Saudi retail banks need internal auditors who can audit AI agents preparing personal finance files, triaging fraud alerts and drafting Arabic customer replies. The work centres on testing approvals, certificates and provenance from the decision record, and on rating findings consistently. Audit judgement stays with them. SAMA, SDAIA and the Personal Data Protection Law frame oversight.
What do internal auditors at a Saudi retail bank cover?
Personal finance is the core retail product, much of it structured as Sharia-compliant financing and repaid through salary. Auditors test affordability and responsible lending, the accuracy of profit rate disclosures, early settlement calculations, and whether the Sharia structure was followed in each contract, working with the bank's Sharia function. Mortgage finance has grown as home ownership has become a national priority.
Fraud and digital channels are the other big theme. Instant payments and digital onboarding have brought impersonation scams and account takeover, and SAMA expects banks to maintain strong counter-fraud controls. Auditors test detection, intervention, customer notification and complaint handling. The internal audit function reports to the board's audit committee and must remain independent of management.
What changes when agents arrive?
Agents tend to be deployed in high-volume retail work first. Each capability holds a depth earned on the bank's own cases.
- Personal finance file preparation (depth 2). The agent gathers salary certificates, credit bureau data and existing obligations and drafts the affordability assessment. A credit officer decides.
- Early settlement calculations (depth 1). It computes the settlement amount under the contract and shows its working.
- Fraud alert triage (depth 2). It assembles device and transaction context and drafts a recommendation. An analyst decides whether to block, release or call the customer.
- Arabic and English customer replies (depth 2). It drafts the reply. An officer reviews and sends.
Audit can use an agent of its own at depth 1 to test full populations from the append-only record, such as every early settlement in a quarter.
What must auditors learn, and what stays with them?
The basics come first: depth, the minimum chain of five bounds, the four verdicts and the record. Our guide on what internal auditors should learn before working with AI agents sets them out.
Then the tests specific to this market. For personal finance, auditors should test that a salary certificate from an employer is treated as signed evidence and that declared income alone did not support a decision. For early settlement, they should recompute a sample independently, since a systematic error affects many customers. For Arabic replies, auditors who read Arabic should check the Arabic version, because that is the one the customer reads and may complain about.
Rating consistency matters as much as testing. Audit teams in Saudi banks often combine local and expatriate staff with different backgrounds. Calibration sessions for internal auditors on anonymised agent findings make sure the team rates a lapsed certificate or an unapproved release the same way. Agent certificates lapse after 90 days, and a run that clears no depth drops the agent to depth 1 the same day, so certificate testing should be routine.
What stays with the auditor: the plan, opinion, ratings and the report to the audit committee. Our piece on whether AI agents will replace internal auditors explains why independence and judgement remain human.
Which Saudi rules shape oversight and literacy?
SAMA supervises banks and sets expectations on governance, internal audit, cyber security, counter-fraud and the fair treatment of customers, including responsible lending in personal finance. When agents prepare finance decisions or triage fraud, they sit inside controls SAMA already supervises, and auditors need the literacy to test them.
The Personal Data Protection Law, with SDAIA as competent authority, governs customer data. It requires purpose limitation and security, gives customers rights over their data, and restricts transfers outside the Kingdom, which matters for where agents process data. SDAIA has also published national AI ethics principles stressing accountability, transparency and human oversight.
AML obligations follow the FATF Recommendations. Cross-border references such as ISO/IEC 42001 and the Basel Committee's operational resilience principles help structure the audit programme.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
A 90-day training plan
Days 1 to 30. All auditors learn the vocabulary. The head of internal audit maps each agent with capabilities, depth, certificate dates and data location.
Days 31 to 60. Pilot an audit of personal finance file preparation. Test that officers decided, that income evidence was signed, that Arabic disclosures were accurate, and that certificates were current.
Days 61 to 90. Hold the first calibration session, audit early settlement calculations, write the standing programme and set up banking corrections for audit's agent.
Where the Academy fits
Pryme Intelligence Academy's Foundations track gives every auditor the vocabulary in about four hours, free, and can be listened to as audio. Auditors leading agent audits can take the Operator track, with module tests set in retail banking and the auditor's role. An admin view shows the head of audit who is certified and when each certificate expires.
Questions people ask
Should the Sharia function see agent audit findings?
Where a finding affects contract structure or profit calculation, yes. The record shows exactly what the agent drafted and who approved.
Can an agent approve personal finance?
Only at a depth earned on the bank's own cases and within its limits. Most banks keep approval with a credit officer, and audit should confirm which applies.
Does Arabic-language review need specialist auditors?
It needs auditors who read Arabic for samples of customer-facing text. Where the team lacks them, pair an Arabic-reading colleague with the auditor and document the arrangement. Our piece on why internal auditors are the real control and the guide to AI agent skills by role cover audit's place.