The Chief Audit Executive: A Seat the CEO Does Not Own

A chief audit executive is the only senior appointment at a Gulf platform where the governance structure the seat is meant to serve typically exists before the person does: audit committees are constituted from sitting non-executive directors the moment a listing or a regulatory licence requires one, while the resourced, independently reporting internal audit function underneath it is built later, and often more reluctantly. JOH Partners' reading of governance disclosure across Tadawul, DFM and ADX-listed platforms, cross-referenced against its own legal, risk and audit search mandates, finds that this sequencing is not an accident of timing; it is a structural feature of how Gulf boards actually build assurance, and it means the first chief audit executive a board appoints is rarely walking into a function that has already decided what independence looks like. They are walking into a committee that has decided it wants independence in principle and is about to discover, through this one appointment, whether it actually means it.

An audit committee that exists on paper before the chief audit executive exists in practice has made a promise it has not yet had to keep. The first appointment to the seat is where that promise is tested.

Why the seat is built backwards, and why that is not automatically a failure

Governance codes across the Gulf's principal exchanges require an audit committee composed largely or entirely of non-executive directors well before they say anything specific about internal audit resourcing, which means a board can be in full formal compliance with its listing rules while the function reporting to that committee remains thin, recently created, or still finding its reporting line. JOH's earlier reading of the control layer beneath the Gulf CEO documented this pattern across the full assurance and control set: legal, risk, audit and the company secretariat are, on paper, the most fully documented layer of Gulf corporate governance, precisely because committee composition is a mandatory disclosure rather than a voluntary one, and the least consistently tested on whether the formal structure carries practised independence behind it.

This is not, in itself, evidence of bad faith. A newly listed family platform genuinely cannot build a functioning, independently staffed internal audit capability on the same timeline it can appoint three non-executive directors to a committee; one is a governance appointment, the other is an operating capability that needs a mandate, a budget and a credible candidate willing to hold it. The problem is not the sequencing. The problem is boards that treat the sequencing as the finish line, mistaking a properly constituted committee for a properly resourced assurance function, and discovering the gap only when the committee asks a question the function cannot yet answer. The pattern is most visible at the diversified group holdings platforms where a single family group carries multiple licences and listing obligations across markets, because each entity's audit committee can be technically compliant on its own terms while no single chief audit executive holds a consolidated view across the group.

What the appointment actually tests

Because the committee already exists when the first chief audit executive arrives, the appointment does not create independence from nothing; it reveals how much independence the board was actually prepared to grant once a real person, with a real reporting line and a real budget request, is sitting in the room. JOH's search and advisory work across the chief audit executive interview process consistently surfaces the same pattern from the candidate side: strong candidates are not primarily assessing the mandate document, which almost always reads well, they are assessing whether the committee chair has ever actually used the access the charter describes, and whether the outgoing or interim holder of the function, where one exists, was permitted to raise something uncomfortable without it being quietly absorbed by the chief executive first.

Every audit committee charter promises the chief audit executive unmediated access to the board. The candidate's real question in the interview is whether that promise has ever been tested, or whether it is simply the sentence every charter is required to include.

The test runs in both directions, and this is the part boards underestimate. A capable chief audit executive, in the first eighteen months of a genuinely new function, is not just building the audit plan and staffing the team; they are actively probing the limits of the access the committee described at hire, because the charter's language and the chair's actual behaviour under pressure are frequently two different things, and the only way to find out which one governs is to raise something the chief executive would rather not have surfaced and watch what the committee does next. JOH's observation across its own governance mandates is that this first real test, not the appointment itself, is the moment that determines whether the function becomes genuinely independent or quietly settles into a reporting line that runs through the chief executive's goodwill regardless of what the org chart says.

The boundary against chief risk officer and chief legal officer

Three seats now sit inside what this series treats as the Gulf platform's assurance and control layer, and a board scoping any one of them should be explicit about where it ends and the next begins, because the confusion is common enough to distort both hiring and reporting-line design. The chief risk officer sits in the first line: identifying and managing risk alongside the executives running the business, typically with a reporting line that still runs, in practice if not always on paper, close to the chief executive. The chief legal officer advises the company on legal exposure and obligation, a function the board leans on for judgement rather than independent testing. The chief audit executive is different from both: independent assurance in the third line, whose entire governance value depends on being able to test the first and second lines, including the risk function's own effectiveness, without the chief executive mediating that access. A board that collapses the distinction, most often by routing the chief audit executive through the same reporting line as the chief risk officer, has quietly removed the one feature that made the seat worth creating in the first place.

JOH's earlier reading of the chairs leading Gulf-listed family businesses is a useful companion to this boundary question, because the chair's own appetite for an uncomfortable finding, more than any charter clause, is what ultimately decides whether a chief audit executive's independence is real or theoretical. A chair who treats a difficult internal audit finding as the function doing its job gets a chief audit executive willing to keep bringing difficult findings. A chair who treats it as disloyalty gets a function that learns, within one or two cycles, to soften what it surfaces, whatever the reporting line on paper says. JOH's engagement supporting group-level functional leadership at a Tadawul-listed Saudi industrial holding illustrates what building that reporting-line protection in from the outset looks like in practice, rather than negotiating it informally once the appointment is already in place.

What independence actually looks like under pressure

The quality a board is genuinely buying when it appoints a chief audit executive is not technical audit competence, which is a baseline expectation rather than a differentiator among senior candidates; it is the durability of that person's willingness to say the difficult thing after the relationship with the chief executive and the committee has had time to settle into familiarity. JOH's own assessment discipline across senior governance appointments draws on the same instrument JOH uses more broadly to test whether an executive's own account of their independence and judgement under pressure matches what colleagues have actually experienced working alongside them, rather than relying on how convincingly a candidate describes their own objectivity in an interview. That same structured approach to surfacing the gap between self-perception and lived experience is what separates an assurance appointment made on the strength of a confident interview from one made on evidence that the independence will still hold in year three, once the committee chair who hired the candidate has moved on and a new chief executive is testing where the boundaries actually sit.

Boards wanting continuous, standing visibility into how the control layer, including the internal audit function, is actually functioning between formal committee cycles increasingly use platforms such as Board Pulse to track those signals on an ongoing basis rather than discovering an independence gap only once a specific finding has forced the question into the open. Tony Couloubis's account of turnarounds, M&A and ethical investing across global private equity markets is a useful companion listen for boards thinking through what durable independence sounds like in practice: the discipline of holding a position that is unpopular with the people who can most affect your own position, sustained well past the point where it would be easier to soften it.

What a board should do before the search opens

A board scoping a genuine chief audit executive mandate, rather than a compliance formality, should resolve three questions before the search begins rather than during the candidate's first year. First, whether the reporting line is functionally to the audit committee, with only administrative matters running through the chief executive, and whether that line has ever actually been used for something uncomfortable rather than existing only as charter language. Second, whether remuneration and tenure decisions for the seat sit at genuine distance from the chief executive's influence, mirroring the independence protection most governance codes already require for the external auditor relationship. Third, whether the committee chair has personally decided, in advance, how they will respond the first time the chief audit executive brings a finding that implicates someone the chair trusts, because that decision made in the abstract, before it is tested by a real name and a real number, is far more reliable than the same decision made under pressure in the room.

Boards that resolve these questions before the appointment get a function capable of catching a control failure while it is still a management problem rather than a board crisis. Boards that leave them unresolved get a capable chief audit executive who spends the first eighteen months discovering, one cautious finding at a time, exactly how much of the charter the committee actually meant.

---

Key takeaways

---

JOH Partners is an executive search and senior executive recruitment firm advising boards, family groups and sovereign-adjacent platforms on chief audit executive, chief risk officer and wider control-layer appointments across the GCC, the UK and Singapore. Boards wanting continuous visibility of how the control layer is actually functioning can request a Board Pulse demo, or engage a partner for a confidential conversation about structuring or filling a chief audit executive mandate.