—Audit Management Software · Qatar
Internal audit in Qatar now operates against an enlarged regulatory perimeter. The QFMA's new Governance Code for Listed Companies (Board Decision No. 5 of 2025, gazetted 17 August 2025) brings mandatory ESG, climate and CSR disclosure and ISSB-aligned reporting on a twelve-month transition. QCB's Bank Instructions Part VII continue to require an independent audit function reporting to a board audit committee. ControlVista is the bilingual, on-premise audit management software built for that perimeter — from Doha.
The Qatar regulatory perimeter
—The Three Pillars
The corporate-governance code, the central-bank rulebook, and the public-sector audit body — the three regulators every internal audit function answers to.
Board Decision No. 5 of 2025, gazetted 17 August 2025. Mandatory for the Main Market and comply-or-explain for the Venture Market, with a one-year transition. Introduces mandatory ESG, climate and CSR disclosure, an enlarged board (7–11 members), and ISSB-aligned reporting.
Under QCB Law No. 13 of 2012, licensed banks must maintain an independent internal audit department reporting to a board audit committee of at least three directors. Management non-interference is explicit. Internal audit must follow IIA standards.
Established by Law No. 5 of 1973, currently operating under Law No. 11 of 2016. Reports directly to the Emir; audits public funds and the operations of state entities. Public-sector internal audit functions coordinate with SAB findings.
—What Changed in 2025–2026
The developments your audit committee will ask about — and the ones your software shortlist needs to absorb without re-platforming.
Replaces the prior code with mandatory ESG/climate/CSR disclosure, ISSB alignment, an enlarged board, an insider-trading list, and a twelve-month transition window for full compliance.
Released by The IIA on 5 February 2025; mandatory for IIA-conforming functions from 5 February 2026. Four governance, six risk-management and seven control-activity criteria must be assessed in every relevant engagement.
Qatar's National Data Privacy Office issued executive guidelines on breach notification (72 hours), Personal Data Management Systems, and DPIAs; first public compliance orders in December 2024 and March 2025. Internal audit functions now own data-protection control testing alongside the traditional perimeter.
The 2017 IPPF was retired on 8 January 2025. Functions conforming to the 2024 Standards must produce explicit evidence of conformance against 5 Domains, 15 Principles and 52 Standards — a much higher documentation bar.
Qatar Stock Exchange disclosures are dual Arabic/English; XBRL filings (mandatory since 1 October 2020) are bilingual. Audit management software that doesn't render natively in Arabic forces double work on every committee pack.
—Why ControlVista in Qatar
ControlVista is built in Doha, by practitioners who report to the same audit committees you do. The platform speaks the QFMA Code's vocabulary, runs on infrastructure QCB-regulated banks already accept, and produces native Arabic committee packs without a translation pass. The IIA Qatar Chapter (Chapter 321, ~700 members) is our home professional body.
Runs inside the perimeter Qatar procurement teams already accept. Your data centre or private cloud, never our cloud. Source-code escrow available.
English and Arabic on every user-facing field. Qatar audit-committee packs render natively in both languages — not as a translation overlay.
Universe, strategy, plan, engagement, opinion, action — the lifecycle the new Standards require, with evidence of conformance produced as a by-product of work.
VistaAssist accelerates writing across every module, then hands judgement back to the auditor. Drafts attributed, editable, always inside the perimeter.
—Frequently Asked
Yes. The platform's universe, plan and reporting layers map directly to the Code's mandatory ESG, climate and CSR disclosure expectations and to the IIA 2024 Standards on which the Code's internal-audit references depend. Committee packs can be exported in QSE-compatible bilingual format.
Yes — and that's the default. ControlVista runs on-premise or inside your private cloud. The vendor (Vantage Technologies, Doha) never has access to engagement files or evidence. Source-code escrow is available for procurement sign-off.
Yes. Arabic is stored at the field level, not as a translation layer. Findings, engagement reports and the committee pack render in Arabic with RTL layout, alongside English versions of the same record. There is no translation step the day before a committee meeting.
The platform ships with a starter PDPPL control library aligned to the NCSA's executive guidelines on breach notification, Personal Data Management Systems and DPIAs. Findings cycle through the same preparer → reviewer → approver workflow as any other engagement.
For public-sector entities, ControlVista's engagement reports and findings can be exported in formats compatible with State Audit Bureau review cycles, and the platform's coverage view distinguishes between internal-audit and SAB-audited areas to support combined assurance.
—Across the Gulf
SCA · CBUAE · UAEAA · ADAA · UAE IAA
CMA · SAMA · GCA · SAIA
FSA · CBO · State Audit Institution · IIA Oman
CBB · MOIC · National Audit Office · IIA-Bahrain
CMA · CBK · State Audit Bureau · IIA Kuwait
—Request a demo
A 30-minute walkthrough with the team that built it — from the audit universe to the board-ready committee pack, in English and Arabic.
A product of Vantage Technologies.