Capital Market Authority regulations

Who it applies to

Companies listed on the Saudi Exchange and capital market institutions authorised by the CMA, including their internal audit and audit committee arrangements.

What internal audit has to show

The governance regulations set expectations for the audit committee, the internal audit function and periodic reporting. Audit has to demonstrate an approved risk-based plan and reporting to the committee on its execution.

What Oversight does with CMA

• Keeps the annual plan, its approval trail and its execution status in one record that can be shown to the committee.
• Drafts programs for governance, disclosure and conduct reviews with the evidence each requirement expects.
• Tracks findings, management responses and follow-up to closure with named preparer, reviewer and approver.
• Assembles the periodic audit committee pack from the same live record, so it reflects the current state.

Typical engagements

• Corporate governance compliance review
• Disclosure and related-party review
• Audit committee reporting and follow-up