What is Internal Audit Function?
The internal audit function is the in-house team (or outsourced equivalent) that provides independent and objective assurance over an organization’s internal controls, risk management, and governance, with a direct reporting line to the board’s audit committee.
How It Works
- Risk-based annual audit plan approved by the audit committee.
- Audits cover financial, operational, compliance, and technology processes.
- Findings reported with action plans and follow-up cycles.
- Charter document defines scope, authority, and independence.
Saudi Context
The CMA Corporate Governance Regulations require companies listed on Tadawul’s Main Market to establish an internal audit unit or department (Article 71), composed of at least one internal auditor whose appointment the audit committee recommends and who is accountable to that committee (Article 73). The audit committee is formed by a board resolution and works under a regulation issued by the general assembly (Article 51). On the Parallel Market (Nomu) the internal audit articles are guiding rather than mandatory. Under Article 75, the unit reports in writing at least quarterly to both the board and the audit committee, and works to an annual plan the audit committee approves (Article 74).
Example
A Tadawul-listed Saudi industrial company runs a 12-engagement annual internal audit plan covering revenue cycle, procurement, IT general controls, ZATCA compliance, and Saudization tracking, with the chief audit executive reporting directly to a CMA-aligned audit committee.