The guide: coding system and sector requirements
Every paper in the file has a fixed code, and each code tells you the section it belongs to. That order lets you find any paper quickly and cross-reference to and from it without ambiguity.
Coding rules
- Ten sections, one per hundred: from 000 “File Administration” to 900 “Quality Review and File Closure”.
- A main paper has three digits within its section, e.g. 403 “Risk and Control Matrix”.
- A sub-paper carries its parent's code plus two digits, e.g. 40301 “Test of Design” under 403.
- Papers prepared for each engagement take the engagement number before their code: 03-401 is the process narrative for engagement 03. Permanent, annual and contract papers keep their code alone.
- Tickmarks, referencing rules and the standard header on every paper are defined in paper 002.
The ten sections
- 000File AdministrationIA-01
- 100Acceptance, Engagement and AdministrationIA-02
- 200Permanent and Annual FileIA-03IA-04
- 300Engagement PlanningIA-05IA-08
- 400Process Understanding and Control AssessmentIA-06IA-08
- 500Testing and FieldworkIA-07IA-08
- 600FindingsIA-09
- 700Reporting and Follow-upIA-09IA-10
- 800Advisory EngagementsReplaces 400–700 on advisory engagementsIA-11
- 900Quality Review and File ClosureIA-12
Sector requirements
Additional requirements applied on top of the base guide according to the client's sector. They appear as notes inside the affected templates.
| Sector and regulator | Requirement | Papers |
|---|---|---|
| Local banks Saudi Central Bank (SAMA) | Functional reporting to the Audit Committee and administrative reporting to the CEO Internal Audit Principles for Local Banks (effective 1 January 2022) | 20203 |
| Local banks Saudi Central Bank (SAMA) | Quarterly report to the Audit Committee on assessments, findings and management responses, and an annual report on the internal control system and performance against plan Internal Audit Principles for Local Banks (effective 1 January 2022) | 709, 707 |
| Local banks Saudi Central Bank (SAMA) | Risk-based annual plan with a documented assessment, approved by the Audit Committee and updated at least annually Internal Audit Principles for Local Banks (effective 1 January 2022) | 207, 208, 20801 |
| Local banks Saudi Central Bank (SAMA) | Outsourcing limited to specialised assignments; requires SAMA prior approval, a non-disclosure agreement and knowledge transfer to staff; the provider may not be the external auditor or be re-engaged for the same assignment within 3 years Internal Audit Principles for Local Banks (effective 1 January 2022) | 101, 10102, 103, 10301, 10302, 10303 |
| Local banks Saudi Central Bank (SAMA) | Electronic database of reports, findings, corrective action plans and working papers, and an approved records retention manual Internal Audit Principles for Local Banks (effective 1 January 2022) | 906, 705 |
| Local banks Saudi Central Bank (SAMA) | Independent external quality assessment at least every 5 years Internal Audit Principles for Local Banks (effective 1 January 2022) | 903 |
| Listed companies Capital Market Authority (CMA) | The Audit Committee reviews internal audit reports, follows up corrective actions and oversees the performance of internal audit Corporate Governance Regulations — Audit Committee duties | 709, 705, 707 |
| Listed companies Capital Market Authority (CMA) | The committee's annual report includes its opinion on the adequacy of internal control and risk management and is published with the General Assembly invitation Corporate Governance Regulations — Audit Committee duties | 709 |
| Listed companies Capital Market Authority (CMA) | A mechanism for employees to raise concerns confidentially, with independent investigation Corporate Governance Regulations — Audit Committee duties | 30201 |
| Associations and civil foundations National Center for Non-Profit Sector Development | Associations with annual revenue of SAR 5 million or more form an internal audit committee Governance Rules for Associations and Civil Foundations (Umm Al-Qura, 2023) — Article 20 | 20201 |
| Associations and civil foundations National Center for Non-Profit Sector Development | The committee reviews internal control and recommends the appointment of the internal auditor Governance Rules for Associations and Civil Foundations (Umm Al-Qura, 2023) — Article 21 | 101, 103 |
| Associations and civil foundations National Center for Non-Profit Sector Development | The external auditor may not be a member of the internal audit committee Governance Rules for Associations and Civil Foundations (Umm Al-Qura, 2023) — Article 36 | 10102 |
| Government entities Council of Ministers | General standards: full independence, impartiality, confidentiality and due professional care Unified Regulation for Internal Audit Units in Government Agencies and Public Institutions (Resolution No. 129 dated 6/4/1428H) | 104, 10301 |
Check the official text of each reference before relying on it; regulations change.