Chief Internal Audit Officer

About The Role Role Summary: The Chief Internal Audit Officer (CIAO) leads Soar’s independent internal audit function and provides the Board and Audit Committee with objective, risk-based assurance on the effectiveness of governance, risk management, and internal controls. The role evaluates whether key business processes, financial reporting, regulatory compliance, technology, and operational activities are appropriately controlled and aligned with the company’s objectives and applicable requirements. The role must maintain independence from the activities it audits and operate in accordance with the company’s approved Internal Audit Charter, applicable regulatory requirements, and recognized professional standards, including the Global Internal Audit Standards issued by The Institute of Internal Auditors (IIA), as applicable. Key Responsibilities: 1- Internal Audit Strategy & Governance Develop and maintain a risk-based internal audit strategy, annual audit plan, and multi-year audit universe aligned with Soar’s risk profile and business objectives. Establish and maintain the Internal Audit Charter, audit methodology, policies, procedures, and quality assurance processes for approval by the appropriate governance body. Provide independent, objective assurance and advisory services without assuming management responsibility for the design or operation of controls. Maintain direct and unrestricted access to the Board and Audit Committee, consistent with the approved governance structure. 2- Risk-Based Audit Planning & Execution Conduct risk assessments across business units, products, processes, legal entities, and outsourced activities to determine audit priorities. Lead and oversee audits of financial, operational, credit, treasury, customer operations, technology, cybersecurity, compliance, and third-party risk management activities. Assess the design and operating effectiveness of internal controls, including segregation of duties, authorization controls, reconciliations, and management oversight. Ensure audit engagements are properly scoped, documented, evidenced, reviewed, and completed within agreed timelines. Use data analytics and continuous auditing techniques where appropriate to improve audit coverage and identify control weaknesses. 3- Regulatory Compliance & Financial Controls Assess the adequacy of controls supporting compliance with applicable Saudi Central Bank (SAMA) requirements, relevant regulations, and internal policies. Review financial reporting processes, accounting controls, payment flows, reconciliations, expense management, and safeguarding of company assets. Evaluate controls over regulatory reporting, recordkeeping, governance approvals, and compliance with contractual obligations. Coordinate with external auditors and relevant assurance providers while preserving Internal Audit’s independence and avoiding unnecessary duplication. 4- Technology & Cybersecurity Audits Assess IT general controls, access management, change management, system development, cloud environments, data protection, backup and recovery, and technology operations. Review cybersecurity governance and controls, including vulnerability management, incident response, security monitoring, privileged access, and third-party security. Evaluate technology resilience, disaster recovery preparedness, and the effectiveness of controls over critical systems and customer data. Follow up on technology and cybersecurity findings while leaving control ownership and remediation implementation with management. 5- Findings, Reporting & Remediation Communicate audit findings clearly, objectively, and promptly, including root causes, risk implications, and practical recommendations. Agree action plans and target dates with responsible management while independently validating closure of significant findings. Escalate overdue, high-risk, or repeatedly occurring control deficiencies to the appropriate executive and governance bodies. Provide periodic reports to the Board and Audit Committee on audit results, significant risks, remediation progress, and emerging themes. 6- Fraud Risk & Investigations Evaluate the adequacy of controls designed to prevent and detect fraud, misconduct, conflicts of interest, and unauthorized transactions. Support or conduct independent reviews and investigations when authorized, maintaining confidentiality and appropriate evidence handling. Coordinate with Compliance, Risk, Legal, and management as appropriate, while maintaining independence and following approved investigation protocols. 7- Stakeholder & Committee Engagement Present the risk-based audit plan, material findings, resource needs, and performance updates to the Audit Committee or other designated governance body. Build constructive working relationships with the CEO, executive management, Risk, Compliance, Finance, IT, Cybersecurity, and external auditors without compromising independence. Provide independent insight on significant organizational changes, new products, outsourcing arrangements, and material initiatives. 8- Audit Quality & Team Leadership Recruit, lead, coach, and develop a capable internal audit team with the skills required for Soar’s business and regulatory environment. Establish quality assurance and improvement processes, including periodic internal assessments and external quality assessments when required by applicable standards. Manage audit resources, specialist support, and the audit budget efficiently. Promote professional skepticism, confidentiality, integrity, and continuous improvement within the function. Key Performance Indicators (KPIs) : Completion of the approved risk-based audit plan, with justified changes approved through governance. Timeliness and quality of audit reports and communication of significant findings. Percentage of high-risk findings remediated by agreed target dates, and validation of closure effectiveness. Coverage of key regulatory, financial, operational, technology, and third-party risks. Quality assessment results and conformance with applicable internal audit standards. Stakeholder feedback on audit clarity, professionalism, and usefulness, while preserving audit independence. Effective management of audit resources, budget, and team development. Requirements Qualifications & Experience : Bachelor’s degree in Accounting, Finance, Business, Information Systems, or a related discipline; a relevant postgraduate qualification is an advantage. Typically 8–12+ years of experience in internal audit, risk, controls, or assurance, including significant leadership experience. Experience in a regulated financial institution, fintech, lending, or financial services environment is strongly preferred. Strong understanding of risk-based auditing, internal controls, governance, financial processes, and applicable SAMA requirements. Ability to assess IT and cybersecurity controls; experience leading technology audits is an advantage. Excellent analytical, report-writing, communication, leadership, and stakeholder management skills. Demonstrated integrity, objectivity, professional skepticism, and the ability to handle confidential information. Preferred Certifications: Certified Internal Auditor (CIA) Certified Information Systems Auditor (CISA) Certified Public Accountant (CPA) or equivalent accounting qualification Certified Fraud Examiner (CFE), where relevant Relevant risk management or financial services certifications Reporting & Independence : Functional reporting: Board Audit Committee or other designated independent governance body, in accordance with Soar’s approved governance structure. Administrative reporting: CEO or another designated executive, where appropriate and consistent with applicable regulatory requirements. The Chief Internal Audit Officer must have unrestricted access to relevant records, systems, personnel, and governance bodies, subject to applicable law and confidentiality re