Internal Audit Committee Roles Under Qatar Governance Rules

The 2025 QFMA Governance Code has changed how listed companies in Qatar structure their Audit Committee and Internal Audit function. This guide focuses on the working relationship between the two, not on general internal audit theory. Under the new framework, listed companies must establish an independent Audit Committee, and Internal Audit must operate independently from Senior Executive Management while reporting directly to that Committee, which also carries specific responsibilities over the Internal Audit Department itself. At Audit Services Qatar, we work with Boards and Audit Committees across the region to turn these requirements into working governance structures, and this article breaks down what the Code expects.

The QFMA Code defines Internal Audit as financial audit, performance evaluation and risk management activity carried out by independent internal units, and that definition sets the boundary between what the Committee oversees and what Internal Audit actually performs.

What the 2025 Qatar Governance Code Says About Internal Audit

The 2025 Code replaced the 2016 framework with clearer obligations for the Audit Committee and Internal Audit. Before looking at structure or duties, it helps to understand who must comply and how the terminology works.

Which companies must follow the new governance rules?

Main Market listed companies must comply with the Code in full, a mandatory requirement tied to listing status. Secondary Market companies follow a comply or explain approach, allowing deviation if the reason is disclosed. The 2025 Code repealed the 2016 Code, and companies received one year from Gazette publication to align their governance position, a transition detail many companies overlook.

Is “Internal Audit Committee” the official term?

This distinction gets confused often. The Audit Committee is a Board committee appointed by and reporting to the Board. The Internal Audit Department is the independent assurance function that reports to that Committee, and the Internal Audit Director heads that function. Mixing these terms up in a charter creates real confusion about accountability.

How the Audit Committee Should Be Structured Under Qatar Rules

Structure determines if the Audit Committee can function as an independent oversight body, and the Code sets minimum requirements for size, independence, meeting frequency and documentation.

• Minimum Membership: At least three members must be appointed by the Board, with appointments recorded in Board minutes and supported by clear terms of reference.
• Independent Chairman: The Committee must be chaired by an independent director who meets the Code’s independence criteria and holds no executive role.
• Majority Independent Members: Most seats must be held by independent directors with financial or audit expertise, ensuring genuine engagement with technical findings.
• Exclusions from Membership: The Board Chairman cannot sit on mandatory committees, and members cannot serve on another Board committee simultaneously under the new Code.
• Meeting Frequency: Mandatory Board committees must meet at least four times per year, with proper records of meetings, decisions, and reports maintained for accountability.
• Charter Requirements: The charter must document authority, responsibilities, reporting lines, meeting frequency, quorum, voting rules, member qualifications, and access to Internal Audit and external advisers.
• Documentation Standards: All duties and powers must be formally documented rather than left to informal practice, ensuring transparency and regulatory compliance.
• Oversight Role: The Committee should oversee assurance processes without interfering in management’s operation of controls or Internal Audit’s independent evaluation.

What the Audit Committee Must Do for Internal Audit

This is the core relationship the Code protects. The Committee’s responsibilities toward Internal Audit go past simply receiving reports at scheduled meetings.

Review Internal Audit reports and findings

The Audit Committee must review reports from Internal Audit, the External Auditor, the QFMA and other supervisory authorities, follow up on identified violations, track corrective actions to a deadline, and confirm that fixes address the root cause rather than only the symptom reported.

Approve the annual Internal Audit plan

 The plan should reflect the company’s real risk profile, not repeat the prior year’s calendar. Work should not begin until the Committee has formally signed off the scope, and mid-year changes should return to the Committee rather than being decided by management alone. The QFMA Code specifically assigns annual approval of the audit plan to the Audit Committee, making it a formal governance step.

Protect Internal Audit independence

This point deserves detailed treatment because independence is the foundation of the function’s value. Internal Audit staff must remain independent from Senior Executive Management in appointment, performance evaluation, salary, incentives and remuneration, and report directly to the Board’s Audit Committee. If management controls how Internal Audit staff are paid or evaluated, the independence the Code requires exists only on paper, which is why Audit Services Qatar treats this as the first item to verify during a governance review.

Ensure Internal Audit has the right skills

Professional qualifications, relevant industry experience, working knowledge of QFMA requirements and continuous training determine how comprehensively Internal Audit can audit the company. The Code specifically requires the Committee to confirm appropriate qualifications, experience and ongoing development within the team.

How the Audit Committee Oversees Internal Controls

Strong oversight of internal controls is one of the audit committee’s most critical responsibilities. By ensuring controls are effective and properly assigned, the committee strengthens governance, reduces risk, and builds confidence in financial and operational integrity.

• Confirm Controls Work: Oversight must extend beyond financial reporting to operational, compliance, and fraud‑related controls. Segregation of duties and authorization limits deserve equal scrutiny under the QFMA Code.
• Identify Weaknesses Clearly: Root cause analysis matters more than closing findings one by one. The Committee should track overdue corrective actions and ensure remediation is genuinely complete.
• Separate Responsibilities Correctly: Management owns and operates controls, Internal Audit evaluates them independently, and the Audit Committee oversees assurance. Confusing these three layers is a common issue in audit charters.
• Monitor Remediation Progress: The Committee should require regular updates on corrective actions, ensuring accountability until weaknesses are fully resolved.
• Ensure Independence of Internal Audit: Oversight includes protecting Internal Audit’s independence from management influence, ensuring findings remain objective and credible.
• Review Control Ownership: Each control must have a clearly assigned owner. The Committee should verify accountability structures are documented and enforced.
• Evaluate Fraud Controls: Fraud prevention measures, whistleblowing channels, and monitoring systems should be regularly reviewed to reduce misconduct risks.

How Internal Audit Should Report to the Audit Committee

Reporting frequency and content are areas where the Code gets specific. Reports should cover audit scope, observations, violations, errors, corrective actions, accountability, and any matters that remain unresolved. Leaving out unresolved matters is a common gap that weakens the value of these reports. The Internal Audit Director must submit reports to the Audit Committee at least quarterly, a specific and checkable requirement companies should confirm is actually happening rather than assumed from past practice.

The Internal Audit Director must notify the QFMA directly when a violation or irregularity could materially affect company performance, business results, financial statement accuracy or compliance with laws and regulations. This obligation sits with the Director personally, separate from the Committee’s own reporting duties. From there, the practical escalation flow runs from an Internal Audit finding, to a management corrective action, to a follow up review, then Committee review, then Board reporting, and finally regulatory escalation where the materiality threshold applies.

How the Audit Committee Can Make Internal Audit More Effective

An effective audit committee sets the tone for how internal audit delivers value. By providing oversight, resources, and strategic alignment, the committee ensures audits go beyond compliance to strengthen governance and risk management.

• Give Internal Audit unrestricted access. Access to records, systems and senior management should never require prior clearance.
• Focus the plan on material risks. Resources should concentrate on genuine exposure rather than routine compliance checking.
• Track overdue findings at Board level. Ageing and risk ratings keep pressure on management without chasing every item.
• Hold private discussions with the Director. Meeting without management present lets sensitive issues surface without influence.
• Evaluate resourcing regularly. Staffing, technology, expertise and training budgets determine if the plan gets delivered.

The chain runs from financial statements, through financial reporting controls, through Internal Audit testing of those controls, to Audit Committee oversight, and finally to Board approval.

Internal Audit Committee Compliance Checklist for Qatar Companies

Use this as a working document rather than a one-time review.

This checklist is useful for Board members, Committee members, Internal Audit Directors, CFOs and compliance officers working through their annual review. Audit Services Qatar uses a version of this checklist during governance reviews with client Boards.

What Companies Should Complete Before the 2025 Code Transition Deadline

The Code gives companies a one-year reconciliation period, and the QFMA confirms publication in the Official Gazette on 17 August 2025, a deadline closer than many governance teams realize.

Review the charter and test Internal Audit independence

Compare the current charter against the new Code line by line, focusing on independence criteria and membership restrictions that changed. Then check the reporting line, appointment process, remuneration and evaluation process for Internal Audit staff, since a policy that states independence on paper is not the same as independence in practice.

Reassess the annual audit plan and reporting procedures

Confirm the plan received formal approval, that quarterly reporting is genuinely happening, and that the serious violation escalation procedure to the QFMA is documented and understood by the Internal Audit Director personally.

Common Internal Audit Committee Mistakes Under Qatar Governance Rules

• Treating Internal Audit as a management function. Independence is compromised when management controls priorities or compensation, regardless of the organization chart.
• Approving the plan without reviewing risk coverage. A Committee that signs off without understanding why areas were selected cannot challenge coverage gaps.
• Receiving reports without following up findings. A finding is not resolved simply because management promised action in a meeting.
• Ignoring recurring control weaknesses. The same finding across multiple cycles points to a systemic issue, not a one-time error.
• Failing to escalate serious violations. Ordinary findings and matters requiring regulatory notification are not the same category.
• Mixing Audit Committee and Risk Committee duties. The 2025 Code created separate roles, and blending them undermines that clarity.

Conclusion

Independent Internal Audit supported by effective Audit Committee oversight leads to stronger internal controls, timely remediation, reliable financial reporting and genuine regulatory compliance. The 2025 QFMA Code has made this relationship a much more explicit governance responsibility than before. The objective is not holding four meetings a year or receiving quarterly reports. The Committee needs to confirm that Internal Audit is genuinely independent, properly resourced, focused on real risk and capable of escalating significant issues without hesitation. Companies that treat this as a checklist exercise tend to discover the gap only when a regulator points it out. Audit Services Qatar helps Boards close that gap before it becomes a compliance problem.

Get Your Audit Committee Structure Reviewed

If your Audit Committee charter, Internal Audit reporting lines or governance disclosures have not been checked against the 2025 QFMA Code yet, now is the right time before the transition deadline arrives. Audit Services Qatar works directly with Boards, Audit Committees and Internal Audit teams to review current structures and prepare documentation that stands up to regulatory scrutiny.

Reach out to our team for a practical review of your governance setup. Call us to get started.

Email us: info@finsoulnetwork.com

Frequently Asked Questions 

Is an Internal Audit Committee mandatory in Qatar?

The mandatory Board body under the Code is the Audit Committee. Internal Audit is the independent function that reports to it, so the two terms describe connected but different parts of the same structure.

How many members should the Audit Committee have?

At least three members, appointed formally by the Board and documented in the Committee charter.

Who should chair the Audit Committee?

An independent Board member, and that person cannot also serve as Board Chairman.

How often should the Audit Committee meet?

At least four times a year under the 2025 Code.

How often must Internal Audit report to the Audit Committee?

At least quarterly, with direct notification to the QFMA required for serious violations that meet the Code’s materiality criteria.