GOSI compliance:
eight questions every operator should be able to answer.

GOSI compliance is not the issue most Saudi mid-market businesses think it is. The contributions get paid. The registrations exist. WPS payroll runs through the right banks. What surfaces in audits, in Qiwa inspections, and in strategic-transaction diligence is not non-payment - it's the operational discipline around how the position is managed. Below are the eight questions every operator should be able to answer in two minutes. If your finance director cannot, that's the finding.

GOSI - the General Organisation for Social Insurance - operates two principal schemes. Saudi nationals are covered for retirement, occupational hazards, and unemployment insurance (SANED). Expatriates are covered for occupational hazards only. Both regimes interact with Qiwa for labour-contract registration, with the Wage Protection System for salary monitoring, and with HRSD's broader Saudization regime. The operational complexity is multi-platform.

Why this is now

Three things have raised the GOSI compliance bar in the last twelve months. First, the integration between GOSI, Qiwa, and Mudad has tightened - mismatches between the three platforms now surface automatically rather than waiting for a manual reconciliation. Second, ZATCA's review of payroll-related expense and zakat positions now cross-references GOSI contribution data, so undeclared remuneration patterns surface during tax review. Third, strategic acquirers running diligence on Saudi targets now ask for GOSI coverage walks as a standard work step, where two years ago they did not.

The cumulative effect is that GOSI is being audited from three different directions simultaneously. The position needs to hold up against all three.

The eight questions

1. What's the GOSI registration coverage across the entire group?

Every operating entity should be registered. So should dormant entities with payroll - even if it's just one director's salary. Branches need to be on the parent registration. Holding companies that pay management fees to operating entities and have no direct payroll still need clean documentation of why no GOSI registration exists. We routinely find one or two entities in mid-market groups that are technically un-registered. The fix is straightforward; the historical exposure is what matters.

2. Are contribution categories correctly assigned for every employee?

The contribution rates differ between Saudi nationals and expatriates, between occupational hazard tiers, and between standard employees and partner-status individuals. Every active employee should have a defensible classification. The areas where misclassification is most common are: dual-nationality individuals (treated as Saudi or expat depending on residency status documentation), partner-status owners drawing salary (specific contribution rules apply), and employees moving between occupational hazard tiers when their role changes. A current-state classification audit takes a day per hundred employees and is worth running annually.

3. Is your end-of-service benefit accrual methodology defensible under audit?

End-of-service benefits are a separate liability from GOSI contributions, but the two interact. Under IAS 19, EOSB obligations should be measured using the projected unit credit method with appropriate discount rate and salary-growth assumptions. We see mid-market entities accruing EOSB on a simplified basis - flat 0.5 month per year, no discount rate, no actuarial review - which is acceptable for very small populations but not for entities of any meaningful headcount. The audit adjustment can be material. The actuarial methodology question should be settled before the audit asks it.

4. How do you handle employees moving between group entities?

Group restructurings, internal transfers, and entity rationalisations create employee movement events. The GOSI registration transfers, the EOSB liability transfers, and the service-continuity calculation each have specific rules. Inconsistent handling across past transfer events creates an audit-trail problem that compounds over years. A defensible position needs documentation per transfer event, not an after-the-fact rationale.

5. Are voluntary contributions for owners and partners optimised?

Self-employed individuals, business owners, and partner-status individuals can voluntarily contribute to GOSI for their own retirement coverage. The contribution amount, the timing, and the classification all interact with personal tax position, zakat treatment of distributions, and ultimate retirement benefit calculation. This is a senior-level structuring conversation, not a HR-process question. We routinely find founder-led businesses where the owner has no GOSI position despite twenty years of operating activity, and the cost of fixing that retrospectively is meaningful.

6. Is your Qiwa integration aligned with your GOSI position?

Qiwa records labour contracts, working hours, and contract types. GOSI records contributions, registrations, and benefits. The two should match exactly. They often do not - employees registered with GOSI but not on Qiwa, employees on Qiwa with contract types that don't match their GOSI classification, working-hour records that don't reconcile to attendance. Each mismatch is a finding waiting to happen. A monthly reconciliation should be standard. It rarely is.

7. Can you produce an inspection-grade audit trail in 48 hours?

A GOSI or Qiwa inspection request typically gives 48-72 hours for response. The documentation required includes payroll registers, GOSI contribution reports, EOSB accrual schedules, employment contracts, working-hour records, and any prior dispute correspondence. Many mid-market entities can produce some of this on demand and not all of it. The gap is usually in the historical correspondence and dispute records - the things that lived in someone's email and never made it into a structured filing system. The fix is operational discipline, not technical complexity.

8. Do your expat employees have the right GOSI position based on their contract?

Expat coverage is occupational hazards only, but the contribution base, the reporting category, and the wage-protection treatment all depend on contract details. Senior expat hires on bespoke packages, expat partners with profit-share arrangements, and expat employees with allowances paid outside the main salary line are all categories where the GOSI position frequently does not match the contractual reality. The exposure surfaces at end of contract or during exit clearance, by which point fixing it is more expensive than designing it correctly upfront.

What good looks like

A defensible GOSI position has four operational markers. We check them in this order on every diagnostic.

• Coverage map. A documented list of every group entity, its GOSI registration status, and the rationale for any entity that is not registered.
• Classification register. A current-state list of every active employee with their GOSI classification, contribution category, and documented basis.
• Reconciliation discipline. Monthly Qiwa-GOSI-payroll reconciliation with documented variance investigation. Not annual. Not on request. Monthly.
• Inspection-readiness file. A current-state inspection bundle - payroll, contributions, contracts, hours, correspondence - capable of being released in 48 hours without forensic effort.

The diagnostic we run

A senior-led GOSI diagnostic takes a week. Day one is the coverage walk and group-level review. Days two and three are sample-based classification testing across the employee base. Day four is the Qiwa-GOSI reconciliation and the EOSB methodology review. Day five is the inspection-readiness simulation - we ask for the kind of file an inspector would and time how long it takes to produce.

The output is a one-page partner summary with the headline finding and a remediation backlog. The full diagnostic sits underneath. For an entity with under 200 employees, a clean diagnostic outcome is achievable inside the engagement. For larger or more complex groups, the diagnostic informs a separately-scoped remediation plan.

If your last GOSI review was driven by a regulator request rather than a planned diagnostic, that is the engagement to commission ahead of the next financial year. A senior partner will respond within one working day with a short read of where you are and where we'd start.