Internal Audit (IIA Standards): Building a Risk-Based Audit Program in Saudi Arabia

You built the ethics program — now who verifies it works?

Once you have an ethics program, who checks it is actually working? That question is the bridge from Part 1 of SCI’s GRC Foundations series to internal audit. Policies, risk registers and compliance controls are management mechanisms; internal audit gives the board or audit committee an independent view of whether those mechanisms are designed sensibly, operate as intended and produce reliable evidence.

For organizations building the wider operating model first, SCI’s step-by-step GRC framework guide explains how governance, risk, compliance and controls connect. Internal audit is the independent assurance layer that tests whether that architecture works in practice.

Internal-audit maturity matters now for two reasons. First, The IIA’s 2024 Global Internal Audit Standards have been effective since 9 January 2025. Second, Saudi regulated sectors impose their own governance requirements. For local banks, SAMA’s internal-audit principles are in force; for Main Market listed companies, the CMA Corporate Governance Regulations set specific expectations for internal control and internal audit. A sound Saudi audit program therefore needs both a professional-standard lens and the correct sector-rule lens.

Source: The IIA — Global Internal Audit Standards

Source: SAMA Rulebook — Principles of Internal Auditing for Local Banks

Source: Capital Market Authority — Corporate Governance Regulations

What IIA International Standards Actually Require

The IIA’s Global Internal Audit Standards are the mandatory professional standards within the 2024 International Professional Practices Framework (IPPF). They are not Saudi statutes by themselves, but they define the professional baseline for an internal audit function that claims alignment or conformance. The Standards are organized into five domains: Purpose of Internal Auditing; Ethics and Professionalism; Governing the Internal Audit Function; Managing the Internal Audit Function; and Performing Internal Audit Services.

Source: The IIA — 2024 Global Internal Audit Standards

The purpose is broader than checking transactions. Internal audit is expected to strengthen the organization by providing independent, risk-based and objective assurance, advice, insight and foresight to the board and management. That makes governance, risk management and control effectiveness the core subject matter — not merely compliance with an annual checklist.

Source: The IIA — Complete Global Internal Audit Standards, Domain I

Independence is designed into the governance structure

Standard 6.2 requires an internal audit charter that formally documents the function’s mandate and other key elements. Standard 7.1 requires the chief audit executive (CAE) to confirm organizational independence to the board at least annually, document reporting relationships and positioning in the charter, and discuss actual or potential impairments. In practical terms, internal audit cannot credibly verify controls that management can edit, suppress or redirect at will.

Source: The IIA — Global Internal Audit Standards, Standards 6.2 and 7.1

The audit plan must follow risk, not habit

Standard 9.4 requires the CAE to create a plan that supports organizational objectives and is based on a documented assessment of strategies, objectives and risks. That assessment must be performed at least annually, and the plan should be reviewed and updated when business conditions, systems, controls or risk exposures change. The board approves the plan. This is the professional foundation for risk-based internal auditing.

Source: The IIA — Global Internal Audit Standards, Standard 9.4

Quality is part of conformance, not an optional afterthought

A function aligned to the Standards also needs a quality assurance and improvement program. Standard 8.4 requires an external quality assessment at least once every five years by a qualified, independent assessor or assessment team. The IIA also expects ongoing and periodic internal quality assessment. A function should therefore build quality evidence into its operating calendar rather than wait until the fifth year to discover gaps.

Source: The IIA — Internal Audit Quality Assurance FAQs

The 2024 IPPF also includes mandatory Topical Requirements. As of October 2026, the Cybersecurity and Third-Party Topical Requirements are effective. They apply when internal audit provides assurance on those topics; Global Guidance remains recommended rather than mandatory. This matters when designing an audit universe because professional requirements can change the minimum criteria used in an engagement without dictating that every topic must be audited every year.

Source: The IIA — Topical Requirements

Infographic: IIA operating architecture — five connected domains supporting independent, risk-based assurance.

Source: The IIA — 2024 Global Internal Audit Standards

How This Maps to SAMA/CMA Internal Audit Expectations for Regulated Entities

The important Saudi compliance point is scope. The IIA Standards are a professional benchmark; SAMA and CMA requirements apply according to the regulated entity. A private unlisted operating company should not copy a bank rulebook and call it universally mandatory. Start with the rules that actually govern the entity, then use the IIA framework to strengthen how the function is governed and performed.

SAMA: local banks

SAMA’s Principles of Internal Auditing for Local Banks Operating in Saudi Arabia are in force and apply to all local banks in the Kingdom. They describe internal audit as the third and final line in the three-lines model, directly accountable to the Board and Audit Committee for evaluating governance, risk management and controls through a structured risk-based approach. The principles also require administrative independence from the first and second lines, unrestricted authority across the bank, and direct functional communication with the Audit Committee.

Source: SAMA Rulebook — Principles of Internal Auditing for Local Banks, clauses 3-3 and 11-14

For planning, SAMA is especially concrete. Banks must document a comprehensive list of auditable units and affiliated entities covering operational units, products, services, systems, risks and processes; review that list at least annually; maintain a formal risk-assessment framework; and document an audit cycle that may extend three to four years depending on risk classification. The annual plan must be based on a thorough risk assessment, consider executive-management input, and be updated as the bank’s risk profile changes.

Source: SAMA Rulebook — clauses 38-50, risk-based internal audit plan

SAMA also requires a quality assurance and performance improvement program with internal evaluations and an independent external quality assessment at least once every five years. This aligns closely with the IIA quality architecture, while remaining a bank-specific regulatory requirement in its own right.

Source: SAMA Rulebook — clauses 54-57 and five-year external assessment requirements

CMA: listed companies within the Corporate Governance Regulations

For Main Market listed companies, the CMA Corporate Governance Regulations are mandatory except provisions identified as guiding. Articles 70-75 connect board-approved internal control, risk and internal-audit functions, independence, audit-committee accountability, unrestricted access, a comprehensive audit plan and periodic reporting. SCI’s audit committee roles guide provides additional board-level context for how oversight and internal audit interact.

Source: Capital Market Authority — Corporate Governance Regulations, Articles 70-75 and Article 2

Articles 73-75 were amended in 2023 and became mandatory from 1 January 2024. Article 74 requires a comprehensive audit plan approved by the audit committee, updated annually, with key activities and operations — including risk management and compliance activities — reviewed at least annually. Parallel Market applicability is different: the regulations identify a narrower set of provisions as mandatory there, with other provisions generally treated as guidance unless another rule or CMA decision says otherwise.

Source: Capital Market Authority — Corporate Governance Regulations, Articles 2, 73, 74 and 75

The Three Lines of Defense Model, Explained Simply

The common search term “three lines of defense” is still widely used. The IIA’s current name is the Three Lines Model, and its formal statement was refreshed in July 2026. The model separates ownership from oversight and independent assurance. The board remains accountable for governance; management owns and manages risk; second-line roles support, monitor and challenge; internal audit is the independent third line.

Source: The IIA — current Statements of Position and refreshed Three Lines Model

Source: The IIA — Three Lines Model

Source: SAMA Rulebook — bank-specific third-line requirement

The practical rule is straightforward: internal audit can advise management, but it should not become the permanent owner of the risk process or control it will later audit. Where the CAE holds second-line responsibilities, the IIA requires documented safeguards and alternative assurance for affected areas.

Source: The IIA — Standard 7.1 Organizational Independence

Infographic: Three Lines Model — board oversight, first-line ownership, second-line challenge and independent internal audit.

Source: The IIA — refreshed Three Lines Model

Building a Risk-Based Audit Plan, Step by Step

A risk-based plan is not a list of departments rotated on a fixed schedule. It is a documented decision about where independent assurance will create the most value given the organization’s objectives, risk profile, regulatory obligations and available audit resources. The following sequence combines IIA Standard 9.4 with the more detailed audit-universe and planning requirements that SAMA sets for local banks.

Source: The IIA — Standard 9.4 Internal Audit Plan

Source: SAMA Rulebook — clauses 38-50

1. Confirm the mandate, charter and reporting line

Before scoring risks, confirm what internal audit is authorized to review, who approves the charter and plan, who the CAE reports to, and whether there is unrestricted access to records, people and systems. If governance is unclear, a sophisticated risk model will not fix the independence problem.

2. Build the audit universe

Create a structured inventory of auditable entities: business units, legal entities, major processes, products, systems, projects, outsourced arrangements, compliance obligations and cross-cutting risks. The universe should be complete enough that a high-risk area cannot disappear simply because it has no convenient department name.

3. Collect risk signals

Use strategic objectives, enterprise-risk information, regulatory expectations, incidents, losses, complaints, prior audit findings, external-audit observations, major system changes, acquisitions, outsourcing, new products and management concerns. Do not rely on one risk register as the only source.

4. Apply a documented prioritization method

Score factors consistently. Common factors include inherent risk, residual risk, control maturity, regulatory criticality, materiality, change velocity, time since last audit, prior findings, complexity and management concern. The exact weights should fit the organization and be documented.

5. Convert risk into coverage

High-risk items generally receive earlier or deeper coverage; lower-risk items may be deferred or reviewed through thematic work, continuous monitoring or reliance on other assurance. For SAMA-regulated banks, any regulator-specified frequency overrides the internal risk assessment.

6. Match the plan to resources and obtain approval

Estimate the skills, technology, specialist support and audit days required. Show the audit committee what is covered, what is not, why items are deferred, and what resource constraint creates residual assurance risk. Then obtain the required approval.

7. Keep the plan dynamic

Review emerging risk during the year. A cyber incident, acquisition, major outsourcing, new regulator requirement or failed remediation may justify moving an engagement forward. Document material plan changes and communicate them to the board or audit committee.

A simple audit-universe table can make the prioritization visible. The example below is illustrative — it is not a regulator-prescribed scoring model.

Source: Implementation basis — The IIA Standard 9.4

Source: Implementation basis — SAMA clauses 38-50 for local banks

Infographic: risk signals flow into a documented assessment, prioritized audit universe and dynamic audit-plan portfolio.

Source: The IIA — Standard 9.4 Internal Audit Plan

Common Internal Audit Failures Saudi Companies Should Avoid

The weaknesses below are not “Saudi-only” failures; they are recurring implementation patterns that conflict with the direction of the IIA Standards and, for regulated entities, can also create gaps against SAMA or CMA expectations. SCI’s internal-control gaps guide explains why a control that exists only on paper gives the board false comfort.

• Repeating last year’s plan with minor date changes instead of rebuilding priorities from current strategy and risk.

• Treating the audit universe as an organization chart, so cross-cutting risks, outsourced processes, systems and major projects fall outside coverage.

• Weak CAE access or reporting arrangements that allow management to delay, narrow or filter sensitive work.

• Allowing internal audit to design or own the control it will later evaluate without documenting safeguards and alternative assurance.

• Using compliance checklists that confirm a policy exists but do not test control design, operating effectiveness or evidence quality.

• Writing findings without a clear risk statement, root cause, accountable owner, target date and closure evidence.

• Closing repeat findings on management assertion alone, without validating whether the corrective action actually works.

• Ignoring the quality calendar — including internal assessment and the five-year external assessment requirement when claiming IIA conformance.

Source: The IIA — Standards 7.1, 8.4 and 9.4

Source: SAMA — Principles of Internal Auditing for Local Banks

Source: CMA — Corporate Governance Regulations

Readiness Checklist: Is Your Internal Audit Function IIA-Aligned?

Use this as a management and audit-committee discussion tool, not as a substitute for a formal quality assessment. “Yes” should mean there is evidence, not only an intention.

Source: The IIA — Global Internal Audit Standards

Source: The IIA — Internal Audit Quality Assurance FAQs

How structured training can close the alignment gap

An audit methodology only works when the team shares the same interpretation of independence, risk assessment, planning, evidence, reporting and quality. For internal auditors, audit managers, GRC professionals and assurance leaders who need a structured review of these concepts, SCI’s Internal Audit — IIA Standards course can support that learning process. Training should complement — not replace — the organization’s own regulatory analysis, audit charter, methodology, supervision and quality assurance.

GRC Foundations Series — Part 2 of 3

This article is Part 2 of SCI’s three-part GRC Foundations series. Part 1 — Ethics & Anti-Corruption Compliance establishes why the control and ethics program exists. Part 2 explains how internal audit independently tests whether governance, risk management and controls work. Part 3 — KYC & Customer Due Diligence applies the same evidence-and-assurance mindset to customer-facing onboarding and due diligence. Replace the “coming soon” placeholders only after the real article URLs are live and verified.

Conclusion

A mature internal audit function is not defined by the number of audits completed. It is defined by whether the right risks receive independent attention, whether conclusions are supported by evidence, whether the board receives an unfiltered view, and whether findings lead to durable improvement.

For Saudi organizations, the practical model is layered: use the IIA Standards as the professional operating baseline, then apply the regulatory requirements that actually govern the entity. For local banks, SAMA is detailed about independence, the audit universe, risk-based planning, quality and reporting. For listed companies within CMA scope, the Corporate Governance Regulations connect internal control, audit-committee accountability, audit planning and reporting. The result should be one coherent audit program — independent, risk-based, documented and capable of changing when the risk profile changes.