Internal audit teams at SAMA-regulated institutions face a recurring challenge when planning their annual audit universe. Domain 9 of the Saudi Central Bank's IT Governance Framework requires independent review of cybersecurity controls, yet most internal audit functions lack the technical depth to design tests, interpret evidence or rate findings against the framework's requirements. Audit committees expect assurance that cybersecurity risks are managed, but generic control checklists rarely provide the confidence needed.
We perform cybersecurity audits on behalf of, or alongside, your internal audit function — planned, executed and reported to internal audit standards. This article explains how we deliver a SAMA ITGF cybersecurity internal audit in three weeks, from initial scoping through to a final report ready for the audit committee, complete with management responses and action plans.
Why Internal Audit Functions Engage External Cybersecurity Specialists
The SAMA IT Governance Framework sets out detailed requirements across nine domains, with Domain 9 addressing information security. Regulated institutions must demonstrate that controls are designed appropriately and operating effectively. Internal audit provides independent assurance to the board and audit committee, but cybersecurity audits demand skills that many internal audit teams do not maintain in-house: the ability to test technical controls such as network segmentation, privileged access management, encryption implementation and security monitoring, and to assess whether those controls meet the specific obligations in the framework.
Bringing in specialists does not replace the internal audit function. Instead, it extends capability for a defined period, ensuring that the audit committee receives credible, risk-based assurance without the cost of permanent headcount or the risk of superficial review.
Our Three-Week Method: Plan, Fieldwork, Report
We structure each engagement around the same three-phase method used by internal audit functions globally. The duration is typically three weeks for a focused SAMA ITGF cybersecurity audit, though more comprehensive reviews may extend to six weeks depending on scope and the number of entities or systems in scope.
Week One: Plan — Scope, Risks and Audit Program
The first week is dedicated to understanding the institution's environment, agreeing the scope and building a risk-based audit program.
What happens: We meet with the head of internal audit and relevant stakeholders — typically the chief information security officer, head of IT and representatives from risk and compliance — to confirm which ITGF controls fall within scope. Not every audit covers all of Domain 9; some focus on specific control families such as access management, vulnerability management or incident response, depending on the institution's risk assessment and the audit committee's priorities.
We review the institution's most recent risk register, prior audit reports, regulatory inspection findings and any self-assessment or gap analysis conducted against the ITGF. This background informs our risk-based audit planning, ensuring that testing effort is directed toward the controls that matter most.
We then prepare an audit plan and program that sets out the audit objectives, scope boundaries, control testing procedures, sampling approach and timeline. The program lists each control to be tested, the evidence we will request and the criteria for assessing both design and operating effectiveness.
Who takes part on the client side: Head of internal audit, CISO, head of IT, and often the chief risk officer or compliance lead.
What the client holds at the end of week one: An agreed audit plan and program, ready to share with the audit committee if required, and a clear list of evidence requests sent to control owners.
Week Two: Fieldwork — Testing and Evidence Collection
The second week is dedicated to evidence collection, control testing and preliminary findings.
What happens: We conduct design and operating effectiveness testing for each in-scope control. Design testing examines whether the control, as documented, is capable of addressing the risk it is meant to mitigate. Operating effectiveness testing verifies that the control has functioned consistently over the review period.
Our approach includes sampling and evidence review. For example, when testing user access reviews, we select a sample of privileged accounts and examine whether quarterly reviews were completed, whether exceptions were escalated and whether access was revoked when no longer required. When testing vulnerability management, we review scan results, patch deployment records and evidence that critical vulnerabilities were remediated within the timeframes specified by the ITGF.
We hold daily touchpoints with control owners to clarify evidence, discuss observations and confirm our understanding before drafting findings. This collaborative approach reduces the risk of misunderstanding and speeds the agreement process in the following week.
Who takes part on the client side: Control owners across IT and cybersecurity, and often representatives from business units if application-layer controls are in scope.
What the client holds at the end of week two: A complete set of working papers documenting all tests performed, evidence reviewed and preliminary observations. These working papers support the audit trail and provide the foundation for the draft report.
Week Three: Report — Findings Agreed with Management
The third week focuses on converting observations into rated findings, obtaining management responses and delivering the final audit report.
What happens: We prepare a draft audit report that presents each finding with a risk rating, root cause analysis, impact assessment and recommendation. Findings are rated using a consistent scale — typically critical, high, medium and low — aligned with the institution's existing internal audit methodology.
Each finding is shared with the relevant control owner and their manager to confirm factual accuracy and agree the management response. The management response includes the action plan, responsible owner and target completion date. This step is essential: audit committees expect to see not only what is deficient, but also what management intends to do about it.
Once all findings are agreed, we issue the final audit report for the audit committee. The report opens with an executive summary, scope statement and overall opinion, followed by detailed findings and an appendix listing all controls tested. The format matches the institution's standard internal audit reporting template, ensuring consistency across the audit universe.
Who takes part on the client side: Control owners, department heads, the CISO, head of internal audit and sometimes the chief financial officer or chief operating officer for sign-off on management responses.
What the client holds at the end of week three: A final audit report ready for the audit committee, complete with management responses and action plans, and a full set of working papers retained by internal audit for regulatory or external audit review.
Follow-Up: Verification of Corrective Actions
Audit committees rightly expect that findings do not simply sit in a report. After the initial audit, we return to verify that management has implemented the agreed corrective actions.
What happens: Typically three to six months after the original audit, we conduct a follow-up audit. We review evidence of remediation for each finding, test that new or improved controls are operating as intended, and confirm closure or update the status if actions remain incomplete.
The output is a follow-up report that provides the audit committee with assurance that risks have been addressed, or transparency where gaps remain.
What Makes This Approach Effective for Audit Committees
Audit committees value this method for several reasons.
First, it delivers independent assurance. We are not the team that designed or operates the controls; we assess them objectively against the ITGF requirements and report what we find.
Second, it integrates seamlessly with the institution's existing internal audit process. The audit plan, working papers and report format are familiar to the audit committee, and findings flow into the institution's issue-tracking and governance processes without friction.
Third, it is risk-based. We do not audit every control in Domain 9 every year. Instead, we focus testing on the areas of highest risk, informed by the institution's own risk assessment and the regulatory environment.
Fourth, it provides rated findings with management responses. The audit committee sees not only the deficiencies, but also the agreed path to resolution, with accountability and deadlines clearly assigned.
Full List of Deliverables
At the conclusion of a SAMA ITGF cybersecurity internal audit, the institution receives:
- Audit plan and program
- Working papers
- Audit report for the audit committee
- Follow-up report (delivered after the agreed remediation period)
Each deliverable is prepared to internal audit standards, ensuring that the institution's governance, risk and compliance framework remains coherent and that external auditors or regulators can rely on the work performed.
How We Support Your Internal Audit Function
If your institution is planning its annual internal audit coverage and you need independent, credible assurance over SAMA ITGF cybersecurity controls, we can help. We perform cybersecurity audits on behalf of, or alongside, your internal audit function — planned, executed and reported to internal audit standards.
To discuss how we can support your next audit cycle, reach out to our team.
