The Audit Committee

A board cannot, as a whole, sit with the external auditor for three hours, work through the judgements behind a set of accounts, or probe why an internal-audit finding keeps recurring. It has neither the time nor, often, the specific financial fluency. So it delegates that work to a small group of its own members who can — the audit committee. In Saudi Arabia, this is not optional for a listed company: the Capital Market Authority's Corporate Governance Regulations require an audit committee, and the quality of that committee is one of the clearest signals of whether a company is genuinely governed.

The committee exists to give the board — and, behind it, shareholders and regulators — independent assurance on three things: that the numbers can be trusted, that the external audit is rigorous and independent, and that the internal control system actually works. Everything below follows from those three jobs.

Composition: independence is the whole point

An audit committee only provides assurance if it can look at management's work from the outside. That makes its composition non-negotiable:

• Non-executive members, with independent directors forming its core — people with no employment, ownership, or business relationship that would compromise their objectivity.
• Financial literacy across the committee, and at least one member with genuine expertise in accounting or financial matters, able to read the statements critically rather than take them on trust.
• An independent chair who sets the agenda and is willing to ask the uncomfortable question.
• The CEO and CFO are not members. They attend when invited, to be questioned — not to sit in judgement of their own reporting.

A committee stacked with executives, or with "independent" directors who are independent only on paper, cannot do the job no matter how diligent it is. The structure has to make objectivity possible before the effort can make it real.

What the committee actually does

A well-run audit committee works across four fronts, each with a written mandate in its charter:

1. Financial reporting

Before the board approves them, the committee reviews the financial statements — focusing on the areas that involve judgement: significant estimates, unusual transactions, changes in accounting policy, and going concern. The question it exists to ask is not "do the numbers add up?" but "are the judgements behind them reasonable, and fully disclosed?"

2. The external audit

The committee owns the relationship with the external auditor on the board's behalf: it recommends the auditor's appointment, reviews the audit plan and fees, and safeguards the auditor's independence — including scrutinising any non-audit services that could compromise it. Crucially, it meets the auditor privately, without management present, so the auditor can speak freely about what they found and how management behaved.

3. Internal audit and internal control

The committee oversees the internal control system and the internal audit function. Internal audit should report functionally to the committee, not to the executives whose work it examines — that reporting line is what protects its independence. The committee approves the internal-audit plan, reviews its findings, and tracks whether remediation actually closes the gaps rather than merely being promised.

4. Compliance and whistleblowing

The committee typically oversees the framework for legal and regulatory compliance, the handling of related-party transactions, and the channel through which employees can raise concerns confidentially. A functioning speak-up route that reports into the audit committee is one of the most effective fraud controls a company has.

An audit committee that receives what management presents, and never questions it, is not oversight. It is a signature at the bottom of someone else's work.

Minutes that show challenge

The difference between a real audit committee and a decorative one shows up in its minutes. A committee that meets on a genuine schedule, holds private sessions with the auditor and with internal audit, and keeps minutes recording the questions it asked — not just the reports it received — is one an auditor and a regulator can rely on. Minutes that read as a list of items "noted" describe a committee that rubber-stamped. The record is the evidence that oversight happened.

Where audit committees fall short

• Members who cannot read the accounts — appointed for seniority or relationship, not financial capability.
• No private sessions — the auditor and internal audit are only ever heard with management in the room.
• A charter that is a template — adopted once and never referenced in a meeting.
• Internal audit reporting to the CFO — destroying the independence the committee exists to protect.
• Findings that recur — the same issue raised year after year, with remediation promised but never evidenced as closed.

Building an audit committee that does all of this is one of the longest-lead items in preparing a company to be publicly accountable — a director recruited last quarter cannot credibly claim to have overseen the year. It is also the committee that most reassures a regulator, a lender, or an incoming investor, because it is the clearest proof that the numbers are watched by someone with the independence, the expertise, and the mandate to say no.