THE REGULATORY REALITY
What CMA and the Companies Law Actually Require
Let’s be specific about what the law actually says — not what people assume it says, or what they hope it doesn’t.
Regulatory Timeline
2017- CMA Corporate Governance Regulations issued
2021- ZATCA e-invoicing Phase 1 launched; audit activity intensifies
2022- New Companies Law enacted with enhanced director duties
2023- CMA increases IPO review scrutiny on internal controls
2024- CMA observations issued to multiple listed companies on ICR disclosures
2025- Corporate Income Tax rules take full effect
2026+- Expected: formal ICR attestation requirements for listed companies
CMA Corporate Governance Regulations
Listed companies have to maintain effective internal controls and an internal audit function that reports to the Audit Committee. So far, so familiar. But here’s the part that’s changed: boards must now publish an annual assessment of how well those controls are actually working. Not a generic statement. An assessment — with methodology, with evidence, with named weaknesses and a plan to fix them. The CMA is reading these now. Properly. A one-paragraph declaration that everything is fine, with nothing behind it, is going to get flagged. We’ve seen it happen. Several times in the last two examination cycles.
The New Companies Law
The Companies Law has sharpened the language around what directors owe. Care. Loyalty. Oversight. These aren’t new concepts, but the liability provisions are more specific than they used to be. If there’s a breach or negligence in financial reporting, directors can be held jointly and severally liable. That’s personal exposure, not corporate.
So what does this mean in practice? A properly documented ICR framework isn’t a nice-to-have. It’s the paper trail that proves you were doing your job as a director. Without it, you’re not just exposed to regulatory risk — you’re exposed to personal risk. And no board member should be comfortable with that.
ZATCA and the Tax Reporting Dimension
This one catches people by surprise. VAT. Corporate Income Tax. Transfer Pricing. PE risk. E-invoicing. The tax landscape in Saudi has become genuinely complex over the past three years, and every single one of those obligations depends on the quality of your underlying financial data.
The numbers are worth knowing. VAT non-compliance penalties run between 5% and 25% of the underpaid amount. Repeat offenses? Double that. Transfer pricing adjustments can trigger reassessments plus penalties of up to 50% of the adjustment. These are not theoretical risks for most companies — they’re live ones.
Here’s the thing people miss: the controls that fix your ICR problem are the same controls that fix your tax problem. It’s the same data. If your revenue recognition is messy, your VAT returns will be messy too. You can’t fix one without the other.
KSA Is Moving Fastest
Worth zooming out for a moment. The UAE has governance requirements. Bahrain has the CBB rulebook. Oman’s CMA has its own framework. But none of them are moving as fast or as assertively as Saudi Arabia. The CMA here is further ahead in enforcement posture than any of its GCC peers. Companies that operate across the region should plan for convergence toward the Saudi standard — not the other way around.
Pre-IPO Expectations
If you’re on the path to listing, this bit matters most. The CMA now expects to see working internal controls before you file your prospectus. Not a roadmap. Not a commitment letter. Actual controls that have been designed, documented, and — ideally — tested.
We know of multiple IPO processes between 2023 and 2025 that hit delays because this wasn’t in place. In each case the cost was significant: adviser fees, management distraction, investor re-engagement, lost momentum. And that’s before you count the reputational hit of a delayed listing, which is harder to quantify but very real.
Fewer than 20% of Saudi subsidiaries have formal ICR documentation
THE SAUDI GAP:
Where Most Companies Fall Short
The end state is clear under COSO and SOX: assign ownership, document controls, test them, and report to the board. The concept is simple — the challenge is execution.
Across 40+ groups in the Kingdom, most material subsidiaries lack formal ICR documentation, and very few have tested controls in the past two years. This is not just a gap — it’s a governance blind spot.
ICR Maturity Assessment: Where Saudi Companies Typically Sit
Where Most Saudi Companies Are Today
Governance & Policy: Governance documents exist but are high-level, rarely updated, and not operationally embedded.
Control Documentation: Controls are implicit in process narratives; no standard library; mapping to risks is absent.
Testing & Assurance: Internal Audit plans driven by tradition or relationship, not risk; testing is compliance-focused rather than control-effectiveness focused.
Issue Management: Findings from IA and external audit tracked separately; no consolidated view; remediation timelines slip without consequence.
Board Reporting: Board report statements are narrative and qualitative; evidence base is thin; CMA reviewers are increasingly testing this.
And at the subsidiary level? No documentation. Manual controls nobody’s ever tested. Internal audit coverage on a three-year rotation at best. For any listed group with material subsidiaries, this is where the real risk hides — quietly, until it shows up in a restatement or a qualified audit opinion.
WHY THIS MATTERS BEYOND COMPLIANCE
Yes, there’s a compliance case. But if that’s the only argument you’re making to your board, you’re underselling it badly. Three other things matter just as much — arguably more.
IPO Valuation and Timeline
Investors and their advisers conduct detailed control assessments during IPO due diligence. Control weaknesses identified late in the process are expensive to remediate under time pressure and create negotiating leverage for buyers.
Research across emerging-market IPOs indicates that companies with independently assessed internal controls achieve 8–15% higher first-day pricing relative to peers with governance question marks. In a SAR 2 billion IPO, that translates to SAR 160–300 million in foregone value.
Companies with a demonstrable, tested ICR framework consistently achieve smoother CMA review processes, fewer late-stage disclosure requirements, and stronger institutional investor engagement during the bookbuild.
SAR 160–300 million in foregone IPO value from weak controls
Director Protection
Under the Companies Law, the question a director must be able to answer is not “Were there controls in place?” but “Did you exercise oversight over them, and how do you know they were working?”
Director Liability: With vs. Without ICR Oversight
Financial restatement
- Director CAN Demonstrate ICR Oversight: Defense of due diligence available; personal liability mitigated
- Director CANNOT: Joint and several liability exposure under Companies Law
CMA regulatory enquiry
- Director CAN Demonstrate ICR Oversight: Evidence of proactive remediation; reduced penalty risk
- Director CANNOT: Potential personal sanctions; reputational damage
Shareholder litigation
- Director CAN Demonstrate ICR Oversight: Documented governance record supports good-faith defense
- Director CANNOT: Burden of proof shifts to director
Decision Quality and Operational Performance
The least-discussed benefit of strong ICR is the one most directly connected to business performance: the reliability of the information management uses to run the company.
The reporting controls that satisfy CMA are the same controls that produce the accurate, timely data that enables a CFO to close books faster, manage cash more precisely, and negotiate with banks from a position of strength.
A PRACTICAL ROADMAP
Six Steps to ICR Maturity
ICR should not be treated as a one-time transformation project, but as a sequenced, risk-prioritized journey that delivers regulatory and business value at each stage.
Step 01: Diagnose: Assess the current state of internal controls against CMA regulations, Companies Law, and COSO principles, including governance, documentation, and issue tracking.
Step 02: Prioritize: Focus on high-risk reporting areas and key regulatory submissions, identifying major control gaps and “no-regret” priorities.
Step 03: Govern: Formalize ownership through a Board-level Internal Control Policy, updated IA Charter, and clearly defined accountability and reporting structures.
Step 04: Build: Develop and document a standardized control framework across core financial and regulatory processes.
Step 05: Test and Report: Implement risk-based testing, establish issue tracking and remediation, and produce structured Audit Committee reporting.
Step 06: Sustain: Embed the framework through digitization, analytics, annual reviews, and active CFO/Audit Committee oversight.
6–9 months from diagnostic to first testing cycle
CLOSING THOUGHT
Companies that treat ICR as an early investment rather than a late obligation will be better positioned on every dimension that matters in the current Saudi environment: regulatory approval, IPO valuation, director protection, capital access and the quality of information that drives strategic decisions.
The structural shift in KSA governance is not reversible. CMA expectations will continue to rise, ZATCA enforcement will continue to intensify, and institutional investors — domestic and international — will continue to apply global governance standards to Saudi‑listed companies.
For any board, the real question is not whether to invest in ICR, but when:
Five Questions Every Saudi Board Should Be Able to Answer Today
- Do we have a documented, board-approved ICR policy — and when was it last updated?
- Can we identify our top 10 financial reporting risks and the controls that mitigate them?
- Has our internal audit function tested the operating effectiveness of key controls in the past 12 months?
- Does our Audit Committee receive a structured report on control deficiencies, remediation status, and trends?
- If the CMA asked us to evidence our internal control assessment, could we produce the supporting documentation within 48 hours?
5 questions every Saudi board should answer today
