The Audit Committee’s New Mandate: ESG and Technology Assurance for GCC Boards

What Does an Audit Committee Now Have to Assure?

Financial reporting, external audit and internal control remain the foundation. What has changed is the range of non-financial exposures that now require committee-level assurance: cybersecurity, sustainability reporting, technology and AI risk, third-party dependencies and whistleblower integrity. The IIA’s 2026 Risk in Focus: Middle East report found 69 percent of Chief Audit Executives in the region place cybersecurity among their top five priorities for audit time and effort, against a global average of 55 percent, with governance and corporate reporting at 64 percent and business resilience at 59 percent. MEIoD’s analysis of audit committee oversight and internal controls set out how Saudi and Bahraini regulation has been converting that expansion from recommendation into obligation.

The standards moved underneath the committee. The IIA’s 2024 Global Internal Audit Standards became mandatory on 9 January 2025, consolidating earlier guidance into 15 guiding principles and introducing Topical Requirements covering cybersecurity, IT governance, ESG and third-party management, with the Cybersecurity Topical Requirement effective 5 February 2026. Standard 7.1 requires the Chief Audit Executive to report to a board-level authority rather than to management. A committee equipped to oversee a function built to 2017 expectations is not automatically equipped to oversee one operating under the current framework, which is why the cybersecurity imperative is now a committee competency question rather than a technology one.

EY put the structural change plainly: boards are expected to align Internal Control over Financial Reporting with Internal Controls over Sustainability Reporting, so financial and non-financial information carry comparable control discipline. Cyberattacks across MENA have risen 40 percent year over year, and more than half of audit committees now treat cybersecurity as a priority.

How Should the Committee Approach Sustainability Assurance?

Carefully, because the regulatory picture across the GCC is uneven and frequently misdescribed. The 29 GCC Unified ESG Metrics, published by the GCC Exchanges Committee on 9 January 2023 and structured around the three ESG pillars with alignment to GRI, SASB, CDP, UNGC and the SDGs, provide a common regional language. They do not replace individual exchange or regulator requirements. Where a committee sits determines what it owes.

Two points follow for a committee. First, Qatar approaching external auditor assurance ahead of the region is the signal worth watching, because assurance is the step most Gulf frameworks have deferred and its cost and control implications exceed those of disclosure itself. The IAASB has issued ISSA 5000 as a general standard for sustainability assurance engagements, and the IESBA has finalised corresponding ethics and independence standards, so the infrastructure now exists.

Second, IFRS S2 requires disclosure of board oversight of climate risk, including whether relevant expertise sits on the board and whether a dedicated committee exists. For many GCC companies, that is a governance restructuring task rather than a reporting task. Where sustainability sits in a department with no board line of sight, the structure does not satisfy the disclosure requirement. KPMG’s 2026 guidance for audit committees recommends identifying material sustainability information, building a COSO-aligned internal control framework and running an assurance readiness assessment before committing to an engagement, since limited assurance is the current norm and reasonable assurance the expected direction. A corporate governance assessment that scores non-financial reporting controls gives a defensible starting point, and MEIoD’s work on the ESG accountability gap explains why delegation downward stopped being viable.

What Are the Committee’s Other Expanded Duties?

Cybersecurity and technology risk

The Cybersecurity Topical Requirement formalises cyber as a required internal audit focus area. For the committee that means confirming the audit plan covers it, that findings reach the committee independently of management, and that the committee has the expertise to act on them. Annual point-in-time cyber audits no longer satisfy boards; regional Chief Audit Executives are moving toward continuous control monitoring, which changes the cadence and the format of what the committee should expect. The same logic extends to AI oversight, where the GCC BDI found 63 percent of boards lack a defined strategy.

Whistleblower mechanism integrity

Bahrain’s Corporate Governance Code requires the audit committee to oversee the whistleblower programme through which employees raise concerns about financial or legal impropriety, and Saudi CMA regulations require the committee chair to update the full board on material cases. These are the channels through which a board learns what its compliance framework cannot see, and a mechanism that has never received a report is evidence of distrust rather than cleanliness. The corporate secretary manages the information flow between committee and board, and where that process is weak the board decides on filtered material.

Internal audit independence

Saudi Arabia’s January 2024 CMA amendments gave the audit committee explicit responsibility for recommending the appointment and dismissal of internal auditors, alongside oversight of internal audit resources, mandated training for board and executive members, and periodic meetings with auditors as a standalone accountability layer. In practice internal audit in many GCC companies still reports to the CFO or CEO, and that reporting line shapes what the function finds. A committee that has not tested its own reporting line against Standard 7.1 carries an exposure auditors and regulators are now equipped to identify.

Where Is the Competency Gap?

On the committee itself. The GCC BDI Board Effectiveness Review 2025 found only 32 percent of boards run a formal selection, induction, review, development and deselection process, with appointments still frequently shaped by family ties and personal relationships rather than a skills matrix. A committee without members carrying cyber literacy, sustainability assurance experience or data governance fluency cannot interrogate the risks its mandate now covers. Bahrain’s Code requires a committee of at least three members chaired by an independent director with a majority meeting defined financial literacy qualifications, and caps external auditor terms at five consecutive years, but financial literacy alone no longer covers the mandate. The Corporate Directors Program builds the competencies needed to test management assertions on non-financial risk as rigorously as the financial statements, and board independence in practice is the precondition for any of it working.

How MEIoD Supports Audit Committees

MEIoD works with audit and risk committees across the GCC to build the assurance architecture the expanded mandate assumes.

• Board Evaluations: an independent assessment of whether the committee receives the quality of information, and applies the level of scrutiny, its mandate now demands.
• CG Assessment: a structured review covering internal controls, non-financial reporting quality and committee independence against current standards.
• Corporate Directors Program: builds cybersecurity, sustainability and data governance competencies for committee members.
• The Audit & Risk Committee: Beyond Financial Oversight to Tech & ESG Assurance (14 October 2026, 11:00 AM UAE, virtual): a modernised committee mandate and toolkit for a technology-driven, tightly regulated environment.

An audit committee that can only assure the financials has outgrown its own terms of reference. The mandate widened. The competencies have to follow. Contact MEIoD, and we will build the assurance framework around it.

FAQ