ControlVista

—Insurance

Internal audit software for insurers, as GCC insurance supervision tightens.

Every GCC insurance supervisor now expects an independent internal audit function that reports to the board or its audit committee — and several of those supervisors are new. ControlVista gives insurer audit functions one traceable record, from a risk-based plan across underwriting, claims and reserving to verified remediation.

Supervisors and audit bodies across the GCC

  • Insurance Authority (KSA)
  • CBUAE
  • QCB
  • CBB
  • FSA (Oman)
  • IRU (Kuwait)
  • IIA Standards 2024

—What's Different

Why audit in insurance is different.

A universe across the whole value chain

Underwriting, claims, reserving, reinsurance and distribution each carry their own risks. The audit plan has to show coverage across all of them — and why the riskiest came first.

Supervisors that have changed

Saudi Arabia, Oman and Kuwait all have new insurance supervisors or governance rules since 2023. Plans and committee reports need to stand up to the current supervisor's expectations, not the last one's.

Independence written into the rules

Insurance governance rules across the GCC require internal audit to be independent and to report to the board or audit committee — so the function needs its own system of record, not a corner of management's tooling.

—Across the GCC

Who sets the bar, country by country.

  • Saudi Arabia

    Insurance Authority

    The sole insurance regulator since March 2024, taking over from SAMA. The 2015 Audit Committee Regulation for insurers requires an independent internal audit department reporting to the audit committee.

  • UAE

    Central Bank of the UAE

    Supervises insurers since the 2020 merger of the Insurance Authority. Its Corporate Governance Regulation for Insurance Companies (2022) requires a permanent, independent internal audit function reporting to the board or audit committee.

  • Qatar

    Qatar Central Bank

    QCB's 2016 insurance governance instructions require an internal audit function reporting to the board or a board committee — the one control function insurers may not outsource. QFC insurers are supervised by the QFCRA.

  • Bahrain

    Central Bank of Bahrain

    Rulebook Volume 3 (Insurance), High-Level Controls module: licensees must establish an internal audit function, independent of senior management and reporting to the audit committee.

  • Oman

    Financial Services Authority

    Replaced the Capital Market Authority in 2024. Its corporate governance code for insurance companies requires the board to appoint an internal auditor and establish an internal audit function.

  • Kuwait

    Insurance Regulatory Unit

    Established under Law No. 125 of 2019. Its Corporate Governance Rules (in force January 2025) require an internal audit unit independent of executive management, reporting to the audit committee.

—How ControlVista Fits

One audit record, from risk to verified closure.

VistaPlan

Coverage across the value chain

A risk-ranked universe spanning underwriting, claims, reserving and reinsurance, with coverage rotation and board approval.

VistaField

Testing with sign-off built in

Walkthroughs, RACM-based testing and evidence in the file, with preparer → reviewer → approver sign-off as the work happens.

VistaResolve

Actions that close

Management responses, independent verification and 30 / 60 / 90-day escalation — so findings close and stay closed.

VistaReport

What the board committee needs

Plan progress, high-risk findings and action ageing from live data, in English and Arabic.

—Frequently Asked

Questions audit leaders ask.

Can ControlVista run on the insurer's own infrastructure?

Yes. ControlVista is on-premise by default — deployed in your data centre or private cloud. We have no access to your engagement files, and source-code escrow is available.

Is ControlVista a GRC or actuarial system?

No. It is audit management software for the internal audit function. It gives internal audit its own record of plan, engagements, findings and remediation; it does not replace risk, compliance or actuarial systems.

Can reports to the audit committee be in Arabic?

Yes. English and Arabic live on every user-facing field, so reports and committee packs render natively in both languages.

—Request a demo

See ControlVista run your audit lifecycle, end to end.

A 30-minute walkthrough with the team that built it — from the audit universe to the board-ready committee pack, in English and Arabic.

A product of Vantage Technologies.

We respond within one business day.