Most owner-managed companies in the Kingdom first hear the words "internal audit" from someone outside the business. A bank reviewing a credit line. A fund doing due diligence. A board member who joined after the last funding round and wants to know who checks the checkers.
By then the request usually comes with a deadline. It is much easier to start earlier.
What the law actually requires (as of October 2026)
The rules depend on what kind of company you are.
If you are a joint stock company, the Companies Law requires an audit committee, formed by a resolution of the ordinary general assembly from non-executive board members, with three to five members (Article 101). That committee reviews the financial statements and the external auditor's notes, and it must prepare a report on how well the company's internal controls work. The report has to be available at head office at least 21 days before the general assembly and read out at the meeting (Article 104). See the official Companies Law translation from the Bureau of Experts.
Think about that for a second. A committee is legally signing off an opinion on your controls. Without someone actually testing those controls during the year, that opinion is a guess.
For companies listed on the Main Market, the Capital Market Authority goes further. Its Corporate Governance Regulations require an internal audit unit with at least one internal auditor, appointed on the audit committee's recommendation and reporting to that committee. Article 73, together with the rules on the audit plan and report, became mandatory on 1 January 2024. Article 71 lets a company use an outside firm for this work, though responsibility stays with the company.
The CMA has said it is reviewing these regulations as part of its 2024 to 2026 plan, so check the current text on the CMA site before relying on any article number.
A limited liability company has no such requirement. Most of our clients are LLCs. So why bother?
Why private companies set it up anyway
Because the people who fund you will ask the same questions a regulator would.
A fund looking at a Series A in Riyadh will want to see who approves payments, how revenue is recognised, and whether the inventory count matches the books. If the answer to all three is "the founder", the valuation conversation changes.
A few things we see often in growing Saudi companies:
- One person can create a vendor, approve the invoice and release the payment.
- Petty cash and employee advances are reconciled once a year, at audit time.
- ZATCA e-invoices are issued from one system while sales are booked in another, and nobody matches the two.
None of these are fraud. They are gaps that appear when a company grows faster than its processes. An internal audit finds them while they are still cheap to fix.
What a sensible first year looks like
You do not need a full department. For a company with, say, SAR 30 to 100 million in revenue, a risk-based plan covering four or five areas a year is usually enough. Start with cash and payments, then sales and receivables, then payroll and GOSI, then procurement. Report findings to the owners or the board every quarter, with a named person and a date against each fix.
If you are planning to list, or bring in an institutional investor, treat this first year as a rehearsal. The audit committee you will need later can then pick up a working function instead of building one under pressure.
FCG runs outsourced internal audit and controls reviews for Saudi companies, from a one-off health check to a full annual plan reporting to your board. Statutory audit stays with your external auditor; our associate firm Gadwalah CPA handles that work where clients need it.
Read more about our Internal Audit service, or book a free consultation and we will walk through where your controls stand today.
