Which Saudi Companies Must Appoint an Auditor, and How Long One May Serve

Most Saudi companies are not obliged to have an auditor at all. The Companies Law opens by saying a company shall have one auditor or more, licensed to practise in the Kingdom, and the next article takes the obligation away again from micro and small companies. The Implementing Regulations define micro and small with three numbers, and a company that meets any two of them is out of scope.

The companies that stay in scope get the other half of the rule: an appointment with an expiry date. An individual auditor may serve 10 consecutive fiscal years. A firm may serve 10, may be reappointed on conditions, and may not pass 20 in total, with the partner supervising the audit capped at 10 inside that. A listed company runs a shorter clock set by the Capital Market Authority, and that one counts non-consecutive years too.

Both halves are examined, from two directions. The Regulations paper of the SOCPA Fellowship asks what the Law and its Regulations say; the Audit paper asks what the auditor must do about it. A candidate who trained on the international standards alone will recognise the idea of rotation and almost none of these numbers.

When the Law requires an auditor, and when it does not

Article 18 of the Companies Law, issued by Royal Decree M/132 of 30 June 2022 and in force from January 2023, does most of the work in two sentences. A company shall have one or more auditors licensed to practise in the Kingdom, and the partners, the general assembly or the shareholders determine his appointment, his fees, his term and his scope of work. The maximum term is not in the Law at all: Article 18 hands that to the Regulations.

Article 19 is the exemption. The Article 18 requirement does not apply to micro and small companies, with six exceptions that put a company straight back in scope.

Exception in Article 19(1)	What it catches
The articles of incorporation or association provide for an auditor	The company's own constitutional document. Read it before assuming the exemption.
It is listed in the capital market	Listed joint stock companies, which then answer to a stricter regime as well.
It issues debt instruments, traded financing sukuk, preferred stock or redeemable stock	Anything raised through an instrument the market can hold.
Relevant laws require an auditor	Regulated activities. An entity supervised by the Capital Market Authority may only be audited by an auditor registered with the Authority.
It is a foreign company	A foreign investor's Saudi vehicle does not escape on size.
It owns another company or is a subsidiary of one	Groups, unless every company in the group is itself micro or small.

Article 19(4) exempts the general partnership separately, unless all of its partners are companies in a form other than a general partnership, or all are general partnerships whose own partners are, or its articles provide otherwise. The logic is consistent: where the ultimate risk sits behind limited liability, someone audits.

The micro and small test: two of three

Article Seven of the Implementing Regulations sets the criteria Article 19 refers to. A company is designated micro or small in a fiscal year when two of the following are met.

Test	Threshold
Total revenues	Not more than SAR 10 million
Asset value	Not more than SAR 10 million
Number of employees	Not more than 49

Two of three, not all three, is the detail a question turns on. A company with SAR 9 million of revenue, SAR 12 million of assets and 40 employees fails the asset test and still qualifies. Add one fact, that it is a subsidiary, and Article 19(1) puts it back in scope with nothing else changed. Article 19(2) then adds a timing rule: the designation applies during the first fiscal year of registration with the Commercial Register, or for two consecutive fiscal years, so the status is meant to be stable rather than to flip with one good year. Read that paragraph in the Arabic before relying on a single set of figures.

The exemption is claimed on the record rather than quietly assumed. Article Five of the Regulations requires the manager or chairman to file the financial statements, and the auditor's report if there is one, with the Saudi Business Center through the electronic filing programme. Article Seven(2) requires a company relying on the exemption to attach a statement that the requirement does not apply to it and that no partner or shareholder holding the prescribed percentage has asked for one.

The partner who can force an appointment, 30 days before year end

That second half of the statement points at Article 19(3). One or more partners or shareholders representing at least 10% of the company's interests or voting shares may request an auditor in writing. It is the minority's own lever: no regulator has to agree and the majority does not have to want it.

Article Eight of the Regulations sets the mechanics, and they are tight. The request goes in writing to the manager or the board of directors, at least 30 days before the end of the company's fiscal year. On receiving it, the manager or board must call the partners, the general assembly or the shareholders to vote on the appointment under the ordinary rules. A shareholder who raises this in the last week of December for a calendar year company has missed the year, not a formality.

Ten years for a person, twenty for a firm, ten for the partner inside it

Article Six is the rotation rule, and it opens with a qualification worth reading twice: the appointment is subject to the terms in relevant laws and regulations and to the Code of Conduct and Ethics for the accounting profession as approved in the Kingdom. The numbers are a ceiling, not a safe harbour.

Who	Maximum	What it takes to go further
An individual auditor	10 consecutive fiscal years	Nothing. The cap is the cap.
An auditing firm	10 consecutive fiscal years	A recommendation from the audit committee, if there is one, or the existence of other offers to audit the accounts.
An auditing firm, in total	20 consecutive fiscal years	Nothing.
The partner supervising the audit	10 consecutive fiscal years	Nothing. The firm may stay while the partner changes under it.

Two things follow that candidates miss. The firm's second decade is conditional rather than automatic, and the condition is either a positive recommendation or a competitive process. And the words "if there is one" matter: the Companies Law creates no audit committee anywhere in its text, so most companies have none, and a listed company has one because the Capital Market Authority's Corporate Governance Regulations require it.

The Law polices this personally, not only through the company. Under Article 262 a person who accepts or continues an audit knowing of a reason in the Law that prevents him faces a fine of up to SAR 500,000, as does an auditor who fails to perform the duties the Law gives him. Article 261 reaches a year's imprisonment and a fine of up to SAR 1 million for an auditor who does not notify the company of violations he finds and suspects to be criminal.

The break that does not reset the clock

A firm near its limit sometimes assumes it can step out for a year and start again. Article Six(c) and (d) close that off with a single unit of time, two fiscal years. A person who suspended audit work for less than two fiscal years may be reappointed only for the remaining period of the maximum terms. A person who has exhausted them may be reappointed only after two fiscal years have lapsed from the date the term of office expired. One year out buys nothing: the counter pauses, it does not reset.

Note what the Saudi caps count, which is consecutive fiscal years. That word does real work, and the two regimes below count differently.

Listed companies run a shorter clock

A listed joint stock company sits inside the Companies Law and inside the Capital Market Authority's own implementing regulation for listed joint stock companies. Its Article 3, added by an Authority board resolution of January 2023 that gave companies two financial years to align, is stricter on every dimension. The ordinary general assembly appoints the external auditor and sets his fees, term and scope. The firm's total term may not exceed seven consecutive or non-consecutive financial years, recalculated only after at least three consecutive financial years have lapsed since the last year it audited the company. The supervising partner is capped at seven consecutive or non-consecutive financial years, recalculated after at least five. The Authority may amend either term for a company or a sector at its discretion.

The phrase to underline is "consecutive or non-consecutive". Under the Companies Law a break interrupts the count; here it does not, and only the cooling off period restarts anything. Two further requirements sit alongside it: the Corporate Governance Regulations have the ordinary general assembly appoint on a board recommendation that itself rests on an audit committee recommendation, with no fewer than two nominees, and the Authority's registration rules require both the firm and the individual certified public accountant to be registered with it before they may be appointed at all.

The ethics code counts differently again

Article Six defers to the approved Code of Conduct and Ethics, and Article Nine sends the separate question of what other work an auditor may do for a client to that Code and to any instructions SOCPA issues. SOCPA has adopted the international Code of Ethics for professional accountants, including the International Independence Standards, so the text in force is the one any Gulf audit firm already works to.

For the audit of a public interest entity that Code caps a key audit partner at seven cumulative years, with cooling off of five consecutive years for the engagement partner, three for the individual responsible for the engagement quality review and two for other key audit partners. Cumulative is the operative word: years off the engagement do not stop the count unless they are long enough to be cooling off in their own right. A partner can therefore sit comfortably inside the Companies Law at year eight and be outside the Code. Where several rules apply at once none overrides the others, and the binding number is simply the smallest.

How the United States does it

The American rules rotate people and never firms. Under the Securities and Exchange Commission's independence rule in Regulation S-X, the lead partner and the engagement quality reviewer on an issuer audit may serve five consecutive years and then take five years off, and other audit partners may serve seven consecutive years and then take two. A firm with fewer than five issuer audit clients and fewer than ten partners is exempt, provided the Public Company Accounting Oversight Board reviews each affected engagement at least once every three years. There is no mandatory audit firm rotation for US issuers. The deeper difference is what the obligation attaches to: in the United States it attaches to being an issuer, so a private company of any size may never appoint an auditor, while in Saudi Arabia it attaches to being a company above three modest thresholds.

Regime	What rotates	Time on	Time out
Companies Law Regulations, Article Six	Individual auditor, firm, supervising partner	10 consecutive fiscal years, 20 for a firm in total	2 fiscal years
Capital Market Authority, listed companies	External auditor and supervising partner	7 consecutive or non-consecutive financial years	3 financial years for the firm, 5 for the partner
Endorsed ethics code, public interest entities	Key audit partners	7 cumulative years	5 years for the engagement partner, 3 for the quality reviewer, 2 for other key audit partners
SEC Regulation S-X, issuers	Audit partners only, never the firm	5 consecutive years for the lead partner and quality reviewer, 7 for other audit partners	5 years and 2 years respectively

Where the Fellowship examines this

Every rule above assumes an auditor licensed to practise in the Kingdom, and that licence is a Saudi one issued under the Law of the Profession of Accounting and Auditing. A US licence is not a substitute for it, which is the practical reason the Fellowship matters to anyone who intends to sign a report here; the cost and sequencing argument is in CPA or SOCPA: Which Should You Take in Saudi Arabia?, and what the American credential converts into elsewhere in the region is in The US CPA Across the Gulf.

The material itself is asked in two voices. In Regulations it is a thresholds and figures question, the most predictable type on the most memorisable paper: who must appoint, how many years, how long the break. In Audit it arrives from the auditor's side, inside the Saudi layer no international qualification covers: whether you may accept the engagement, whether you may keep it, and which clock binds first. The rest of each paper is mapped in the SOCPA Regulations study guide and the SOCPA Audit study guide. Learn the numbers as a table, attach each one to the instrument it came from, and when a scenario mixes them answer with the shortest applicable period and name the instrument that imposed it.

Where to practise this

Prepito's Regulations course covers the Companies Law and the rest of the Saudi commercial and professional instruments with practice questions and full explanations in Arabic and English, and the Audit course covers appointment and independence from the auditor's side alongside the standards. For the qualification as a whole, see the SOCPA Fellowship programme. If the American comparison is what you are studying, the framework behind it is in Independence Under the AICPA Code.

---

This is study material, not legal advice, and not a substitute for the instruments it describes. Sources: Companies Law, Royal Decree M/132, Articles 18 to 20 and 260 to 262, the Implementing Regulations of the Companies Law on the Ministry of Commerce site, Articles Five to Nine, the Capital Market Authority's Implementing Regulation of the Companies Law for Listed Joint Stock Companies, Article 3, the Corporate Governance Regulations, Article 78, the Rules for Registering Auditors of Entities Subject to the Authority's Supervision, the IFAC profile of Saudi Arabia on SOCPA's adoption of the international ethics code, the IESBA long association questions and answers for the cooling off periods, and SEC Regulation S-X, Rule 2-01 for the American partner rotation. The Arabic texts govern the Saudi instruments, the Authority may amend the listed company terms by resolution, and thresholds and article numbers change with each amendment; confirm the current text before relying on a figure.