A Chief Audit Executive at a Qatari bank answers to two sets of rules about how the function is run: the professional standards the function claims to conform to, and Qatar Central Bank's governance instructions. The second set is short, written in Arabic, and more specific than most functions treat it.
This is what QCB's current instructions require of internal audit, what changed from the earlier framework, and what they do not say.
Which document actually governs
The governing text is Circular No. 25 of 2022, Governance Instructions in Banks (تعليمات الحوكمة في البنوك), issued on 30 August 2022 to all banks under QCB Law No. 13 of 2012. It replaced Circular No. 68 of 2015, the earlier corporate governance principles for banks. Circular No. 2 of 2023 amended it only on board size.
The instructions are issued in Arabic, and QCB has not published an official English version. Internal audit appears in three places: the principle on board committees (which sets up the audit committee), the principle on the internal control system, and the annex on Sharia governance for Islamic banks.
Older material still sits in QCB's 2013 Instructions to Banks — Part VII, Chapter Two covers internal auditing, outsourcing and senior appointments. Its governance content has been replaced twice since, so treat it as background and check any provision you rely on against the 2022 text.
Independence and the reporting line
The board must keep internal audit staff independent of executive management in their appointment, performance evaluation, pay, incentives and bonuses. Internal audit reports directly to the board audit committee.
The 2013 instructions said the same thing more bluntly: executive management must not interfere in internal audit's work. The 2022 text turns that principle into specific levers — who hires, who rates, who pays — that a supervisor can test.
The audit committee
| Requirement | QCB Circular 25/2022 |
|---|---|
| Size | At least three members (as for every board committee) |
| Composition | A majority independent and non-executive directors |
| Expertise | Finance, accounting and audit |
| Exclusivity | Members may not sit on any other committee |
| Board chair | Excluded from committees |
| Meetings | At least four a year |
| Separation | Audit and risk/compliance committee duties may not be merged |
One change from 2015 is worth noting: the earlier principles expected the committee to be wholly independent or non-executive; the 2022 text requires a majority.
The committee recommends to the board the selection, appointment and termination of the head of internal audit, handles the function's budget and assesses its staff. It reviews and approves the audit plan each year. And it follows up corrective action on findings from internal audit, the external auditor and QCB itself.
What the head of internal audit must do
The 2022 instructions put specific duties on the head of the function:
- Inform executive management of findings and follow up the corrective action.
- Report to the audit committee at least quarterly on the scope of work, findings, violations and the actions taken.
- Review the quarterly and annual financial statements and report to the audit committee before the board approves them.
- Evaluate segregation of duties, and review the bank's remuneration policy each year.
Scope, staffing and outsourcing
Internal audit must be able to audit all of the bank's functions and activities. QCB does not prescribe an audit cycle length; the committee's annual approval of the plan is the control.
The board must make sure audit staff have high professional qualifications and practical experience, keep pace with regulatory and international audit and accounting standards, and are trained continuously.
Under the 2013 instructions, internal audit is a core function that may not be outsourced except in extraordinary circumstances and for a short period, with QCB's no-objection — and outsourcing contracts must give internal audit and QCB access to the provider.
Islamic banks: the Sharia audit line
For Islamic banks, the 2022 annex adds a parallel structure. Each bank appoints internal Sharia auditors or a Sharia audit section linked to the Sharia Supervisory Board, and QCB's prior approval is required for its head. The Sharia auditor must be functionally independent, reports to the Sharia board at least quarterly with a copy to the audit committee, and coordinates with the audit committee, which evaluates the auditor's performance. Sharia board observations go directly to the audit committee.
What the instructions do not say
- They do not name the IIA. QCB refers to international standards for auditing; the IIA Standards are the benchmark most banks adopt, but that is the bank's choice, not a QCB text requirement.
- They do not require an external quality assessment. If the function claims conformance with the IIA Standards, that requirement comes from the Standards.
- They do not prescribe an audit cycle or a records-retention period for internal audit.
- They do not require the internal audit plan or routine reports to be filed with QCB. The direct line to QCB is for serious breaches.
Listed banks answer to both
A bank listed on the Qatar Stock Exchange also falls under QFMA's 2025 Governance Code for listed companies, and the two texts converge: internal audit independent of management in hiring and pay, a direct line to the audit committee, quarterly reporting, annual plan approval, and a direct escalation duty to the regulator. We cover the QFMA side in Qatar's 2025 Governance Code: what changes for the audit committee and internal audit.
What this means for how the function is run
Every one of these requirements leaves a trail a supervisor can ask for: the committee's annual plan approval, four quarterly reports with the content QCB specifies, the financial-statement review before board approval, the follow-up of QCB's own findings, and the assessment behind each decision to escalate — or not.
That trail is what ControlVista's audit management software for Qatar is built to keep: plan, engagement, finding, action and committee pack drawn from one record, on-premise inside the bank's perimeter, in Arabic and English.
Sources
- Qatar Central Bank, Circular No. 25 of 2022, Governance Instructions in Banks (Arabic): qcb.gov.qa
- Qatar Central Bank, Circular No. 2 of 2023 (amendment): qcb.gov.qa
- Qatar Central Bank, Banking Supervision instructions, 2024 Arabic edition — administrative risks and governance: qcb.gov.qa
- Qatar Central Bank, Instructions to Banks (2013), Part VII, Chapter Two: qcb.gov.qa
- Qatar Central Bank, Circular No. 68 of 2015 (superseded): qcb.gov.qa