Everything else is either agreed or moving. These are the ones that need you.
EY’s standard terms have three clauses about your data. Two are settled. The one left says EY decides for itself how it uses your data, rather than only doing what you instruct. Your side has asked EY to explain why it needs that, and to sign a separate agreement putting EY under your instructions instead.
Nothing else blocks signature.
This was your addition to the scope, and the deep read has found it in writing. The national address agreement, clause 3.1, gives SPL the right to commercially exploit the sovereign address database and keep every riyal, with the maintenance work as the stated payment. Work Saudi Post separately pays SPL to do.
That is why one product card shows Saudi Post receiving 0% while an outside firm takes 45%. Not an anomaly, the agreement working as drafted.
PwC designed a committee to make the final call on the price Saudi Post charges SPL, and on whether SPL buys from Saudi Post at all. Saudi Post has two seats. SPL holds the chair, the vice chair and the finance seat.
And it was never created. Management’s written answer this July reads “was not establised.” Which also explains why no price review happened after 2023. Both halves are findings.
Eight findings from reading the contracts against the 2022 price list, before any numbers were tested. Three are rated critical.
| Ref | What was found | Rating |
|---|---|---|
| F-01 | Two different prices exist for the same work. A flat fee of about SAR 47M a year in the 2022 contract, and per-product prices in the 2022 study. Nothing says which one applies, so SPL may be paid twice. | Critical |
| F-03 | The 2019 master agreement that everything else hangs off has never been handed over. Without it there is no way to know which contract outranks which. | Critical |
| F-06 | Every signed contract predates the 2022 price list and none was ever amended to adopt it. So the price list has no legal force.Corrected 31 Jul 2026: wrong. The price list was formally adopted on 15 September 2022 by a signed addendum that replaced the old rates with the PwC rates, and reaffirmed in September 2023. The addenda were sitting unopened in the email. | Corrected |
| F-02 | The marketing fee is fixed at 6% of Saudi Post revenue in the signed agreement, but shown as a 5-8% range in the study. | High |
| F-04 | Outside air freight actually costs between SAR 3.91 and SAR 36.75 a unit depending on destination. The price list adjusts by a flat SAR 4, so it probably under-recovers. | High |
| F-05 | NAQEL was asked to quote prices in the 2022 market survey and is also a paid carrier for Saudi Post. That is a conflict inside the benchmark itself. | High |
| F-08 | The annual price review happened in September 2022 and September 2023, then stopped. Nothing for 2024 or 2025.Narrowed 31 Jul 2026: reviews did take place. The sharper point is that the 2023 review looked at the prices and changed nothing, so rates have been frozen for three years on a survey from late 2021. | Medium |
| F-07 | National Address fees in the signed agreement match the price list exactly. Checked, no exception. | Validated |
Every contract and all seven PwC deliverables are now read. Four of the eight original findings have been corrected or withdrawn on the evidence.
The audited accounts settle it: NAQEL is 100% owned by SPL and SPL Digital Services 55%. So 721 million of Saudi Post contracts are not outside purchases at all. They are money moving into the subsidiary group, entirely outside the transfer pricing framework.
Clause three says the fee is payable provided Saudi Post "bears all amounts, fees, and operational costs" for the same services. If that is how it has been applied, it is not cost-plus at all. Needs testing against invoices.
Saudi Post pays SPL in 15 to 30 days and waits 60 to 90 to be paid. It must pay disputed marketing claims in full first and argue later. And SPL can demand half the annual address fees six months early.
It may terminate only by proving SPL is not performing, judged by an independent consultant, cost split evenly. In the other two agreements Saudi Post can walk at will, with no reason and no notice.
Until September 2022 every product card showed both what SPL charges the customer and what Saudi Post charges SPL. Since then only the transfer price appears. The margin is no longer visible in the contract.
NAQEL answered the 2022 market survey that set what arm’s length looks like, while already wholly owned by SPL. Every transfer price still in force rests on that benchmark.
Dated 20 June 2019, approved in the board's 58th session. Everything else hangs off it. It has still never been handed over.
158 files on disk. Setting aside signature graphics and the compressed bundles, that is 113 distinct documents, plus 31 files that are the same document arriving twice. Nothing was deleted, and every duplicate names its master copy in the index.
| Group | What it is | Files |
|---|---|---|
| The 2026 special audit | Your committee memo, the engagement plan, the work program, the data request, the first findings memo, two working files | 18 |
| EY’s evaluation | Both drafts of the policy review, the report shell, the functions questionnaire, the request list blank and answered, and the returned financial data | 13 |
| Engagement paperwork | Non-disclosure agreement through to signature, three rounds of engagement letter, EY’s standard terms with the clause fight in the margins | 12 |
| The 2022 PwC study | Project charter, survey approach, and deliverables D1 to D7, including the price list itself | 10 |
| Contracts | Signed agreements and annexes between the two entities, plus third-party carriage | 37 |
| Audited accounts | SPL 2022, 2023 and 2024. Saudi Post 2022 and 2024 | 6 |
| Your own analysis | Your independent review, and the earlier AI-drafted memos | 3 |
| Separate governance thread | Board decision and slides on merging internal audit oversight across the two entities. Related, but not this evaluation | 11 |
The single biggest gain: seven compressed bundles that had never been opened. They are the data room EY was given on 11 May, and they have now been unpacked and indexed.
The committee memo exists twice, and the difference is deliberate.
Only the Drive copy should be treated as the committee record.
The review queue was reported as holding 17 items. In fact one file was sitting there, and it is an exact copy of a working file already on the Drive.
The other flagged items were never downloaded. All fourteen were flagged for the same reason, and all fourteen were sent by you. The fetcher trusts EY and SPL addresses but not your own, so your forwards got held back. Ten were signature graphics. The rest we already hold.
Two flagged copies were never pulled and I cannot prove they match what we hold: a 23 April version of the memo, and a 1 May version of the scope of work. Low risk, since the fuller masters of both are already in the file. Closing it needs one more pull from the mailbox.
EY answers the technical question. Your own internal audit answers the commercial one. Neither replaces the other.
EY · the outside view
Whether the framework holds up against Saudi and international transfer pricing rules. Seven pieces: mapping the transactions, working out who really does what, testing the policy, a high-level profit check, the org structure, the contracts, and a risk assessment.
Draft first for your comment, then a final report. EY’s own estimate is 2 to 3 weeks of work once data flows. Fee USD 23,180.
Internal audit · the inside view
Whether the prices are actually fair and the money lands in the right period. Covers 2024 and 2025, across all 24 transferred products and the 5 flowing the other way.
Planned at 12 to 14 weeks. Mostly your own people, with outside specialists only where the skill is genuinely needed.
Done. Produced the eight findings, three of them critical.
Strip out the internal charges and see what each product really earns or loses for the group as a whole. Output is a heat map that decides where deeper work is worth doing. A product below 5% margin escalates immediately.
For the products the heat map flags, test whether the split between the two entities actually covers what each side spends. This is where a subsidy, if there is one, becomes visible and measurable.
Runs alongside B. Was there a committee, were prices reviewed, do the internal accounts reconcile, and is a four-year-old market survey still defensible.
Interim briefings to you at the end of A, then the full report. EY’s findings fold in alongside.
Either the size and direction of the cross-subsidy between the two entities, or a documented statement of exactly what data is missing to determine it.
Whether the flat annual fee and the per-product prices have been charged for the same work, tested against two years of actual invoices.
Prices given contractual force, a refreshed benchmark, and a governance body that exists in practice and not only on paper.
A position that stands up to the tax authority and to the external auditors, with the related-party disclosures corrected in the accounts.
| Date | What happened |
|---|---|
| Dec 2021 | The transfer pricing project is chartered at SPL |
| Jul–Sep 2022 | PwC delivers the study. The price list is dated 1 August and marked draft for approval. It is never approved |
| Mar 2025 | Internal audit reviews the contracts and finds no governance over them |
| 20 Apr 2026 | Your memo goes to the committee proposing this audit |
| 26 Apr 2026 | The eight contract findings are issued |
| 11 May 2026 | The data room goes to EY |
| 1 Jul 2026 | EY’s second draft adds the profitability section |
| 16 Jul 2026 | Management returns the request list. The pricing committee “was not established” |
| 23 Jul 2026 | The product-level financial data reaches EY |
| 29 Jul 2026 | Two of three contested clauses closed. One left |