For an internal audit function in a Qatari ministry, public body or state-owned company, the State Audit Bureau (ديوان المحاسبة) is the external assurance provider that matters most. It can read your reports, it evaluates your unit, and its observations land on the same people your findings do.
This guide sets out what the Bureau's law actually says, what it means for internal audit, and how to coordinate with it in the way the 2024 IIA Global Internal Audit Standards expect.
The law
The Bureau was established by Law No. 5 of 1973 and today operates under Law No. 11 of 2016, in force since November 2016. Law No. 7 of 2026, in force from July 2026, amended it — adding criminal offences, judicial-officer powers for Bureau staff, and asset declarations for them.
The Bureau is an independent body that reports directly to the Emir, with its budget attached to the Emiri Diwan's. Its President sends an annual activity report to the Emir, and it reports each year on the state's final account.
Who it audits
Under Article 4, the Bureau audits:
- Ministries, government agencies, public bodies and public institutions, and any body that manages public money or is funded by the state.
- Companies and establishments wholly owned by the state or a public legal person, or at least 51% owned by them.
- Private companies that receive state support — profit guarantees, subsidies, utility licences or natural-resource concessions — for that support only.
- Private public-benefit foundations, for the grants or benefits they receive.
- Pension fund accounts.
Audit can take place before, during or after the event. Article 6, however, limits public bodies, public institutions and state-owned companies to after-the-event audit. Separately, tenders, auctions and contracts of QAR 5 million or more go to the Bureau for prior review, with a seven-working-day response window and signed contracts sent within 30 days.
What it examines
- Financial and compliance audit (Article 7) — including the adequacy and effectiveness of internal control, governance, risk management and conflict-of-interest systems, and the internal control failures behind fraud and violations.
- Performance audit (Articles 13–14) — against economy, efficiency and effectiveness.
- IT audit (Article 15) — including internal controls over systems and data protection.
That overlap with internal audit's own remit is the reason coordination matters: both functions look at the same control environment, for different principals.
The powers that reach internal audit
- Article 19 gives the Bureau access to the minutes of the board, general assembly and oversight committees — and to internal audit reports. It can see any record, request any information, contact any unit directly, and audit without notice.
- Article 20 gives it access to external auditors' working papers, and entities must write that access into their engagement letters.
- Article 17 lets it audit at its own premises, on site, or through an electronic link to the entity's systems.
The deadlines entities live with
| Obligation | Deadline | Article |
|---|---|---|
| Send final financial statements | Within 3 months of year-end | 9 |
| Reply to the Bureau's report (with reasons for any objection) | Within 30 days | 23–24 |
| Report financial violations and loss events | Immediately on discovery | 32 |
| Not replying, or withholding documents | Itself a financial violation | 30 |
The Bureau evaluates internal audit units
The Bureau's organisational structure (Emiri Decision No. 7 of 2017, as amended by Emiri Decision No. 89 of 2023) gives one of its departments — now the Internal Audit and Risk Oversight Department — the job of evaluating the internal audit units of audited entities for efficiency, effectiveness and economy, proposing improvements, and guiding entities on audit rules and standards. Since 2023 it also reviews entities' risk management systems.
In other words, the Bureau is not only a peer to coordinate with; it is also, in effect, an external reviewer of your function.
Where internal audit units come from
There is no single government-wide regulation requiring internal audit units in Qatar. They are created entity by entity, in the Emiri decision that sets each body's organisational structure. Recent ministry structures follow a consistent pattern: the internal audit department reports to the Minister, prepares a risk-based annual plan for the Minister's approval, and follows up the results of oversight bodies' reports. The Ministry of Finance's Financial Control Department sets a methodology for internal audit units in government financial units.
Check your own entity's structure decision; that is where your mandate is written.
Coordinating under Standard 9.5
Standard 9.5 (Coordination and Reliance) asks the chief audit executive to coordinate with internal and external assurance providers and to consider relying on their work — to avoid duplication, expose coverage gaps and add value. Where coordination is inadequate, the CAE raises it with senior management and, if needed, the board. Where internal audit relies on another provider's work, the CAE documents the basis for that reliance and remains responsible for the conclusions.
In practice, for the State Audit Bureau:
- Put the Bureau on your assurance map. Record which areas it audited, when, and what type of audit — so the annual plan shows where you are adding coverage and where you are not duplicating it.
- Track its observations like your own findings. Each observation needs an owner, a response within the 30-day window, and evidence of implementation. Report their status to the Minister or head of entity alongside internal audit's.
- Document any reliance. If you narrow an engagement because the Bureau covered the area, record why its work is sufficient for your purposes — its independence, competence, scope and timing — and keep the conclusion your own.
- Assume your reports will be read. Article 19 means internal audit reports may go to the Bureau. Write them to stand on their own.
- Prepare for evaluation. The Bureau's internal audit department assesses your unit. A clear trail from plan to engagement to finding to closure is the evidence it will look for.
What not to assume
- The law does not require entities to have an internal audit unit or to send their internal audit plan to the Bureau; it gives the Bureau the right to obtain internal audit reports.
- The Bureau does not formally rely on internal audit's work under the law. Coordination is expected under the Standards; reliance is a judgement each side makes.
- The Bureau reports to the Emir — not to the Shura Council or the Council of Ministers.
- The law refers to international audit rules and standards in general terms; it does not name a specific framework.
What this means for how the function is run
Coordination with the Bureau is mostly record-keeping done well: an assurance map that includes it, a single register for its observations and your own findings, response deadlines that are tracked rather than remembered, and reports that can be handed over as they are. That is what ControlVista's audit management software for Qatar keeps in one place — on-premise, in Arabic and English.
Sources
- Law No. 11 of 2016 on the State Audit Bureau — Al Meezan: almeezan.qa
- Law No. 7 of 2026 amending the State Audit Bureau law — Al Meezan: almeezan.qa; QNA, July 2026: qna.org.qa
- Al Raya, State Audit Bureau internal audit oversight (July 2024): raya.com
- State Audit Bureau: sab.gov.qa
- The IIA, Global Internal Audit Standards (2024): theiia.org