Saudi Arabia’s ZATCA Phase Two e invoicing requirements have significantly changed how businesses manage tax compliance, financial data, technology controls, and transaction reporting. For organizations operating across the Kingdom, internal audit has become increasingly important for reviewing whether invoicing systems, accounting processes, data controls, and tax procedures operate according to regulatory expectations. A consultant internal audit can help organizations assess control gaps, test transaction accuracy, and strengthen governance around ZATCA compliance. Phase Two began on 1 January 2023 and continues to be introduced progressively through different implementation waves.
For Saudi businesses, ZATCA compliance is no longer limited to issuing compliant invoices. Organizations need connected systems, reliable transaction records, protected financial information, and consistent control procedures. A Financial consultancy Firm can support management by connecting financial governance, tax compliance, risk management, and internal control reviews. This becomes particularly relevant as ZATCA continues expanding Phase Two implementation during 2026, with new taxpayer groups being notified according to defined revenue criteria.
Understanding ZATCA Phase Two Controls
ZATCA Phase Two, formally known as the Integration Phase, builds upon the requirements introduced during Phase One. While Phase One focused primarily on generating and storing compliant electronic invoices, Phase Two introduces integration with ZATCA’s Fatoora platform and additional technical and business requirements. Under Phase Two, taxpayers must ensure that their electronic invoicing solutions can communicate with ZATCA systems and generate invoices according to the required format. Additional invoice fields and technical requirements must also be addressed.
The major control areas include:
- Integration between the invoicing solution and the Fatoora platform
- Generation of electronic invoices using the required technical format
- Accurate inclusion of mandatory invoice information
- Appropriate handling of credit notes and debit notes
- Secure storage and preservation of electronic invoice records
- System access management
- Data integrity and transaction completeness
- Monitoring of invoice processing failures
- Controls over amendments and corrections
- Reconciliation between accounting records and electronic invoices
These controls create responsibilities for finance departments, information technology teams, tax functions, compliance officers, and internal audit departments.
The 2026 ZATCA Environment
ZATCA continues to implement Phase Two through a wave based approach. In July 2026, ZATCA announced the criteria for Wave 25. The wave includes taxpayers whose revenue subject to VAT exceeded SAR 187,500 during 2022, 2023, 2024, or 2025. Taxpayers included in this wave are required to integrate their electronic invoicing solutions with Fatoora by 1 February 2027.
This development demonstrates why internal audit teams should not treat ZATCA compliance as a one time technology project. Organizations can remain exposed to control weaknesses even after their systems have been technically integrated. ZATCA also conducted more than 60,000 inspection visits during the first quarter of 2026, covering commercial markets and businesses across different regions of Saudi Arabia. This regulatory activity demonstrates the importance of maintaining effective operational and compliance controls rather than relying solely on system implementation.
Importance of Internal Audit for ZATCA Compliance
Internal audit provides an independent assessment of whether controls are appropriately designed and operating effectively. In the context of ZATCA Phase Two, this means going beyond checking whether an organization has an electronic invoicing system. An internal audit review can examine the entire transaction lifecycle, beginning with the creation of a sales transaction and continuing through invoice generation, transmission, accounting recognition, VAT reporting, reconciliation, and record retention.
A consultant internal audit can provide an independent perspective when internal teams are responsible for designing or operating the same controls they are expected to evaluate. Effective internal audit coverage can identify invoices that fail transmission, incorrect VAT calculations, missing mandatory fields, inconsistent customer information, unauthorized invoice changes, duplicate transactions, incorrect credit notes, weak user access controls, incomplete transaction records, reconciliation differences, poor exception monitoring, and weak system change management.
The objective is not simply to identify errors. Internal audit should determine why an error occurred, whether the relevant control failed, and whether similar issues could affect other transactions.
Reviewing Invoice Generation Controls
Invoice generation is one of the most important areas for internal audit attention. Organizations should establish controls ensuring that invoices are generated from approved systems and contain the information required under applicable ZATCA requirements. Auditors should review whether the invoicing process is properly connected to underlying sales and accounting records. If employees can manually alter important invoice information without adequate authorization, the organization may face risks involving inaccurate VAT reporting, revenue recognition, or regulatory compliance.
Internal audit testing can include sample based reviews of invoices to determine whether:
- Invoice numbers are generated according to approved procedures
- Customer information is accurate
- VAT information is correctly calculated
- Invoice dates are properly recorded
- Required invoice fields are populated
- Credit and debit notes are appropriately supported
- Electronic records are retained
- Changes are appropriately authorized
The audit should also consider whether system generated controls operate consistently across different business units and locations.
Fatoora Integration and System Controls
Integration with Fatoora is a central element of Phase Two. Taxpayers must integrate their electronic invoicing solutions with the Fatoora platform and issue electronic invoices according to applicable requirements. This creates important technology control responsibilities for organizations.
Internal audit should evaluate the interface between enterprise resource planning systems, point of sale systems, billing applications, tax engines, and electronic invoicing solutions. A technically connected system may still have weaknesses if data does not transfer completely or accurately.
Important technology controls include:
- Interface monitoring
- Automated error reporting
- System availability monitoring
- Data validation
- User authentication
- Privileged access management
- Change approval
- Backup procedures
- Incident management
- Integration testing
- Exception resolution
Organizations should maintain documented evidence demonstrating that these controls operate effectively.
Data Accuracy and Completeness
ZATCA compliance depends heavily on reliable transaction data. Incorrect or incomplete data can affect invoices, VAT returns, financial statements, customer records, and management reporting. Internal audit should therefore examine data completeness from the source transaction through to the final electronic invoice.
For example, an organization may have accurate sales records in its ERP system but experience problems when data is transferred into the invoicing application. Alternatively, invoices may be successfully generated while accounting records remain incomplete. A strong control framework should reconcile different stages of the transaction lifecycle.
Useful reconciliation procedures include:
- Sales transactions compared with invoices
- Invoices compared with accounting entries
- VAT amounts compared with VAT returns
- Credit notes compared with approved supporting documentation
- Cancelled invoices compared with system logs
- Electronic invoices compared with customer records
These procedures can help identify differences before they develop into larger compliance issues.
Access Management and Segregation of Duties
Technology based tax controls require strong user access management. Employees should receive system permissions according to their responsibilities. Internal audit should assess whether users can perform incompatible activities. For example, an employee who creates customers, issues invoices, approves credit notes, and modifies tax settings may create a significant control risk.
Organizations should apply segregation of duties across important processes, including:
- User creation and approval
- Invoice preparation and approval
- Tax configuration and financial processing
- Credit note preparation and authorization
- System administration and business operations
- Master data maintenance and transaction processing
Periodic user access reviews are also important. Employees who change roles or leave the organization should have their access modified or removed promptly.
Change Management Controls
ZATCA related systems may require periodic updates because businesses need to respond to regulatory, technical, and operational requirements. Weak change management can create significant risks. An unauthorized configuration change could affect VAT calculations, invoice formatting, tax codes, or integration functionality.
Internal audit should assess whether system changes are:
- Properly requested
- Risk assessed
- Approved by authorized personnel
- Tested before implementation
- Documented
- Deployed through controlled procedures
- Reviewed after implementation
The audit should also examine emergency changes to determine whether they receive appropriate retrospective review.
Monitoring Failed Transactions
Not every electronic transaction will necessarily move through the system without an error. Businesses therefore need effective exception management. A failed invoice transmission should not simply remain in an error queue without investigation. Management should know what caused the failure, who is responsible for resolution, and whether the transaction was subsequently processed correctly.
An effective monitoring process should identify:
- Failed invoice submissions
- Rejected transactions
- Duplicate submissions
- Transmission delays
- Invalid customer information
- Incorrect tax treatment
- Missing mandatory information
- System interface failures
A consultant internal audit can test whether management receives appropriate reports and whether identified exceptions are resolved within defined timeframes.
VAT Reconciliation and Financial Reporting
ZATCA controls should also be connected to broader financial reporting processes. VAT amounts recorded in invoices should reconcile with accounting records and VAT reporting. Discrepancies can arise because of timing differences, incorrect tax codes, manual journal entries, credit notes, refunds, or system integration problems.
Internal audit should evaluate whether management performs regular reconciliations and investigates significant differences. The review should consider:
- Output VAT
- Input VAT
- Sales records
- Purchase records
- Credit notes
- Debit notes
- Refund transactions
- VAT return balances
- General ledger balances
ZATCA also continues to emphasize timely tax compliance. During 2026, its withholding tax guidance states that late payment penalties can be calculated at 1% of unpaid tax for every 30 days of delay. Although withholding tax is separate from electronic invoicing, the broader message is important. Strong tax governance requires accurate records, clear accountability, and timely compliance.
Governance and Audit Committee Oversight
Boards and audit committees should treat ZATCA compliance as part of the broader enterprise risk framework. Management should be able to demonstrate that significant compliance risks are identified, monitored, and addressed. Audit committees can request periodic reporting on electronic invoicing controls, outstanding exceptions, system changes, regulatory developments, and internal audit findings.
A Financial consultancy Firm can support governance structures by helping management assess financial control maturity, compliance processes, reporting quality, and risk exposure.
Audit committee reporting can include:
- Overall ZATCA compliance status
- Open internal audit findings
- Significant system exceptions
- Reconciliation differences
- Access control weaknesses
- Major technology changes
- Tax reporting issues
- Remediation progress
- Emerging regulatory risks
This approach allows senior leadership to view ZATCA compliance as an ongoing governance responsibility rather than simply an accounting activity.
Risk Based Internal Audit Approach
A risk based audit approach allows organizations to prioritize areas with the greatest potential impact. Not every control requires the same level of audit attention. High volume transaction environments, complex ERP structures, multiple business locations, and significant automated processing may require deeper testing.
Risk assessment can consider:
- Transaction volume
- VAT exposure
- System complexity
- Number of integrations
- Manual intervention
- Historical errors
- Access privileges
- Business growth
- Regulatory changes
- Third party technology dependencies
Organizations with extensive digital operations may also need to consider cybersecurity risks because unauthorized access to financial systems could affect invoice integrity.
Third Party and Technology Provider Risks
Many Saudi businesses depend on external technology providers for electronic invoicing solutions. While taxpayers may use compliant solutions from service providers, organizations remain responsible for ensuring that their systems meet applicable requirements. Internal audit should therefore consider third party risk management.
Relevant procedures include:
- Reviewing provider contracts
- Assessing service level agreements
- Reviewing security responsibilities
- Checking incident reporting procedures
- Evaluating data retention arrangements
- Reviewing business continuity controls
- Assessing access arrangements
- Monitoring service performance
Third party dependence should not result in unclear accountability. Management should understand which controls are performed internally and which are performed by external providers.
Building Continuous ZATCA Control Monitoring
Traditional annual audits may not be sufficient for highly automated tax environments. Organizations can strengthen their control framework by introducing continuous monitoring. Automated monitoring can identify unusual transactions, missing invoice fields, reconciliation differences, repeated failures, and unusual user activity.
Examples include:
- Daily invoice exception monitoring
- Automated VAT reconciliation
- Monthly access reviews
- Continuous transaction validation
- Automated duplicate detection
- Exception trend analysis
- Periodic system configuration reviews
This approach allows internal audit and management to detect issues earlier and reduce the possibility of repeated control failures.
Preparing for Ongoing Regulatory Changes
ZATCA’s Phase Two rollout remains progressive. Taxpayers are notified for their applicable waves, with subsequent waves communicated in advance of their integration date. This makes regulatory monitoring an important internal control.
Saudi organizations should maintain a structured process for monitoring new ZATCA requirements, technical updates, implementation waves, and changes to relevant guidance. A mature compliance function should assess each regulatory development for its impact on:
- Finance processes
- Tax calculations
- ERP configuration
- Electronic invoicing
- Data management
- Internal controls
- Reporting
- Staff responsibilities
- Third party providers
Strengthening Internal Audit Documentation
Audit evidence is essential when evaluating ZATCA controls. Internal auditors should maintain sufficient documentation to demonstrate what was tested, how it was tested, what evidence was reviewed, and what exceptions were identified.
Useful documentation can include:
- System configuration evidence
- Invoice samples
- Reconciliation reports
- Access review records
- Change management records
- Exception reports
- User activity logs
- Management responses
- Remediation evidence
- Third party control documentation
Well documented testing enables management and audit committees to track whether identified issues have been properly resolved.
Creating a Stronger ZATCA Control Framework
Saudi businesses can strengthen their Phase Two control environment by combining technology controls, financial controls, tax governance, and internal audit. A practical framework should include:
- Clear ownership of ZATCA compliance
- Documented policies and procedures
- Regular control testing
- Strong segregation of duties
- Automated reconciliation
- Effective exception management
- Secure system access
- Controlled system changes
- Periodic risk assessments
- Continuous regulatory monitoring
- Internal audit follow up
The objective should be to create controls that operate as part of normal business processes rather than separate compliance activities.
Measuring Internal Audit Effectiveness
Management can evaluate the effectiveness of ZATCA related internal audit activities using measurable indicators. Useful indicators include:
- Percentage of tested invoices without control exceptions
- Number of unresolved system errors
- Average time required to resolve invoice failures
- Percentage of users reviewed during access certification
- Number of unauthorized changes detected
- Reconciliation differences identified
- Percentage of audit findings remediated on time
- Number of repeated control failures
These measurements help organizations understand whether their control environment is improving over time.
Strategic Importance for Saudi Businesses
ZATCA Phase Two reflects Saudi Arabia’s wider digital transformation of tax administration and financial processes. Since its introduction in 2023, the Integration Phase has progressively expanded across taxpayer groups. ZATCA continues to update its technical materials and guidance during 2026.
For businesses operating in Riyadh, Jeddah, Dammam, and other Saudi markets, effective ZATCA controls can support more reliable financial information and stronger tax governance. Internal audit has an important role because it can connect operational activities with governance expectations. Rather than reviewing only whether invoices are generated, auditors can assess the complete control environment surrounding electronic invoicing.
A consultant internal audit can help organizations evaluate whether controls are appropriately designed, consistently implemented, adequately documented, and capable of identifying risks before they create significant financial or regulatory consequences. As Phase Two implementation continues through 2026 and beyond, organizations should view ZATCA compliance as an ongoing control responsibility. Strong integration, accurate financial data, effective access management, reliable reconciliation, continuous monitoring, and independent internal audit can collectively create a more resilient compliance environment for businesses operating across the Kingdom.