Audit Committees and Internal Audit in Unlisted Saudi Companies: What the Law Requires, What Is Guidance, and How to Build One That Works

The previous Companies Law required every joint stock company to form an audit committee. The Companies Law issued by Royal Decree M/132 dated 1/12/1443H no longer contains that requirement in its text; it leaves committees to the regulations of the competent authority: the Capital Market Authority for listed companies and the Ministry of Commerce for the rest. As a result, many unlisted joint stock companies and limited liability companies now ask: are we still required to have an audit committee? Is internal audit an obligation or a choice? And if it is a choice, how do we build one that works in practice rather than on paper? This guide answers all three from the texts themselves.

1. The compliance map after the new Law

Requirement	Listed joint stock company	Unlisted joint stock company	Limited liability company
Audit committee	Mandatory; formed by board resolution with 3 to 5 members, none of them executives, at least one independent and one specialist in finance and accounting, chaired by an independent member (Art. 51, CMA Corporate Governance Regulations)	Guidance only; the Ministry’s Corporate Governance Regulations for Unlisted JSCs (Art. 53) recommend a committee formed by the general assembly with 3 to 5 members including an independent member and a finance and accounting specialist; the Implementing Regulations of the Companies Law refer to it “where one exists”	Not required by law; may be provided for in the articles of association
Internal audit unit	Mandatory (Art. 71, CMA Regulations); may be outsourced without relieving the company of responsibility	Guidance only (Arts. 73–78, Ministry Regulations); may be outsourced	Not required by law
Owners’ oversight right	Through the assembly, the committee and the external auditor	Through the assembly, the committee where one exists, and the external auditor	A non-managing partner may inspect the company’s business and examine its records twice a year, and the company must respond within 15 days (Art. 171)
External auditor	Mandatory	Mandatory	Mandatory except for micro and small companies within the conditions of Art. 19

One exception deserves attention: entities supervised by a sectoral regulator, such as the Saudi Central Bank or the Insurance Authority, are subject to their own governance requirements, which may impose an audit committee and an internal audit unit regardless of listing. A company planning a listing on the Main Market or Nomu will also need to meet the CMA Regulations before the offering, not after it.

2. When does an unlisted company need an audit committee even without an obligation?

Obligation is not the only test. In our experience an audit committee becomes a practical necessity when one or more of the following applies:

• Partners or shareholders who are not involved in day-to-day management and need an oversight channel independent of the executives, the usual position in family companies from the second generation onward.
• Bank financing or sukuk with covenants that require reliable financial reporting on time.
• A volume of related-party dealings that calls for independent monitoring of disclosure and authorisation procedures, as explained in our guide on conflicts of interest and related-party transactions.
• A listing plan or the entry of a strategic investor within three years; a committee that has operated for two years is far more convincing than one formed a month before the offering.
• Repeated external-auditor observations on internal control that go unaddressed, typically visible in the management letter year after year.

3. How to form a committee that actually works

We take the Ministry of Commerce Regulations for unlisted companies as the reference, since they are designed for this category, and note what the CMA Regulations add when a listing is on the horizon:

1. Formation resolution and charter: the committee is formed by a resolution of the ordinary general assembly, which also issues, on the board’s proposal, a working charter covering the committee’s procedures, duties, member selection rules, term, remuneration and the filling of vacancies (Art. 53). In listed companies the committee is formed by board resolution (Art. 51, CMA Regulations).
2. Composition: three to five members, shareholders or otherwise, none of them an executive board member, with at least one independent member and one specialist in finance and accounting, preferably chaired by an independent member. The CMA Regulations require at least half the members to be independent and prohibit a member from sitting on audit committees of more than five listed companies.
3. Meetings: at least every six months, with minutes recording discussions and recommendations, periodic meetings with the external auditor and the internal auditor, each of whom may request a meeting when needed (Art. 56).
4. Confidential reporting channel: the committee must set procedures allowing employees to report, in confidence, any irregularity in financial reporting or otherwise, and must verify reports through an independent investigation proportionate to the matter (Art. 57).
5. Disagreement with the board: if the board rejects the committee’s recommendation on appointing or removing the external auditor, his fees, or the appointment of the internal auditor, the board report must include the recommendation, its reasoning and the board’s reasons for not adopting it (Art. 55).

The committee’s duties in three circles (Art. 54)

• Financial reporting: reviewing the financial statements before they reach the board, examining unusual matters, verifying significant accounting estimates, and reviewing accounting policies and recommending on them.
• Internal audit: reviewing internal control, financial control and risk management systems, studying internal audit reports and following up corrective action, supervising the internal auditor, recommending his appointment and remuneration, or recommending the need to appoint one where none exists.
• External auditor: recommending his nomination, removal, fees and performance evaluation after verifying independence, reviewing his plan and confirming he provides no technical or administrative work outside the audit, and studying his report and observations and their follow-up. The Implementing Regulations of the Companies Law (Art. 6) add that reappointing an audit firm after ten consecutive years requires a recommendation from the audit committee where one exists, or competing proposals, with a cap of twenty years, as detailed in our guide on appointing, removing and rotating the auditor.

4. The internal audit unit: the minimum that makes it real

Articles 72–78 of the Ministry Regulations and Articles 71–75 of the CMA Regulations describe almost the same structure. The point is to read it as a functional minimum, not a formality:

Element	What the regulations say	What it means in practice
Internal control system	Approved by the board to evaluate risk-management policies, the application of the company’s governance rules and compliance with regulations, and to ensure related-party transactions follow their rules (Art. 72)	A documented delegation-of-authority matrix, segregation of duties in purchasing, sales, cash and payroll, and a risk register that is kept current
Composition and reporting line	At least one internal auditor, recommended by the audit committee and accountable to it, assigned no other work, with remuneration set on the committee’s proposal (Art. 75)	A reporting line to the committee, not to the CFO; otherwise it is internal financial control, not internal audit
Plan	A comprehensive plan approved by the audit committee and updated annually; main activities and processes, including risk management and compliance, reviewed at least annually (Art. 76)	A plan built on a risk assessment rather than a copy of last year’s
Report	A written report to the board and the audit committee at least every six months, covering findings, comparison with prior reports, recommendations and what has been implemented (Art. 77)	A findings tracker with a closure date and an accountable owner for each item
Retention	Audit reports and working papers kept, clearly showing the work done, the findings and recommendations (Art. 78)	A working-paper file for each engagement, available to the external auditor and regulators
Outsourcing	External providers may perform internal audit and risk-management functions without relieving the company of responsibility (Art. 73)	A suitable option where the company’s size does not justify a full department, provided the provider is not the company’s own external auditor

The last point is fundamental: Article 20 of the Companies Law prohibits the external auditor from performing technical, administrative or advisory work for the company he audits, except as permitted by the regulations. Internal audit therefore cannot be outsourced to the same firm that audits the financial statements. We provide our internal audit service to companies we do not audit, whether as a build from scratch, full or partial co-sourcing, or an assessment of an existing function.

5. Set-up mistakes that empty the committee of substance

• A committee of executives: the CFO or CEO sitting on the committee meant to oversee them, which both sets of regulations expressly prohibit.
• No charter: a committee without an assembly-approved charter means its duties and powers are contested at the first disagreement with the board.
• Internal auditor reporting to executive management: a report that goes to the general manager first, to be edited before the committee sees it.
• A plan without risk: branches reviewed in rotation while the purchasing cycle is never audited because it is “sensitive”.
• Findings never closed: the same observation repeated in three consecutive reports with nobody asking who owns its closure. See our earlier guide on evaluating an internal audit function (Arabic).
• Confusing it with the external audit: assuming the annual statutory audit replaces internal control, whereas the external audit expresses an opinion on the financial statements and is not designed to detect every irregularity, as explained in audit vs review vs compilation.

6. A practical path for a company starting from zero

1. General assembly resolution forming the audit committee and approving its charter and members’ remuneration.
2. Appointment of three non-executive members including an independent member and a finance and accounting specialist, with an independent chair.
3. Board approval of the internal control system, the delegation-of-authority matrix and the conflict-of-interest policy.
4. Committee decision on the internal audit model: an appointed internal auditor, an outsourced provider, or a mix.
5. An initial risk assessment producing the first-year plan, focused on the cycles touching cash and related parties.
6. The first semi-annual report with a findings tracker, followed by a committee meeting with the external auditor before year-end to discuss his observations.

7. How we help

Within our governance service we draft the audit committee charter, committee terms of reference and the delegation-of-authority matrix, and we help select and onboard members. Within our internal audit service we establish the function or perform its work on a co-sourced basis, providing the committee with periodic reports it can act on. We never combine this with auditing the same company’s financial statements, in compliance with Article 20 of the Law.

Sources

• Companies Law, Royal Decree M/132 dated 1/12/1443H, Articles 17–21, 171 and 274 (Bureau of Experts, Council of Ministers)
• Implementing Regulations of the Companies Law dated 25/6/1444H, Article 6 (Umm Al-Qura Gazette)
• Corporate Governance Regulations for Unlisted Joint Stock Companies, Articles 2, 49–57 and 72–78 (Ministry of Commerce)
• Corporate Governance Regulations issued by the CMA Board, Resolution 8-16-2017 as amended by Resolution 8-5-2023, Articles 51–56 and 71–75 (Umm Al-Qura Gazette)

Related guides

• Assessing the internal audit function