A new client call often starts the same way. A finance manager has just been told by a bank, an investor, or the Ministry of Commerce portal that the company needs an audited financial statement, and nobody is sure whether that requirement actually applies to them.
The answer depends on how the company is structured, its size, and who regulates it. A Saudi statutory audit is not something every business needs, but most incorporated companies of any real scale do need one, and the rules changed with the Companies Law that took effect in 2023.
This guide explains exactly when a statutory audit is required in Saudi Arabia, which companies are exempt, and what to do if your company is now caught by the requirement.
When Does a Saudi Company Need a Statutory Audit?
Joint stock companies and most limited liability companies must appoint a SOCPA-licensed auditor under the Companies Law. LLCs classed as small or micro can be exempt if they meet two of three tests: turnover under SAR 10 million, assets under SAR 10 million, or fewer than 49 employees. Listed and regulated entities are always audited.
What Is a Statutory Audit?
A statutory audit is an independent examination of a company’s financial statements, carried out by a licensed external auditor, to confirm that the figures give a true and fair view of the company’s financial position. It is required by law rather than requested voluntarily by management.
In Saudi Arabia, the auditor checks the balance sheet, income statement, cash flow statement, and supporting records against the accounting standards endorsed by the Saudi Organization for Chartered and Professional Accountants (SOCPA), which are based on International Financial Reporting Standards (IFRS). The result is a signed audit opinion that shareholders, lenders, and regulators can rely on.
This is different from an internal audit, which a company commissions on its own initiative to review controls and processes, and from a review engagement, which gives a lower level of assurance and does not satisfy a statutory obligation.
Which Companies Must Appoint an Auditor?
The starting point is the Companies Law issued by the Ministry of Commerce, which came into force on 19 February 2023 and replaced the previous 2015 law. It sets out two broad groups of companies that must appoint an auditor
Joint stock companies always need an auditor
Every joint stock company, whether listed on the Saudi Exchange (Tadawul) or closed, must appoint one or more auditors. This applies regardless of turnover, assets, or headcount. The legal form alone triggers the obligation, because a JSC structure is designed to attract outside shareholders who need independent assurance over the numbers.
Listed companies carry an extra layer of oversight from the Capital Market Authority, which sets its own disclosure and audit timelines on top of the Companies Law.
Limited liability companies are generally required to have an auditor too
Most people assume an LLC, as a private structure with a small number of partners, sits outside the audit net. Under the current Companies Law, that assumption is wrong for anything but the smallest businesses. LLCs are generally required to appoint an auditor, and the exemption available to small and micro companies has to be actively claimed and documented rather than assumed.
The Small and Micro Company Exemption for LLCs
The Companies Law does not require an LLC to appoint a statutory auditor if the company qualifies as small or micro under the executive regulations. Qualification depends on meeting at least two of the following three criteria in the relevant financial year:
- Annual turnover below SAR 10 million
- Total assets below SAR 10 million
- Average employee headcount below 49
If a company meets two out of the three tests, it can rely on the exemption. If it only meets one, the exemption does not apply, and an auditor must be appointed.
This size-based test replaced an older rule that tied the audit obligation to a company’s registered capital. Some guidance still in circulation online refers to a capital threshold around SAR 500,000 for LLCs. That reflects the position under the previous Companies Law and no longer determines whether a current-generation LLC needs an audit. If you are relying on older material to decide, it is worth rechecking the position against the 2023 law and its executive regulations before assuming your company is exempt.
When the exemption does not apply, even to a small company
A handful of situations override the small and micro exemption regardless of how the numbers work out:
- The company has foreign ownership, in whole or in part.
- The company has issued or intends to issue debt instruments such as sukuk or bonds.
- Partners holding at least 10 percent of the capital request that an auditor be appointed.
- The Articles of Association require the appointment of an auditor.
A foreign-owned trading company with SAR 3 million in turnover, for example, cannot rely on the small company exemption purely because of its size. Ownership structure decides the outcome here, not turnover.
Other Situations That Trigger an Audit Requirement
Beyond legal form and size, a handful of sector and situational triggers apply independently of the Companies Law.
Regulated financial institutions. Banks, insurance companies, finance companies, and other entities supervised by the Saudi Central Bank must be audited under their licensing conditions, regardless of size.
Listed and CMA-regulated entities. Companies with securities admitted to trading, investment funds, and CMA-licensed intermediaries fall under Capital Market Authority audit and disclosure rules that sit alongside the Companies Law.
Group and consolidated reporting. Where an LLC is part of a group, the turnover, assets, and headcount of related entities can be relevant to the size test. A holding company that looks small on its own can still be caught once its subsidiaries are taken into account.
Foreign branches. A Saudi branch of an overseas company is generally expected to have its local accounts audited, and the parent company’s own reporting obligations can add a further layer of requirements.
Lender and investor requirements. Even where a company is legally exempt, banks financing the business, investors conducting due diligence, or a parent company consolidating results will often ask for audited or reviewed financial statements as a condition of the relationship.
Statutory Audit vs Voluntary Review Engagement
Some SMEs that are not legally required to be audited still commission assurance work because a lender, investor, or supplier asks for it. It helps to know how the two options differ before deciding which one fits.
| Feature | Statutory Audit | Voluntary Review Engagement |
|---|---|---|
| Legal basis | Required by the Companies Law or a sector regulator | Chosen voluntarily by the company |
| Level of assurance | Reasonable assurance, the highest level available | Limited assurance |
| Typical cost | Higher, reflecting deeper testing of transactions | Lower, based on analytical procedures and inquiry |
| Auditor qualification | Must be SOCPA-licensed | Also performed by a SOCPA-licensed practitioner |
| Best suited to | Companies caught by the Companies Law or a regulator | Exempt SMEs that need comfort for a lender or investor |
If your company is required to be audited, a review engagement will not satisfy the obligation. If you are genuinely exempt but a bank or investor wants assurance, a review can be a proportionate and less costly alternative.
What Happens If a Required Audit Is Skipped
Treating the audit requirement as optional carries real consequences. Failing to appoint an auditor when the Companies Law requires one, or failing to file audited statements on time, can result in administrative penalties, and can affect a company’s standing with the Ministry of Commerce, including licence renewals and other filings.
There is also a tax angle worth planning around. Where an audit uncovers Zakat or VAT that has been under-declared, the Zakat, Tax and Customs Authority (ZATCA) can raise its own penalties on the shortfall. Reconciling Zakat and VAT filings against the accounting records before the audit starts is one of the simplest ways to avoid this kind of surprise.
Because penalty amounts and enforcement practice can change, confirm the current position with the Ministry of Commerce or a licensed advisor before treating any figure you see elsewhere as final.
How to Prepare for Your First Statutory Audit
Preparation determines both the cost and the length of the engagement. A company with clean, reconciled records will move through fieldwork faster than one where the auditor has to chase missing documents. Auditors in Saudi Arabia will typically ask for:
- Year-end trial balance and general ledger
- Bank statements and reconciliations for every account
- Fixed asset register, including additions, disposals, and depreciation
- Accounts receivable and payable ageing schedules
- Inventory records and stock count documentation
- Zakat and VAT returns, reconciled to the accounting records
- Payroll records and employee headcount data
- Board minutes, key contracts, and legal documents
Companies preparing for their first audit should also confirm that accounting records are being kept in Arabic and stored within the Kingdom, as Saudi regulations require, and that records are retained for the period set out in the Companies Law.
Choosing a SOCPA-Licensed Auditor
Only auditors licensed by SOCPA may sign a statutory audit report in Saudi Arabia. Before appointing a firm, it is worth checking a few practical points beyond the licence itself.
Look for experience with companies of a similar size and industry, since the issues that come up in a construction contractor’s accounts are not the same as those in a trading business or a technology start-up. Ask how the firm scopes and prices engagements, since a fee that looks low can reflect a narrower scope than you expect. Confirm the firm’s independence position, since SOCPA rules limit the non-audit services an auditor can provide to the same client. Finally, check the proposed timeline against your own reporting deadlines, including the Ministry of Commerce filing window and any lender or shareholder requirements.
Under current rules, an audit firm can generally be appointed for up to five consecutive years, extendable in limited circumstances, while the individual partner signing the report is subject to a shorter rotation limit. This is worth factoring into a multi-year relationship with any firm you appoint.
Frequently Asked Questions
Does every Saudi company need a statutory audit?
No. Joint stock companies always need one, and most LLCs do too, but LLCs classed as small or micro under the size test can be exempt unless foreign ownership, debt issuance, a partner request, or the Articles of Association override the exemption.
What size threshold decides whether an LLC needs an audit?
An LLC can be exempt if it meets at least two of three tests: annual turnover under SAR 10 million, total assets under SAR 10 million, and an average headcount under 49 employees. Meeting only one test does not qualify the company for the exemption.
Can a foreign-owned company in Saudi Arabia avoid the audit requirement?
Generally no. The small and micro exemption does not apply to foreign-owned entities regardless of their turnover, assets, or headcount, so most foreign-owned LLCs need a SOCPA-licensed auditor.
How long does a first-time statutory audit usually take?
It depends heavily on how organised the company’s records are. A company with reconciled accounts and a complete document set will move through fieldwork considerably faster than one where the auditor has to reconstruct missing records.
Who can perform a statutory audit in Saudi Arabia?
Only auditors licensed by the Saudi Organization for Chartered and Professional Accountants (SOCPA) can sign a statutory audit report. An unlicensed practitioner’s report will not be accepted by the Ministry of Commerce or the Capital Market Authority.
Where are audited financial statements filed?
Audited financial statements are generally filed with the Ministry of Commerce through its electronic filing platform, typically within a set period after the financial year end. Listed companies file with the Capital Market Authority as well.
Is a review engagement an acceptable substitute for a statutory audit?
Only if the company is genuinely exempt from the audit requirement. A review provides a lower level of assurance and does not satisfy a legal obligation to be audited.
Summary
Whether a Saudi company needs a statutory audit comes down to legal form, size, and who regulates it. Joint stock companies, listed entities, and regulated financial institutions are always audited. Limited liability companies are generally required to appoint an auditor too, though small and micro LLCs can claim an exemption if they meet the size test and none of the override conditions apply.
Because the rules changed with the 2023 Companies Law, and because group structures, foreign ownership, and sector regulation can all change the answer, it is worth confirming your company’s specific position rather than relying on assumptions carried over from an earlier structure or an outdated source.
Next Steps
If you are not sure whether your company is required to appoint an auditor, or you need to prepare for your first statutory audit in the Kingdom, request an audit consultation with our team to review your legal form, size, and reporting obligations before your next filing deadline. You can also explore our audit firm in Riyadh and speak with an audit specialist about what a first-year engagement typically involves.
