant?" It is: does the committee above me have the composition and the reporting line that makes my independence real? The CMA's regulations are one of three layers governing internal audit in Saudi Arabia.
What the regulations require of the committee
The composition rules exist to protect objectivity, and they do it structurally rather than by exhortation.
Two things follow from that composition, and they matter more in practice than the headcount does.
First, executives are excluded. The body overseeing assurance cannot be staffed by the people whose control environment it oversees. That is the same principle SAMA applies to banks and the SCA applies to UAE-listed companies — a recurring shape across the Gulf, with local variation in the detail.
Second, the committee is a separate body from the risk-management committee. That separation is worth defending. Where risk and audit oversight collapse into a single forum, the function that is supposed to independently assure risk management ends up reporting to the people running it.
Where internal audit sits
Under the regulations, internal audit is supervised by the audit committee. The committee's remit runs to the internal audit function's work, its plan, and the response when weaknesses surface.
That supervisory relationship is the whole architecture of independence in a listed Saudi company. The CAE's plan is approved by a body management does not sit on; the findings reach that body without an executive filter; and the committee — not the CEO — is the audience for the opinion.
Where this erodes, it rarely erodes by breaking a rule. It erodes when the committee sees only what has been pre-reviewed by management, when the plan is negotiated down before it ever reaches the committee, or when overdue findings are presented as an aggregate rather than by name and owner.
The bar is higher for banks
A listed bank in the Kingdom answers to both regimes at once. The CMA's regulations set the committee. SAMA's Principles of Internal Auditing for Local Banks then add a considerably more prescriptive layer on the function itself:
| CMA (listed companies) | SAMA (local banks) | |
|---|---|---|
| Audit committee | Mandatory, 3–5 members | Mandatory |
| Composition | Non-executive; ≥1 independent | Independent / non-executive |
| Internal audit reporting | Supervised by the audit committee | Functionally to the committee, administratively to the CEO |
| Head of internal audit | — | SAMA prior non-objection to appoint, assign or extend |
| Audit cycle | — | Documented, 3–4 years by risk classification |
| External quality assessment | — | At least every five years |
A bank that satisfies the CMA composition rules has cleared the lower of the two bars.
What the committee needs from the function
The consistent theme across both regimes is a shift from asserting governance to evidencing it. A committee that must show its oversight was real needs a function that can produce, on demand:
- A documented, risk-based plan with the trail from risk to engagement visible.
- Working papers with a clean preparer → reviewer → approver record.
- Findings tracked to a verified close, by owner, with ageing and escalation.
- A board-ready view that is the system's own record rather than a deck rebuilt each quarter — increasingly in Arabic and English from the same underlying engagement.
That last point is where most global platforms struggle and where the committee actually reads. It is the reason functions in the Kingdom are moving to audit management software built around the audit lifecycle, with VistaReport generating the committee pack from the live record rather than from a parallel deck.
The Saudi deployment detail is on our audit management software for Saudi Arabia page; the vendor landscape on best audit management software in Saudi Arabia.
See how ControlVista feeds the committee or request a demo.