Saudi Arabia Tightens Audit Quality & Oversight Rules for CMA-Regulated Firms

Key Takeaways

• Audit Quality Requirements Strengthened: Saudi Arabia’s Capital Market Authority has approved new requirements covering professional qualifications, quality management, inspections and transparency for registered accounting firms.
• Qualified Audit Managers Required: Firms must maintain enough audit managers holding a SOCPA fellowship, or an equivalent fellowship accepted by the CMA, based on the nature, scale and complexity of their business.
• Inspection Findings Can Require Remediation: Where warranted, firms must prepare corrective action plans following CMA inspections, obtain the authority’s approval and implement them.
• Audit Committees Gain Greater Visibility: Firms must share the CMA’s final inspection results concerning a listed company’s audit file with that company’s audit committee.
• Transparency Reports Expand: Firms must disclose more about their governance, leadership and quality management systems, including who oversees those systems and the results of their annual evaluations.

Deep Dive

For an accounting firm auditing companies under the supervision of Saudi Arabia’s Capital Market Authority, an inspection will no longer necessarily end when the regulator leaves the room. The CMA Board has approved amendments to the Rules for Registering Auditors of Entities Subject to the Authority’s Supervision, tightening requirements around professional qualifications, quality management, regulatory inspections and transparency. The amendments take effect from the date of their publication.

The changes reach into the machinery of an audit firm rather than simply adding another layer of disclosure around it. The CMA wants registered firms to have enough qualified people for the work they undertake, systems capable of protecting audit quality, and a clearer process for correcting weaknesses when an inspection finds them.

At the personnel level, registered accounting firms must maintain a sufficient number of audit managers who hold a fellowship from the Saudi Organization for Chartered and Professional Accountants, or an equivalent professional fellowship accepted by the CMA. The requirement is not expressed as a single numerical threshold. The number must instead be commensurate with the nature, scale and complexity of the firm’s business activities.

That formulation puts the burden where it belongs: on whether a firm has the professional depth to support the work it has taken on. A larger or more complicated audit practice cannot satisfy the requirement merely by meeting a fixed minimum designed for a smaller one.

The amendments also require firms to maintain an appropriate quality management system for engagements involving the audit and review of financial statements. Registered firms must comply with professional standards when reviewing interim financial statements and auditing annual financial statements of entities under CMA supervision.

The CMA said the measures are intended to enhance the quality of audit work and increase investor confidence in the market. They form part of a broader effort to create a regulatory framework aligned with international best practices and relevant laws and regulations, while improving the information disclosed by accounting firms registered with the authority.

When an Inspection Finds Something

The sharper edge of the amendments appears in the inspection process. Registered accounting firms must comply with detailed instructions when the CMA conducts an inspection, including requirements to cooperate with the authority and provide the information, data and documents it requests. But the rules do not allow the process to stop at the finding itself.

Where the outcome of an inspection warrants corrective action, the accounting firm must prepare a corrective action plan and submit it to the CMA for approval. Once approved, the firm must comply with its implementation.

There is another consequence when the inspection concerns the audit file of a listed company. The accounting firm must share the CMA’s final inspection results with that company’s audit committee.

That changes who sees the regulator’s findings. An inspection of an audit file is no longer solely a matter between the accounting firm and the CMA. The committee charged with monitoring the auditor’s work is brought into the chain, giving it the regulator’s final findings on the audit it is responsible for overseeing.

The CMA said the requirement is intended to enable audit committees to perform their duties in monitoring auditors’ work.

The result is a more complete line of accountability. Firms must provide the regulator with what it needs to conduct an inspection, address deficiencies when corrective action is warranted and, for listed-company audit files, place the final findings before the audit committee. A weakness identified in an inspection therefore has somewhere to go.

Making Audit Quality Visible

Some of the most revealing changes concern the Transparency Report, because they deal with something regulators have long had to contend with: audit quality is difficult for outsiders to judge from the finished audit opinion alone.

Under the amendments, registered accounting firms must provide disclosures concerning their profile, governance and leadership. They must also describe the quality management system they apply, identify the people assigned to oversee it and disclose the outcome of the system’s annual evaluation.

Taken together, those disclosures expose more of the structure behind the audit. Interested parties can see not merely that a quality management system exists, but who is responsible for overseeing it and what the firm’s own annual evaluation found.

The CMA said the additional information is intended to allow interested parties to assess the quality of audit work performed by registered accounting firms.

The final amendments did not arrive without warning. On April 8, 2026, the CMA published draft amendments to the auditor registration rules for public consultation through the Unified Electronic Platform for Consulting the Public and Government Entities, which is affiliated with the Saudi Competitiveness and Business Center, as well as through the CMA’s own website. The consultation remained open for 30 calendar days.

What has emerged from that process is a framework concerned with the conditions under which reliable audits are produced: who manages the work, what systems govern it, how firms respond when the regulator finds a problem and what the people responsible for overseeing a listed company’s auditor are allowed to know.

For registered accounting firms, those obligations now sit closer together. Professional qualifications feed into audit execution, audit execution sits inside a quality management system, that system is subject to inspection and evaluation, and shortcomings can produce corrective obligations visible beyond the walls of the accounting firm. The audit opinion may remain the document the market ultimately sees. The CMA’s amendments place considerably more weight on everything required to stand behind it.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.