What is Internal Audit?
Internal audit is an independent, objective assurance and consulting activity carried out within an organization to evaluate and improve risk management, internal controls, and governance processes, reporting to the audit committee of the board.
How It Works
- Annual risk-based audit plan approved by the audit committee.
- Audits cover financial, operational, compliance, and IT processes.
- Findings issued in written reports with management action plans.
- Follow-up tracking until issues are remediated.
Saudi Context
The Corporate Governance Regulations issued by the CMA require companies listed on Tadawul’s Main Market to maintain an internal audit unit or department (Article 71) that reports to, and is accountable to, the audit committee (Article 73). On the Parallel Market (Nomu) those articles are guiding rather than mandatory. ZATCA and SAMA also expect internal audit to cover tax compliance and regulatory adherence as part of the second line of defense.
Example
A Saudi bank’s internal audit team conducts a SAR 5,000,000 expense audit covering 80 vendor contracts, identifies 12 control weaknesses, and tracks remediation through to the next audit committee meeting.