Photo: Key code lock by Khrystinasnell. Photo and cropped/resized versions: CC0.
In a small company, the owner often approves payments, the accountant records them and one person does both at month end. That works while the business is small and everyone knows each other. It becomes a risk as payments, staff and stock grow.
Internal controls are the checks that make sure money is spent with approval, recorded correctly and protected. They do not need a large team or expensive software. They need clear rules on who does what, and someone who checks.
This guide uses the COSO framework to explain internal control, then sets out a starter checklist by business cycle and the controls Qatari tax rules expect from your accounting system.
- Reference framework
- COSO 2013
- Components
- 5
- Salaries paid
- By bank transfer
- Law checked
- 16 October 2026
The short answer
In short
- Internal controls are the checks that make sure money is spent with approval, recorded correctly and protected. The usual reference is the COSO Internal Control – Integrated Framework (2013), with five components.
- The key rule in a small team: no one person should start, approve, pay and record the same transaction. Where that is not possible, the owner reviews.
- Start with five areas: cash, bank, purchases and payments, payroll, and stock. Then add sales and system access.
- Your auditor examines your internal financial control systems (Commercial Companies Law Article 145(4)) and reports weaknesses in writing, usually in a management letter.
What internal control means, using the COSO framework
COSO, the Committee of Sponsoring Organizations of the Treadway Commission, publishes the framework most auditors and companies use as the reference. It is not Qatari law. Its 2013 framework replaced the 1992 version on 15 December 2014.
COSO defines internal control as a process, carried out by the board, management and other staff, designed to give reasonable assurance that the company meets its objectives in operations, reporting and compliance. It has five components, supported by 17 principles.
| Component | What it covers | In a 5 to 50 person company |
|---|---|---|
| Control environment | Integrity, ethics, oversight and clear responsibilities (principles 1 to 5) | The owner sets written approval rules and follows them too |
| Risk assessment | Identifying what could go wrong, including the potential for fraud (principles 6 to 9) | A short list of what could go wrong in cash, payments, payroll and stock |
| Control activities | The actions that reduce those risks, including controls over technology (principles 10 to 12) | Approvals, reconciliations, counts and access rights |
| Information and communication | Quality information shared inside and outside the company (principles 13 to 15) | Written procedures and a monthly management report |
| Monitoring activities | Checking that controls work and reporting weaknesses on time (principles 16 and 17) | A monthly owner review and follow-up of the auditor’s points |
COSO accepts that a smaller company’s controls may be less formal and less structured and still be effective. It also says no system is perfect: controls give reasonable, not absolute, assurance.
Separation of duties when your team is small
Every transaction has four steps: someone starts it, someone approves it, someone holds the asset or makes the payment, and someone records it. The more of these steps one person controls, the easier it is for an error or a fraud to go unnoticed.
With one accountant, full separation is rarely possible. COSO’s answer is that where separation is not practical, management chooses alternative controls. In practice, this usually means the owner or a partner approves every payment, or every payment above a set limit, in the online banking system. The owner also receives the bank statement directly and reviews it each month against the reconciliation, and on the same monthly cycle looks at new suppliers, new staff and changes to bank details.
Access rights in the accounting system then limit who can create suppliers, post entries and approve them. Where possible, duties rotate, and staff take their leave so that someone else covers their work.
If an outside firm keeps your books, keep approval rights in the company. The company stays responsible to the GTA for its books even when bookkeeping is contracted out (Executive Regulations Article 36(4)). See outsourced accounting in Qatar.
The starter checklist by cycle
The items below are good practice, not legal requirements, except where a law is cited. Pick those that fit your size and add limits that suit your business.
Cash
- Set a petty cash limit and a named custodian.
- Require a receipt or voucher for every payout.
- Have someone other than the custodian count the cash, without notice, from time to time.
- Do not use petty cash for personal loans or advances.
Bank
- Use two signatories, or dual approval in online banking, above a set limit.
- Reconcile every bank account each month; one person prepares, another reviews and signs.
- Review who has bank user rights at least once a year and when staff leave.
- Keep cheque books locked and record cancelled cheques.
Purchases and payments
- Keep an approved supplier list, and confirm any change to supplier bank details by phone with a known contact.
- Use purchase orders above a set limit.
- Match the order, the delivery and the invoice before paying.
- Write down who may approve what amount.
- Check withholding tax on payments to non-resident suppliers. See withholding tax in Qatar.
Sales and receivables
- Issue invoices from a single numbered sequence.
- Set credit limits and review the ageing of receivables each month.
- Have credit notes approved by someone other than the person who raised them.
Payroll and WPS
- Have changes to the staff master file, such as new staff, pay rises and bank details, approved by someone other than the payroll preparer.
- Review the payroll against contracts before the Wage Protection System file is sent.
- Pay salaries only by bank transfer through WPS (Labour Law Article 66). For payment dates, see the Qatar compliance calendar 2027.
- Review the end-of-service provision at least at the year end.
Stock
- Count stock at least at the year end, with someone other than the storekeeper, and record it in the inventory book (Commercial Law Article 25).
- Investigate and approve count differences before adjusting the books.
- Review slow-moving and damaged stock.
- Limit access to the store.
Your auditor may attend the year-end count. See the audit preparation checklist. For the monthly bookkeeping routine itself, see bookkeeping for SMEs in Qatar.
Controls your accounting system must have
Qatari tax rules set conditions for books kept on a computer, and Executive Regulations Article 36(3) can be read as a control list. The system must be secure against tampering with entries or outputs, with user access and passwords controlled. Entries cannot be changed after they are confirmed, and statement dates cannot be manipulated. The original supporting documents are kept, along with the system design and user documents, and extracts of entries and accounts are produced every three months. The GTA must also have access to all records at any time within Qatar.
Your auditor must confirm in its report that the system meets recognised security and accuracy standards. Books and records are kept at the place of business for 10 years after the year they relate to (Article 36(1)). Our accounting system setup service helps you configure access rights and approval steps, and an IT audit looks at system controls in more depth.
How to check your controls are working
Controls weaken quietly when people are busy. A short monthly review by the owner keeps them working. Sign and date each review, so that you and your auditor can see it took place:
Monthly owner review
- Bank reconciliations prepared, reviewed and signed
- New suppliers, new staff and any bank detail changes
- Payments above the approval limit
- Credit notes and write-offs
- Stock differences and adjustments
- Progress on the points in the auditor’s last management letter
Your auditor examines the company’s financial and administrative systems and internal financial control systems (Commercial Companies Law Article 145(4), applied to LLCs by Article 260). Significant weaknesses it finds are reported in writing to management and the board (ISA 265). See the audit report and management letter explained.
For an outside view, our internal controls and risk advisory service reviews your controls and helps you fix gaps, and internal audit gives ongoing checks. For the difference, see internal audit, external audit or review. That work cannot be done by your external auditor: it may not do technical, administrative or consultancy work for the company it audits (Commercial Companies Law Article 143; Law No. 8 of 2020, Article 27(3)).
Listed companies have their own rules: the QFMA Governance Code requires the board to put in place effective internal control systems and an independent internal audit (Article 7). For most SMEs, controls are a management decision, but your auditor and the GTA expect the points above.
What to do next
Pick the two or three cycles where most money moves, write down who does and who checks each step, and start the monthly owner review. Add the other cycles over the following months, and review the whole list once a year or when the business changes, for example when you open a new branch, take on more staff or change your accounting system. Our internal controls and risk advisory, internal audit and accounting system setup services can help, and our SMEs page explains how we work with smaller companies. To discuss your needs, request a proposal.
Frequently asked questions
What are the five components of internal control?
Under the COSO Internal Control – Integrated Framework (2013): control environment, risk assessment, control activities, information and communication, and monitoring activities. They are supported by 17 principles. COSO is a reference framework, not Qatari law.
What should an internal control review checklist cover?
Start at company level with the five COSO components, such as approval rules and monthly review. Then cover each cycle: cash, bank, purchases and payments, sales, payroll and stock, plus access rights in the accounting system (Executive Regulations Article 36(3)).
How can a small company separate duties with only one accountant?
Where full separation is not practical, COSO says to use alternative controls. For example, the owner approves payments in online banking, reviews the bank statement and reconciliation each month, and checks new suppliers and staff, with access rights limiting what the accountant can change.
Are internal controls required by law in Qatar?
Listed companies must have effective internal control systems under the QFMA Governance Code (Article 7). For other companies, controls are mainly a management decision, but the auditor examines internal financial control systems (Commercial Companies Law Article 145(4)) and the GTA sets conditions for computer-kept books (Executive Regulations Article 36(3)).
Does our auditor check our internal controls?
Yes, as part of the audit. The auditor examines internal financial control systems (Commercial Companies Law Article 145(4)) and reports significant deficiencies in writing (ISA 265). It does not give a separate opinion on whether your controls are effective (ISA 265 paragraph 11).
Can our external auditor design our controls?
No. The auditor may not do any technical, administrative or consultancy work for the company it audits (Commercial Companies Law Article 143), and may not audit an entity to which it provides consultancy work (Law No. 8 of 2020, Article 27(3)). Use a different firm.
How does WPS help payroll control?
Salaries must be paid by transfer to the worker’s bank account in Qatar (Labour Law Article 66), and the Wage Protection System lets the Ministry compare payments with contracts. The company still needs its own review of the payroll before the file is sent.
Sources
Laws and regulations
- Income Tax Law and Executive Regulations, 2024 edition (General Tax Authority)
- Commercial Companies Law No. 11 of 2015 (Al Meezan)
- Law No. 8 of 2020 on the Auditing Profession (Al Meezan)
- Governance Code for Listed Companies, 2025 (Qatar Financial Markets Authority)
- Retail payment systems: Wage Protection System (Qatar Central Bank)
Frameworks and standards
This article is general information, not legal or audit advice for your company. The laws, regulations and framework cited were checked on 16 October 2026; English descriptions of Arabic legal texts are our own. Checklist items are good practice and should be adapted to your business.