This guide was written in Arabic first — read it in Arabic.
Every Saudi ministry, university, authority and public institution covered by the state general budget must have an internal audit unit. The document that governs those units is not an international standard or a corporate governance code. It is a single regulation, issued almost two decades ago and still in force: the Unified Regulation for Internal Audit Units in Government Entities and Public Institutions (اللائحة الموحدة لوحدات المراجعة الداخلية في الأجهزة الحكومية والمؤسسات العامة).
This guide sets out what it actually requires, article by article, what later decisions added, what it does not say — and how it meets the 2024 Global Internal Audit Standards that many units have adopted in their quality programmes.
The legal framework at a glance
| Instrument | Date | What it did |
|---|---|---|
| Council of Ministers Decision No. 235 | 20/8/1425H (2004) | Required an internal control unit in every entity under the audit bureau's oversight — the basis for the regulation |
| Council of Ministers Decision No. 129 | 6/4/1428H (April 2007) | Approved the unified regulation: 23 articles, in force 90 days after publication |
| Council of Ministers Decision No. 410 | 22/9/1437H (June 2016) | Amended Article 15 to add the National Anti-Corruption Commission (Nazaha) to the external oversight bodies |
| Council of Ministers Decision No. 412 | 17/6/1441H (February 2020) | Abolished follow-up units and moved several of their tasks to internal audit |
The General Auditing Bureau (ديوان المراقبة العامة) was renamed the General Court of Audit (الديوان العام للمحاسبة) in 2019, although Article 22 of the regulation still uses the old name.
Scope and establishment (Articles 1–3)
The regulation applies to every government body or public institution with legal personality that is covered by the state general budget. It defines the principal official (المسؤول الأول) as the entity's highest administrative authority — and that person is the centre of the whole arrangement.
- Each entity sets up an internal audit unit at its headquarters, whose director reports to the principal official; branch units may be added by the principal official's decision.
- The headquarters director's grade is at least the 11th rank or equivalent.
- The unit must have enough specialist staff, and is formed by the principal official's decision.
Article 2 sets the unit's objectives: protecting public funds and property, preventing and detecting fraud and error, ensuring accurate financial data and records, improving the efficiency and effectiveness of operations, ensuring compliance with laws and plans, and ensuring sound internal control.
Who leads the unit and who works in it (Articles 4–6)
The director must be a Saudi national with at least a university degree in accounting or equivalent and at least seven years' audit experience. Appointment, promotion, transfer, secondment or assignment requires the principal official's approval. Staff need a degree or diploma in accounting or a field closely related to the entity's work, plus experience. The director organises and supervises the unit and is responsible for its effectiveness.
The annual plan and access (Articles 7–9)
- The director prepares an annual internal audit plan, which the principal official approves; it can only be amended with the principal official's approval.
- The unit has direct contact with officials and access to all books, records and documents; all staff must cooperate.
- The director prepares the unit's procedures with the entity's development function, and an annual training plan approved by the principal official.
The regulation does not use the words "risk-based". The IIA 2024 Standards expect it (Standard 9.4), so a unit that claims conformance needs to document the risk assessment behind its plan.
The unit's duties (Article 10)
Article 10 lists thirteen duties, mainly financial and compliance work with elements of performance evaluation:
- Evaluating internal control, including the accounting system.
- Checking compliance with laws, regulations and financial procedures.
- Evaluating the organisational plan — authorities and segregation of duties.
- Evaluating achievement of objectives and analysing variances.
- Identifying misuse of material and human resources.
- Post-auditing expenditure and revenue documents, and examining accounting records.
- Reviewing contracts and agreements, cash funds and stocktakes, and warehouses.
- Reviewing financial reports and the final account, and advising on the draft budget.
- Other tasks the principal official assigns within the unit's remit.
Reporting and follow-up (Articles 11–14)
| Report | Content | To whom, and when |
|---|---|---|
| Engagement report | Results and recommendations | At the end of each engagement, with follow-up of implementation |
| Quarterly report | Work done, violations found, actions taken — plus a detailed report on external oversight bodies' observations and their status | To the principal official, at least every quarter |
| Ad-hoc report | Any violation that needs reporting | To the principal official, when it arises |
| Annual report | Work done and key findings, access to information, achievement of objectives, internal control, compliance, soundness of the final account | To the principal official, within 90 days of fiscal year-end |
External oversight bodies and the financial controller (Articles 15–16)
Article 15, as amended in 1437H, requires regular cooperation with the entity's external oversight bodies: the Ministry of Finance, the audit bureau (now the General Court of Audit), the Control and Investigation Board, Nazaha, and audit firms. The unit gives them access to its reports, follows up implementation of their observations, and answers their queries promptly. Article 16 requires cooperation with the financial controller and sharing of relevant results.
That follow-up belongs in the quarterly report itself — and it is one of the heaviest workloads for units that track each body's observations in a separate file.
Independence and professional conduct (Articles 17–20)
- The principal official must give the unit full independence; its director and staff may not be given executive work or sit on executive committees.
- Neutrality and avoidance of conflicts of interest; disclosure of anything that impairs independence; no audit of work that would compromise it.
- Confidentiality, and no personal use of information.
- Due professional care: planning, documented working papers and sufficient evidence.
Decision 412: when audit inherited follow-up
Council of Ministers Decision No. 412 of 17/6/1441H abolished follow-up units in government bodies. It moved inspection campaigns, monitoring of work progress, and review of complaints to internal audit; preliminary investigations went to the legal department and attendance monitoring to human resources.
The decision did not amend the regulation's text, but it widened the unit's work with tasks closer to operational monitoring. That is where a unit needs clear guard rails: Article 17 bars executive work, and the IIA 2024 Standards expect objectivity to be safeguarded when the function takes on work outside assurance and advice. The practical answer is to define the scope and limits of these tasks in the internal audit charter, and keep them separate from assurance engagements in the plan and the reports.
What the regulation does not say
- It does not name the IIA Standards or any standard-setter; it refers only generally to professional auditing standards and ethics.
- It does not provide for an audit committee. The reporting line is the principal official. Some entities — universities, for example — have audit committees under their own regulations, not under this one.
- It does not require the plan or reports to be sent to the General Court of Audit. The Court's role under Article 22 is to monitor implementation of the regulation.
- No replacement has been approved, on the sources available. The General Court of Audit announced draft updates in 2019 and 2023 — an updated regulation, an audit committee regulation and an ethics guide — and said in 2023 they were under study.
The regulation and the IIA 2024 Standards
Many units go beyond the legal minimum. Princess Nourah University's quality assurance and improvement programme (second edition, 2025) cites Decisions 235, 129 and 412 and is built on the Global Internal Audit Standards, including an external assessment every five years. Imam Mohammad Ibn Saud Islamic University says its unit works to the regulation, the government auditing standards issued by the General Court of Audit, and the IIA Standards together.
| What the regulation requires | What the IIA 2024 Standards add |
|---|---|
| Annual plan approved by the principal official (Art. 7) | A plan based on a documented risk assessment (Standard 9.4) |
| Follow-up and escalation after 30 days (Art. 11) | Confirming implementation of recommendations and action plans (Standard 15.2) |
| Cooperation with external oversight bodies (Art. 15) | Documenting the basis for coordination with, and reliance on, other assurance providers (Standard 9.5) |
| Documented working papers and sufficient evidence (Art. 20) | Documentation sufficient to repeat the work and reach the same results (Standard 14.6) |
| Full independence; no executive work (Art. 17) | Objectivity and independent positioning (Principles 2 and 7) |
| — | A quality assurance and improvement programme and an external assessment every five years (Standards 8.3 and 8.4) |
What this means day to day
Nothing in the regulation is hard in principle. The difficulty is proving it on demand: that the plan was approved and amended with the principal official's approval, that every quarterly report covered the external bodies' observations and their status, that every overdue recommendation was assessed and escalated on time, and that the annual report went out within ninety days.
A unit running on spreadsheets and email can say all of that. ControlVista's audit management software for Saudi Arabia is designed to show it: plan, engagement, finding, recommendation and the principal official's report from one record, in Arabic and English, inside the entity's own infrastructure.
Sources
- Council of Ministers Decision No. 129 of 6/4/1428H and the Unified Regulation — scanned original instruments, Internal Audit unit, Imam Mohammad Ibn Saud Islamic University: units.imamu.edu.sa
- Council of Ministers Decision No. 410 of 22/9/1437H amending Article 15: units.imamu.edu.sa
- Council of Ministers Decision No. 412 of 17/6/1441H abolishing follow-up units — Ajel: ajel.sa
- Princess Nourah University, Internal Audit quality assurance and improvement programme (2nd edition, 2025): pnu.edu.sa
- Imam Mohammad Ibn Saud Islamic University, Internal Audit profile: units.imamu.edu.sa
- Al-Madina, General Court of Audit statements on updating the regulation (2019, 2023): 664479 · 860079
- Saudipedia, General Court of Audit: saudipedia.com