—Internal audit software · Qatar
Internal audit in Qatar answers to three bodies. QCB's Governance Instructions for Banks require every licensed bank to keep an independent internal audit function, reporting directly to a board audit committee. The QFMA's Governance Code for Listed Companies (Board Decision No. 5 of 2025) replaces the code every Main Market company reports against. And the State Audit Bureau audits the state entities whose internal audit units coordinate with its work. ControlVista is the bilingual, on-premise audit software built for that perimeter — internal audit management for the Chief Audit Executive, from Doha.
The Qatar regulatory perimeter
—The Three Pillars
The corporate-governance code, the central-bank rulebook, and the public-sector audit body — the three regulators every internal audit function answers to.
Circular No. 25 of 2022, issued under QCB Law No. 13 of 2012. Internal audit is independent of executive management in appointment, evaluation and pay, and reports directly to an audit committee of at least three directors — majority independent, with finance and audit expertise. The head of internal audit reports to the committee at least quarterly and must notify QCB directly of serious breaches.
Board Decision No. 5 of 2025, in force since 18 August 2025; Main Market companies comply in full, secondary-market companies comply or explain. Internal audit reports directly to the audit committee, which approves the annual audit plan and recommends the Internal Audit Director's appointment to the board.
Established by Law No. 5 of 1973; now governed by Law No. 11 of 2016, as amended by Law No. 7 of 2026. Reports directly to the Emir and audits ministries, public bodies and companies at least 51% state-owned. It can obtain internal audit reports, and a dedicated department evaluates internal audit units.
—What Changed in 2025–2026
The developments your audit committee will ask about — and the ones your software shortlist needs to absorb without re-platforming.
Replaces the 2016 code. The Internal Audit Director reports to the audit committee at least quarterly and must notify QFMA directly of serious violations; the code also sets a 7–11 member board and ESG disclosure referencing ISSB and OECD principles. The one-year transition ran to August 2026.
Released by The IIA on 5 February 2025; mandatory for IIA-conforming functions from 5 February 2026. Four governance, six risk-management and seven control-activity criteria must be assessed in every relevant engagement.
Qatar's National Data Privacy Office issued executive guidelines on breach notification (72 hours), Personal Data Management Systems, and DPIAs; first public compliance orders in December 2024 and March 2025. Internal audit functions now own data-protection control testing alongside the traditional perimeter.
The 2017 IPPF was retired on 8 January 2025. Functions conforming to the 2024 Standards must produce explicit evidence of conformance against 5 Domains, 15 Principles and 52 Standards — a much higher documentation bar.
Qatar Stock Exchange disclosures are dual Arabic/English; XBRL filings (mandatory since 1 October 2020) are bilingual. Audit management software that doesn't render natively in Arabic forces double work on every committee pack.
—Why ControlVista in Qatar
ControlVista is built in Doha, by practitioners who report to the same audit committees you do. The platform speaks the QFMA Code's vocabulary, runs on-premise inside the infrastructure a QCB-regulated bank already controls, and produces native Arabic committee packs without a translation pass. The IIA Qatar Chapter (Chapter 321, ~700 members) is our home professional body.
Runs inside the perimeter Qatar procurement teams already accept. Your data centre or private cloud, never our cloud. Source-code escrow available.
English and Arabic on every user-facing field. Qatar audit-committee packs render natively in both languages — not as a translation overlay.
Universe, strategy, plan, engagement, opinion, action — the lifecycle the new Standards require, with evidence of conformance produced as a by-product of work.
VistaAssist accelerates writing across every module, then hands judgement back to the auditor. Drafts attributed, editable, always inside the perimeter.
—Frequently Asked
It supports the internal audit side of the Code: a risk-based plan approved by the audit committee, evidenced engagements built around the IIA 2024 Standards, and committee reporting in Arabic and English from the same record. The Code's ESG, climate and CSR disclosures are management's responsibility; where the audit committee asks internal audit for assurance over them, they are planned and audited like any other area of the universe.
Yes — and that's the default. ControlVista runs on-premise or inside your private cloud. The vendor (Vantage Technologies, Doha) never has access to engagement files or evidence. Source-code escrow is available for procurement sign-off.
Yes. Arabic is stored at the field level, not as a translation layer. Findings, engagement reports and the committee pack render in Arabic with RTL layout, alongside English versions of the same record. There is no translation step the day before a committee meeting.
As engagements like any other. Data protection is added to the audit universe and risk-ranked; the work programme is built (or reused from the programme library) against the NCSA's executive guidelines on breach notification, Personal Data Management Systems and DPIAs; and findings move through the same preparer → reviewer → approver workflow.
Audit software. ControlVista is internal audit management software for the Chief Audit Executive — the function that is independent of management and reports to the board audit committee under QCB's Governance Instructions and the QFMA Governance Code. GRC platforms sell to the Chief Risk or Compliance Officer, who reports into management. ControlVista covers the audit universe, the risk-based plan, engagements, the opinion and the actions that follow; it does not try to be an enterprise risk register or a control-framework library.
For public-sector entities, engagement reports and findings export to PDF and Word for sharing with State Audit Bureau reviewers, and the annual plan is the place to document where the function relies on, or coordinates with, the Bureau's work — the coordination the IIA 2024 Standards expect under Standard 9.5.
—Go Deeper on Qatar
Circular 25/2022 on independence, the audit committee, quarterly reporting and direct escalation to QCB.
What QFMA's Decision No. 5 of 2025 changed for internal audit's reporting line, the annual plan, and escalation to QFMA.
Sizing, procurement route, QCB and NCSA hosting rules, the IIA 2024 lifecycle and Arabic — vendor-neutral.
What Law No. 11 of 2016 (amended 2026) lets the Bureau see and require, and how to coordinate under Standard 9.5.
—Across the Gulf
SCA · CBUAE · UAEAA · ADAA · UAE IAA
CMA · SAMA · GCA · SAIA
FSA · CBO · State Audit Institution · IIA Oman
CBB · MOIC · National Audit Office · IIA-Bahrain
CMA · CBK · State Audit Bureau · IIA Kuwait
—Request a demo
A 30-minute walkthrough with the team that built it — from the audit universe to the board-ready committee pack, in English and Arabic.
A product of Vantage Technologies.
