Enterprise Risk Management in Saudi Arabia: Aligning COSO, ISO 31000, and National Regulatory Frameworks with Vision 2030
DOI:
https://doi.org/10.54536/ajebi.v5i3.8563Keywords:
CMA, Corporate, COSO ERM, Enterprise Risk Management, ISO 31000, SAMA, Saudi Arabia, Vision 2030Abstract
Enterprise Risk Management (ERM) has become a key tool of corporate governance and strategy management; however, there is a great diversity in the application of ERM among industries and jurisdictions. An interesting institutional context is represented by the Kingdom of Saudi Arabia (KSA), where the banking sector operates within the regulations of the Saudi Arabian Monetary Authority (SAMA) according to the Basel standards of prudential regulation; the stock market operates under the CMA corporate governance code; and the vision of state transformation named Vision 2030, which radically alters the structure of the state apparatus, financial sector and private businesses of the country. The paper provides an extensive examination of Enterprise Risk Management (ERM) frameworks such as the COSO Enterprise Risk Management Integrating with Strategy and Performance (2017) and ISO 31000:2018 standards. This shows how they fit into the risk management standards of SAMA and CMA. Drawing on a systematic qualitative content analysis of roughly 45 documents retrieved from Google Scholar, Scopus, Web of Science, ProQuest, and SSRN, the literature review integrates theoretical discussion and empirical research related to ERM value creation with special emphasis on ERM-related research on Saudi and GCC companies. According to the results of the analysis, Saudi companies function within a fragmented risk governance regime where the integration of prudential, market conduct, and strategic risk management needs is not achieved. As a result, the paper formulates an integrated Saudi ERM model combining the process-driven approach of ISO 31000 with the components of COSO and SAMA/CMA regulations and connecting risk appetite with Vision 2030 goals. The model serves as the major theoretical contribution of the paper; its practical contribution is a phased plan for the implementation of the proposed model by Saudi banks, listed corporations, and governmental institutions. The paper effectively distinguishes between findings of the analysis, conclusions reached by the authors, and recommendations, and ends with implications for policy and future research directions.
Downloads
References
Al-Dubai, S. A. A., & Abdelhalim, A. M. M. (2021). The relationship between risk disclosure and firm performance: Empirical evidence from Saudi Arabia. Journal of Accounting, Finance, Economics and Business, 8(2).
Algrady, S. M., Huang, R., & Al-Matari, E. M. (2025). How do audit committee characteristics affect the quality of financial information? Evidence from Saudi Arabia and United Arab Emirates companies. SAGE Open, 15(2). https://doi.org/10.1177/21582440251317803
Al-Hadi, A., & colleagues. (2019). Risk management in GCC banks. [Bibliographic details to be verified by the author against the original publication.]
Al-Hadi, A., Hasan, M. M., & Habib, A. (2016). Risk committee, firm life cycle, and market risk disclosures. Corporate Governance: An International Review, 24(2), 145–170.
Alhamami, M., & Alruwaili, W. S. (2025). Investigating the role of governance, risk, and compliance (GRC) in investment outcomes through digital transformation in Saudi context. European Journal of Sustainable Development, 14(2).
Al-Matari, E. M. (2022). Do corporate governance and top management team diversity have a financial impact among financial sector? A further analysis. Cogent Business & Management, 9(1), Article 2141093. https://doi.org/10.1080/23311975.2022.2141093
Al-Matari, E. M. (2025). Do corporate environmental sustainability affect corporate performance? The role of board diversity: Evidence from Saudi Arabia stock market. Contaduría y Administración, 70(3), Article e507.
Al-Matari, Y. A., & Fadzil, F. H. (2011). Corporate governance (board of directors and audit committee characteristics) and firm performance. Global Business and Management Research, 3(3), 63–75.
Almodawi, A. (2024). Impact of the audit committee’s characteristics on enterprise risk management, internal audit, external audit and firm performance in Saudi Arabia [Doctoral dissertation, RMIT University]. RMIT Research Repository.
Alqarni, A. A. M. (2021). The impact of corporate governance on major shareholdings: The case of Saudi Arabia [Doctoral dissertation, Newcastle University].
Alsaadi, M. A., Tijjani, B., & Falgi, K. I. (2021). Corporate governance and quality of financial reporting of listed firms: Evidence from Saudi Arabia. Corporate Governance: The International Journal of Business in Society.
Al-Tayan, R. (2022). Empirical analysis of enterprise risk management in Middle East countries [Doctoral dissertation, Loughborough University]. Loughborough University Repository.
Al-Yahyaee, K., & Al-Hadi, A. (2016). Ineffective corporate governance: Busyness of internal board monitoring committees. Corporate Ownership and Control, 14(1), 130–143.
Al-Zaimoor, N., & Desoky, A. (2024). The impact of audit committee features on firm performance—Empirical evidence from GCC countries. Polish Journal of Management Studies, 30(1).
Alzeban, A., & Gwilliam, D. (2014). Factors affecting the internal audit effectiveness: A survey of the Saudi public sector. International Journal of Auditing, 18(2), 142–157. https://doi.org/10.1111/ijau.12016
Al-Zeer, M., & Al-Saber, S. (2020). Enterprise risk management practices in Saudi Arabian banks. [Bibliographic details to be verified by the author against the original publication.]
Amico, A. (2014). Corporate governance enforcement in the Middle East and North Africa: Evidence and priorities (OECD Corporate Governance Working Papers No. 15). OECD Publishing. https://doi.org/10.1787/5jxws6scxg7c-en
Arena, M., Arnaboldi, M., & Azzone, G. (2010). The organizational dynamics of enterprise risk management. Accounting, Organizations and Society, 35(7), 659–675.
Basel Committee on Banking Supervision. (2015). Corporate governance principles for banks. Bank for International Settlements.
Beasley, M. S., Branson, B. C., & Hancock, B. V. (2015). Report on the current state of enterprise risk management: Enterprise risk management is not yet the standard of practice. AICPA & COSO.
Bhimani, A. (2009). Risk management, corporate governance and management accounting: Emerging interdependencies. Management Accounting Research, 20(1), 2–5.
Boshnak, H. A. (2021). Corporate governance mechanisms and firm performance in Saudi Arabia. International Journal of Financial Research, 12(3), 107–123.
Bromiley, P., McShane, M., Nair, A., & Rustambekov, E. (2015). Enterprise risk management: Review, critique, and research directions. Long Range Planning, 48(4), 265–276.
Capital Market Authority. (2017). Corporate governance regulations. https://cma.gov.sa/en/RulesRegulations/Regulations/Pages/details.aspx?code=2
Committee of Sponsoring Organizations of the Treadway Commission. (2004). Enterprise risk management—Integrated framework. AICPA.
Committee of Sponsoring Organizations of the Treadway Commission. (2017). Enterprise risk management—Integrating with strategy and performance. https://www.coso.org
Elo, S., & Kyngäs, H. (2008). The qualitative content analysis process. Journal of Advanced Nursing, 62(1), 107–115.
Florio, C., & Leoni, G. (2017). Enterprise risk management and firm performance: The Italian case. The British Accounting Review, 49(1), 56–74.
Gjerdrum, D., & Peter, M. (2010). The new international standard on the practice of risk management—A comparison of ISO 31000:2009 and the COSO ERM framework. Risk & Insurance Management Society.
Gordon, L. A., Loeb, M. P., & Tseng, C.-Y. (2009). Enterprise risk management and firm performance: A contingency perspective. Journal of Accounting and Public Policy, 28(4), 301–327.
Grewal, J., Habahbeh, L., Acharyya, M., & Aravind, R. (2022). COVID-19 and the effectiveness of ERM frameworks. British Actuarial Journal, 27, Article e8.
Hoyt, R. E., & Liebenberg, A. P. (2011). The value of enterprise risk management. Journal of Risk and Insurance, 78(4), 795–822.
International Organization for Standardization. (2018). Risk management—Guidelines (ISO 31000:2018). https://www.iso.org/standard/65694.html
Jabbour, M., & Abdel-Kader, M. (2016). ERM adoption in the insurance sector: Is it a regulatory imperative or business value driven? Qualitative Research in Accounting & Management, 13(4), 472–510.
Mikes, A., & Kaplan, R. S. (2015). When one size doesn’t fit all: Evolving directions in the research and practice of enterprise risk management. Journal of Applied Corporate Finance, 27(1), 37–40.
Mrabet, Z., Arouri, H., & Mnasri, A. (2024). The impact of board characteristics, gender diversity and ESG performance on firm systematic risk: Evidence from GCC countries. SSRN. https://ssrn.com/abstract=5040813
Nocco, B. W., & Stulz, R. M. (2006). Enterprise risk management: Theory and practice. Journal of Applied Corporate Finance, 18(4), 8–20.
Page, M. J., McKenzie, J. E., Bossuyt, P. M., Boutron, I., Hoffmann, T. C., Mulrow, C. D., Shamseer, L., Tetzlaff, J. M., Akl, E. A., Brennan, S. E., Chou, R., Glanville, J., Grimshaw, J. M., Hróbjartsson, A., Lalu, M. M., Li, T., Loder, E. W., Mayo-Wilson, E., McDonald, S., … Moher, D. (2021). The PRISMA 2020 statement: An updated guideline for reporting systematic reviews. BMJ, 372, Article n71. https://doi.org/10.1136/bmj.n71
Power, M. (2009). The risk management of nothing. Accounting, Organizations and Society, 34(6–7), 849–855.
Saudi Central Bank. (2023a). Financial stability report 2023. https://www.sama.gov.sa/en-US/Publications/FinanceReports/pages/financialstability.aspx
Saudi Central Bank. (2023b). Risk management guidelines for banks. SAMA Rulebook. https://rulebook.sama.gov.sa/en/risk-management
Saudi Central Bank. (2024). Annual report 2023. https://www.sama.gov.sa/en-US/Publications/EconomicReports/pages/annualreport.aspx
Shatnawi, S. A., & Eldaia, D. M. (2020). The factors influencing the enterprise risk management practices and firm performance in Jordan and Malaysia. SSRN. https://ssrn.com/abstract=3568299
Tawfik, O. I., Alsmady, A. A., Rahman, R. A., & Alsayegh, M. F. (2022). Corporate governance mechanisms, royal family ownership and corporate performance: Evidence in Gulf Cooperation Council (GCC) market. Heliyon, 8(12), Article e12624.
Vision 2030. (n.d.). Financial Sector Development Program. Retrieved March 15, 2026, from https://www.vision2030.gov.sa/en/explore/programs/financial-sector-development-program
Vision 2030. (2016). Saudi Vision 2030. https://www.vision2030.gov.sa
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Mohamed Abdelhalim Soliman
This work is licensed under a Creative Commons Attribution 4.0 International License.
