Saudi Arabia’s General Court of Audit (GCA) rolled out Shamel 2.0, a smart e‑audit system with AI-driven analytics, real-time data feeds, secure messaging, and mobile integration, now covering 900+ government entities (Agaam). As KSA shifts to accrual accounting under Vision 2030, Shamel 2.0 is governance in action that drives transparency, accountability, and performance in public finance.
Shamel 2.0 aligns digital tools with Vision 2030’s global push, which means new auditing methods, accrual-based financials, and data-led oversight.
It integrates financial statements, follow-up on recommendations, and public confidence, all from one platform.
Launched at LEAP 2025 and shared at SPIEF, under Dr. Hussam Alangari’s leadership, Shamel is a national gesture toward innovation (INTOSAI Journal) (Saudi Press Agency.
In KSA, Zooming Out shifts audits toward Vision 2030 objectives like NEOM and the Red Sea Project, rather than just reviewing line items.
Suggested Applications of Audit Thinking within Shamel’s Framework:
Run virtual mapping workshops to align audit scope across ministries and mega-projects.
Use visual summaries or dashboards to link findings directly to Vision 2030 priorities, ESG benchmarks, or strategic initiatives like NEOM or the Red Sea Project.
As Shamel evolves, it could embed strategic mapping views that tie audits to national KPIs, transforming e-audit from a reactive tool into a proactive governance lens.
What is the Red Sea Project?
A 28,000 km² regenerative luxury tourism destination on Saudi’s west coast, launching 50 resorts across islands, desert, and mountain sites by 2030. It aims for carbon neutrality and sustainable governance. (Saudi Vision 2030).What is NEOM?
A $500 billion, 26,500 km² futuristic arcology anchored by “The Line,” Oxagon, Trojena, and other zones, all powered by renewables to drive a knowledge-based economy beyond oil. (NEOM)
Shamel evaluates control performance by simulating real-world pressure, revealing how systems respond to risks and overrides. This pillar of Audit Thinking asks: What happens when the system gets pressured? Can users override, delay, or bypass safeguards, and does the platform flag it?
How Shamel Delivers:
Real-time data feeds highlight unusual financial behavior or timing spikes.
Secure communication channels document auditor-auditee interactions and recommendations (INTOSAI Journal).
AI-enhanced logs and mobile alerts trace patterns like skipped approvals, repeated access attempts, or off-hours entries.
These features highlight how controls operate under real conditions. They pinpoint strengths, expose weaknesses, and identify areas that require attention.
Field-Test Example
Use Shamel’s internal workflow module to map the full lifecycle of an audit finding:
Who assigned it?
Who’s responsible?
Was it acted on? If delayed, why?
Was the risk downplayed, reassigned, or silently closed?
Then, apply a Control-Test Log (classic Audit Thinking move):
Choose 5–10 flagged items at random.
Inspect metadata: Who logged it? When? From which IP? Was there an override or second-level reviewer?
Red flag if manual edits occur near shift-change or submission deadlines (common fraud patterns).
Ask: If this control failed tomorrow, would the system tell us or would someone have to find it by accident?
Audit Thinking means proving what happened, when it happened, and why it matters. In digital systems, that requires following the story across forms, systems, time stamps, and sign-offs. It’s about linking actions to actors, not just filing paperwork.
Shamel 2.0 does this by embedding the audit trail directly into each step of the workflow, from initiation to closure, so the chain of events becomes both visible and verifiable.
What That Looks Like in Practice
Impact Survey (INTOSAI Journal):
74% say communication has significantly improved
94% report better follow-up on findings
76% see increased accountability
65 of 81 auditees said transparency rose. Only 6 said “no impact”
These are signs that the audit trail is finally being respected.
Storytelling in the System:
Mobile app time stamps verify where and when inspections happen.
Task tracking reveals not just who logged an issue, but who followed through, and who didn’t.
Approvals are time-bound, name-tagged, and sequenced, creating a full timeline of intent.
The platform doesn’t just show that something was done. It shows how it moved, who touched it, and what changed.
When reviewing a resolved finding in Shamel, ask:
Does the timeline make sense?
Does the person listed match their job title?
Is there any unexplained gap between risk identification and action?
If yes, trace backward. You might catch a quiet bypass, a delayed handoff, or an internal stall tactic.
Why It Matters
In traditional audits, paper trails fade or get sanitized.
Shamel captures every change in the metadata, preserving who did what, when, and how. Instead of relying on memory or narrative, audits are built on traceable facts. That’s how accountability holds.
Audit systems can be smart. But auditors still bring assumptions.
This pillar reminds us: tech doesn’t erase bias, but it often amplifies it quietly. Shamel is powerful, but like any system, it’s only as fair as the people interpreting the data.
Why It Matters
AI-generated flags, workflows, and dashboards may look neutral, but their interpretation is always filtered through a human lens. And sometimes that lens carries shortcuts:
“This entity is remote, must be underperforming.”
“The numbers look clean, must be fine.”
“That dashboard looks complex. Must be thorough.”
These thoughts feel efficient, but they skip the audit thinking process.
Common Pitfalls to Watch For
Garbage in, garbage out: If data sources are flawed, even perfect dashboards will mislead.
AI illusion bias: Trusting flags without human review risks false alarms or missing subtler issues.
Adoption mismatch: With 900+ entities using Shamel, training inconsistencies or misuse are a given.
Cultural assumptions: Assuming rural offices are less capable, or that centralized entities are more compliant, can skew attention and urgency.
Local Advisor Notes
Before you conclude something’s wrong (or right), check in with a local peer, not connected to the audit subject.
Ask:
“Is this process typical here?”
“What’s the unofficial way this is usually done?”
“Is this actually unusual, or just unfamiliar to me?”
Peer Review
Before finalizing findings, share a 1-page summary with a colleague from another region or audit team.
Ask:
“What part of this feels like a leap?”
“Am I assuming intent where I only see delay?”
“Would you write this the same way?”
“If This Were Me” Lens
Imagine your finding is about your own department. Would the language feel fair?
Try rephrasing:
“This process appears inconsistent” instead of
“Staff fail to comply.”
Quiet Reframing
Pause before escalation.
Ask:
“Is the issue here fraud, or confusion?”
“Am I being firm or just frustrated?”
Before you write your final finding, take 90 seconds to jot answers to these:
What assumption am I making right now?
Am I seeing a systemic issue or projecting a pattern?
What would a peer from another region or background see that I might not?
Why This Pillar Is Essential for Digital Auditing
In systems like Shamel, bias hides behind dashboards and data language. If you don’t slow down and ask how you’re interpreting the system, you risk issuing a clean report that reinforces inequality, misses root causes, or unfairly blames the user.
Check yourself, then check the system.
This is the final and often most forgotten pillar of Audit Thinking.
An audit that stops at findings doesn’t close the loop. It leaves insight on the table, and accountability hanging.
Translate the Impact means telling the truth clearly, constructively, and in a way that decision-makers can understand and act on. It shifts the goal from reporting for the record to relaying responsibility for change.
What Shamel Does Well
Shamel turns findings into action. With clear workflows and real-time tracking, it helps auditors move risks from detection to resolution.
Core Wins:
Closed loop assurance: Every finding can be assigned, tracked, acted on, and verified, all in one system.
Real-time risk prioritization: Shamel helps auditors respond to what matters most, based on signal strength, timing, and exposure.
Compliance transparency: As adoption expands, visibility will shift from internal logs to executive dashboards and eventually to public-facing reporting.
Vision 2030 alignment: This platform goes beyond compliance and drives transformation by connecting audit findings to ESG metrics, accrual benchmarks, and public trust.
Tools to Translate Effectively
C‑C‑C‑E‑R - Break each finding into a 5-part message:
Context: Where the issue happened
Control: What was supposed to prevent it
Concern: What went wrong
Effect: Why it matters
Recommendation: What should be done
Example:
Context: Public procurement at the Ministry of Finance
Control: Automated dual authorization
Concern: Manual override by regional manager
Effect: Fraud exposure and budget inconsistency
Recommendation: Enforce system-level alerts; require second sign-off review
Always connect your recommendation to who is responsible and when it should be reviewed. Don’t say “Improve oversight.” Say “Department X to implement Y by Q3.”
Oral Debrief Templates
Use these when presenting findings live (e.g., during exit meetings, entity debriefs, or Ministry-level reviews):
“Here’s what we found…”
“This matters because…”
“This can be resolved by…”
“Here’s what we recommend and how it links to Vision 2030 goals.”
Impact Severity Grid
Add this quick tool into Shamel or your manual reporting. Example:
Ask yourself:
Would the person reading this know why it matters?
Have I been clear enough that action is possible, not just ideal?
If this finding is ignored, what’s at risk, and can I prove that?
Why It Matters
Audit findings that don’t land go nowhere.
If the people reading them don’t understand the consequence, own the fix, or see themselves in the solution, the risk just loops back.
Shamel helps close the loop. But the auditor still has to speak clearly.
Shamel 2.0 is more than a tool. It’s audit infrastructure. It transforms auditing from report-writing into real-time system repair and gives Supreme Audit Institutions (SAIs) a model for scaling that shift across sectors.
INTOSAI Journal: GCA’s digital transformation stats (INTOSAI Journal)
Argaam: GCA’s strategic launch of Shamel 2.0 (Agaam)
SPA: Shamel 2.0 debuted at LEAP‑2025 (Saudi Press Agency)
Zoom Out
When was the last time you paused to see the bigger picture before diving into data?
What national or organizational priorities could reshape your audit’s scope if you truly zoomed out?
Trace the Controls
If you tried to bypass a key control in your system, how easily could you?
Are there any metadata signals (timestamps, IPs, remote approvals) you’re overlooking that could show weaknesses?
Track the Trail
How well does your current audit trail tell the story from finding to resolution?
Could evidence be manipulated or overlooked because it's not digitally traceable?
Check Yourself
Are you bringing assumptions into this audit, maybe about tech, culture, or authority?
Before concluding, do you actively pause and question your own bias?
Translate the Impact
Does each finding answer: Why does it matter, and what should change? (C‑C‑C‑E‑R format)
Audit Thinking is a conversation, not a checklist. Subscribe to stay connected as this framework evolves across countries, platforms, and public sectors. And if something in this article sparked a thought, question, or challenge, drop it in the comments below. Let’s sharpen this work together.
Free Download: E‑Audit Evaluation Checklist
An Audit Thinking Guide to Evaluating Digital Audit Platforms
By Sam Quade | From the upcoming book Auditing Without Power
This one-page tool is designed to help audit professionals, SAIs, and policymakers assess the real-world strength of any e-audit system through the lens of Audit Thinking’s Five Pillars. Whether you’re working with Shamel 2.0 or evaluating a new platform, this checklist brings clarity, strategy, and field-tested insight into your review process.
Access code hint: What is the first pillar of Audit Thinking? (lowercase, no spaces)
Want more field tools, audit templates, and practical scenarios?
Subscribe to Auditing Without Power for future downloads, articles, and updates.
No posts
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.