The State of Internal Audit in the GCC Region!

The Saudi Institute of Internal Auditors and the UAE Internal Audit Association have recently issued a research report discussing the state of internal audit in the Gulf Cooperation Council (GCC) Region.

The report was based on a survey that included 918 internal auditors across the region (Saudi Arabia, UAE, Kuwait, Qatar, Bahrain and Oman).

The key findings of the report are as follows:

• Positioning of the Internal Audit Activity

The survey results show that the majority (77%) of the IA activities in the region functionally  report to the Audit Committee or board. When it comes to administrative reporting 64% of the activities surveyed report to the CEO or equivalent position.                 

• Role of the Internal Audit Activity

Only one third of the surveyed respondents indicated that the three lines of defense model is defined and understood in their organizations.

The assurance services are the dominant value adding services with consulting services on the rise. 

• Internal Audit Focus Areas

only 50% of the respondents indicated that their IA activities are aligned with the strategic plans of their organizations. Operational risks seem to be the focus of most of the activities in the region.

• Processes and Operations

Formal internal audit strategic plans are not present in many of the surveyed activities. Only small number of activities adopt a flexible audit plans although the majority update their audit plans at least annually.

only 57% of IA activities follow all of the IIA standards with the quality assurance standard being the least complied with.

•  Skills and Resources Management

Accounting skills remain the most sought after skills when recruiting internal auditors.

54% of internal auditors and 40% of CAEs  in the region do not posses any internal audit certification.

• Leading Practices and trends

Internal audit activities in the region seem to be behind when it comes to combined assurance, performance audit and auditing ethics and cultures.

• Managing Expectations & Demonstrating Performance

Most of the IA activities do not use formal KPIs. Traditional performance  measurement techniques such as number/percentage of audits completed are in use.

While the results of the survey did not include any significant surprises, it is obvious that despite of the advancement of the profession in the GCC region, there are still many opportunities for improvement .

The report provided an excellent source of information for management, audit committees ,CAEs and independent internal audit consultants ,like myself, to focus their efforts on the right direction!

I would certainly love to see similar reports for the rest of the Middle East countries!