The audit report and management letter: what your auditor's opinion means

The short answer

What the auditor’s report contains, section by section

International Standard on Auditing (ISA) 700 sets the order of the report. The audit reports issued in Qatar usually follow it. In reading order:

1. 1

   Title and addressee

   The report is titled as the report of an independent auditor and addressed to the shareholders or partners.

2. 2

   Opinion

   The opinion comes first. It names the statements audited and says whether they are prepared, in all material respects, under the framework, usually IFRS.

3. 3

   Basis for opinion

   The audit was done under ISA, the auditor is independent, and the evidence is sufficient and appropriate.

4. 4

   Going concern

   If there is a material uncertainty about the company’s ability to continue, a separate section headed “Material Uncertainty Related to Going Concern” draws attention to it.

5. 5

   Key audit matters

   For listed companies, the matters of most significance in the audit, and how the auditor dealt with them (ISA 701).

6. 6

   Emphasis of matter or other matter

   Extra paragraphs that draw attention to a point without changing the opinion (ISA 706).

7. 7

   Responsibilities

   What management and the auditor are each responsible for.

8. 8

   Other legal and regulatory requirements

   A separate section. In Qatar this is usually where the statements required by the Commercial Companies Law and the tax regulations appear.

9. 9

   Signature, place and date

   The report is signed, with the place and date. For listed companies, the engagement partner is named.

Audit reports are signed by a partner or manager entered in MOCI’s register of individual auditors, and no one may sign on their behalf (Law No. 8 of 2020, Articles 7 and 31). See how to choose an auditor in Qatar. A review engagement gives a conclusion, not an opinion: see internal audit, external audit or review.

The four opinions and the extra paragraphs

Two ideas decide which opinion is given: whether a matter is material, and whether it is pervasive. A matter is pervasive if its effects are not confined to specific items, or, if they are, they make up a substantial part of the statements or are fundamental to understanding them (ISA 705 paragraph 5).

A qualified opinion does not always mean the accounts are wrong. It can mean the auditor could not obtain enough evidence for one area, such as missing records (ISA 705 paragraph 7(b)). The basis for opinion section gives the reason.

What a modified opinion means for a bank facility depends on the facility letter, so ask your bank. A report on one item rather than the full statements is a different engagement: see special purpose audit.

What Qatari law says about the auditor’s report

The Commercial Companies Law (Law No. 11 of 2015) sets the auditor’s duties and the content of its report for joint stock companies, and Article 260 applies the same rules to limited liability companies. Under Article 146, the report must state that the auditor obtained the information and explanations it needed, and that the company keeps regular accounts and records in line with internationally recognised accounting rules.

It must also state that the audit procedures give a reasonable basis for the auditor’s opinion on the financial position, results and cash flows, under internationally recognised auditing rules. The auditor then confirms that the financial data in the board’s report agree with the books and that the inventory count was carried out properly. Finally, the report records any breaches of the law or the articles of association during the year with a material effect, and whether they continue.

Who receives it. The auditor gives the general assembly a written report, which is read at the assembly, and sends a copy to the Ministry’s competent department (Article 145). A resolution approving the board’s report without hearing the auditor’s report is void, and joint auditors give one report (Article 148). Every shareholder may discuss the report with the auditor at the assembly (Article 149). In an LLC, the managers send the accounts with the auditor’s report to the Ministry’s department and to each partner within one month of preparing them (Article 251). A joint stock company publishes the full report with its balance sheet at least 15 days before the general assembly (Article 126).

If the auditor cannot finish. Before withdrawing, the auditor sends the Ministry’s department a written report of the reasons, with a copy to the board. If the matter is not resolved within 30 days, the general assembly is called (Article 147).

For tax. Where audited accounts are filed with the tax return, the auditor’s report must confirm that the audit was done under recognised standards, or say why it could not be and give the reason for any reservation. It must also confirm that the accounts follow the applicable standards and that disclosure requirements were met (Executive Regulations Article 34(3)). For computer-kept books, the auditor confirms that the system meets recognised security and accuracy standards (Article 36(3)(d)). See how to file a corporate income tax return.

Listed companies also receive a separate report from the external auditor on compliance with the QFMA Governance Code. For which companies must be audited at all, see is an audit mandatory in Qatar.

What a management letter is, and what it is not

“Management letter” is the common name for the auditor’s written communication on internal control under ISA 265. The standard itself does not use the term, but it defines two levels. A deficiency in internal control exists when a control is designed, implemented or operated in a way that cannot prevent, or detect and correct, misstatements on a timely basis, or when a necessary control is missing (ISA 265 paragraph 6(a)). A significant deficiency is a deficiency, or a combination of them, important enough to merit the attention of those charged with governance, such as the board (paragraph 6(b)).

The auditor must report significant deficiencies in writing, on a timely basis, to those charged with governance and to management. Other deficiencies important enough to merit management’s attention are also reported to management (paragraphs 9 and 10). The letter describes each deficiency and its potential effects, and explains that the audit’s purpose was to express an opinion on the statements, not on the effectiveness of internal control, and that it covers only weaknesses found during the audit (paragraph 11). Most letters also give a recommendation and space for management’s response.

Is a management letter required? A written communication is required when the auditor finds significant deficiencies. A letter covering lesser points as well is common practice. We found no MOCI or GTA rule requiring the letter to be filed.

It is not the representation letter. The management representation letter goes the other way: written confirmations from management to the auditor, signed before the report (ISA 580). See audit preparation checklist.

How to respond to a management letter

1. 1

   Read it together

   Go through the letter with the finance team and the board soon after it arrives.

2. 2

   Rank the findings

   Start with significant deficiencies and anything touching cash, payments or the books themselves.

3. 3

   Name an owner and a date

   Give each finding one responsible person and a target date in a simple tracker.

4. 4

   Write management’s response

   For each point, say whether you agree and what you will do, or why you disagree.

5. 5

   Fix and keep evidence

   Change the control and keep evidence that it works, such as signed reconciliations.

6. 6

   Check before the year end

   Review progress before the next year end.

7. 7

   Report back at the next audit

   The auditor asks for the prior-year letter and checks what was done. Have the tracker ready.

If the same points come back each year, consider an outside review of controls by our internal controls and risk advisory service, or ongoing internal audit. Your external auditor cannot do this work for you: it may not do technical, administrative or consultancy work for the company it audits (Commercial Companies Law Article 143; Law No. 8 of 2020, Article 27(3)). For a practical list of controls, see internal controls checklist for SMEs.

What to do next

Read the report from the opinion down and put the management letter on the next board agenda. Our external audit page describes the audit service. To fix the weaknesses with a firm that is not your auditor, see our internal controls and risk advisory and internal audit services. To discuss your needs, request a proposal.

Frequently asked questions

Sources

This article is general information, not audit or legal advice for your company. The laws, regulations and standards cited were checked on 16 October 2026; English descriptions of Arabic legal texts are our own. Ask your auditor to explain any paragraph in your report you are unsure about.

Related guides

• Audit by sectorAudit for NGOs, charities and private schools in QatarRead the guide
• Internal controlsA starter internal controls checklist for SMEs in QatarRead the guide
• Audited accountsAudited financial statements for bank loans, tenders and visas in QatarRead the guide