Photo: Magnifying_glass_on_antique_table by Stéphane Magnenat. Photo and cropped/resized versions: CC BY-SA 4.0.
Owners in Qatar are often asked for “audited” figures by a partner, a bank or the tax authority, and offered “reviewed” figures or an “internal audit” by advisers. The three words sound alike, but they describe different engagements with different purposes, standards and legal weight.
An external audit gives the shareholders an independent opinion on the year’s financial statements. A review gives a lighter, limited level of assurance on the same statements. Internal audit is a check of the company’s own processes, controls and risks during the year, reporting to the board.
This guide compares the three, sets out when Qatari law requires each one, and explains why one firm cannot be both your external auditor and your internal auditor.
- External audit
- Every year for LLCs and JSCs
- Review
- Limited assurance
- Internal audit
- Required for listed companies
- Law checked
- 16 October 2026
The short answer
In short
- External audit: an independent opinion on the annual financial statements for the shareholders. Limited liability companies and joint stock companies must appoint an auditor every year, whatever their size (Commercial Companies Law Articles 141 and 260).
- Review: a lighter engagement under ISRE 2400 (Revised), mainly enquiry and analysis, giving limited assurance. It does not replace an audit that the law, a regulator or a contract requires.
- Internal audit: the company’s own independent check of processes, controls and risks during the year, reporting to the board or its audit committee. Required for companies listed on the Qatar Stock Exchange; for most other companies it is a board decision.
- Independence: the firm that audits your financial statements cannot also provide your internal audit or other consultancy work (Law No. 8 of 2020, Article 27).
Internal audit, external audit and review side by side
The table compares the three engagements point by point.
| Point | Internal audit | External audit | Review |
|---|---|---|---|
| Purpose | Check that processes, controls and risk management work during the year | Give an opinion on whether the annual financial statements are fairly presented | Give limited assurance that nothing suggests the financial statements are materially misstated |
| Who appoints | The board or its audit committee | The shareholders in general assembly | The owners or managers, often at the request of a lender or partner |
| Who reads the report | The board, the audit committee and management | Shareholders, and others such as the GTA, banks and the Ministry | Owners, partners or a lender who has agreed to accept it |
| Who may do it | An in-house team or an outside firm; not the company’s external auditor | An auditor entered in the register of auditors (Law No. 8 of 2020) | A practitioner who is not the company’s auditor (ISRE 2400) |
| Standard | IIA Global Internal Audit Standards | International Standards on Auditing (ISA) | ISRE 2400 (Revised) |
| Level of assurance | No formal opinion on the financial statements | Reasonable assurance | Limited assurance |
| Main work | Risk-based plan, control testing, follow-up of agreed actions | Planning, testing of balances and transactions, evidence from third parties | Mainly enquiry and analytical procedures |
| Output | Reports with findings and agreed actions | Auditor’s report with an opinion, often with a management letter | Review report with a conclusion in negative form |
| Timing | Throughout the year, by plan | Once a year, after the year end | When needed, usually after the year end |
| Required in Qatar for | Listed companies (QFMA Governance Code); check your regulator if regulated | LLCs and joint stock companies every year; audited accounts for many tax returns | No company type by law; used where no audit is required |
What an external audit is, and who must have one
An external audit is an independent examination of the company’s annual financial statements under the International Standards on Auditing. The auditor plans the work around the risks of material misstatement, tests balances and transactions, obtains evidence from banks, customers and suppliers, and issues a report with an opinion on whether the statements are fairly presented. Many auditors also send a management letter with points on controls.
In Qatar, two separate rules make an audit necessary. The first is company law: every limited liability company has one or more auditors appointed by the general assembly every year (Commercial Companies Law Article 260), and joint stock companies follow the same rule (Article 141). There is no exemption for small companies, and the managers of a limited liability company send the accounts with the auditor’s report to the Ministry and the partners (Article 251).
The second is income tax. Audited final accounts, signed by an auditor registered in Qatar, go with the tax return if the company’s capital is more than QAR 200,000, its income is more than QAR 500,000, or its main office is outside Qatar (Income Tax Executive Regulations Article 33).
Only an auditor entered in the register of auditors under Law No. 8 of 2020 may carry out the audit, and the auditor cannot be a person who took part in preparing the accounts (Executive Regulations Article 34(4)). For the full table by company type, see is an audit mandatory in Qatar. To get ready for the work, see our audit preparation checklist, and for the service itself our external audit page.
What a review engagement is, and when it is enough
A review of financial statements follows ISRE 2400 (Revised), issued by the International Auditing and Assurance Standards Board. The standard applies when the practitioner is not the company’s auditor. The work is mainly enquiry of management and analytical procedures, such as comparing figures with earlier periods and looking into unexpected movements. There is no testing of transactions to the depth of an audit and no confirmation from third parties as a rule.
Because the work is lighter, a review takes less time than an audit; see how audit fees are set for the drivers of time and cost. The report gives limited assurance: it states whether anything has come to the practitioner’s attention that suggests the statements are not prepared, in all material respects, in line with the framework.
A review suits situations where no audit is required. Owners or partners may want an independent look at management accounts or interim figures, for example, or a lender or business partner may have agreed in writing to accept reviewed figures. A review can also serve group reporting for an entity that has no audit duty of its own.
A review does not meet the Commercial Companies Law duty to appoint an auditor every year, and it is not the audited accounts the GTA asks for under Article 33. Before you order one, ask the reader of the report, in writing, whether “reviewed” figures are acceptable. In Qatar, the law on the auditing profession covers “auditing and reviewing accounts” (Law No. 8 of 2020, Article 1), so also ask whether the person who will sign the review is a registered auditor.
Where a lender needs a report on one item, such as a covenant or a single account, rather than the full statements, a special purpose audit or agreed-upon procedures may fit better. Our review of financial statements page explains the service.
What internal audit is, and who must have it
Internal audit is an independent function that works for the board. It builds a plan around the company’s main risks, tests whether the key controls work, reports findings with agreed actions, and follows up until they are done. The international standard is the Global Internal Audit Standards of the Institute of Internal Auditors (IIA), released on 9 January 2024 and effective from 9 January 2025.
Internal audit can be an in-house team, an outside firm (outsourced), or a mix of both (co-sourced). Whatever the model, it should report to the audit committee or the board, not only to the managers whose work it checks.
For companies listed on the Qatar Stock Exchange, internal audit is required. The QFMA Governance Code for Listed Companies (2025) defines internal audit as financial audit, performance evaluation and risk management work by one or more independent units within the company, and Article 7 sets out how it works.
Under Article 7, internal audit staff are independent of senior management in their appointment, evaluation and pay, and the function reports directly to the board’s audit committee. The Internal Audit Director reports to the audit committee at least every quarter, and internal audit must notify the QFMA directly of serious violations.
Banks, insurers and other regulated firms should check their regulator’s rules. For other companies, no general legal requirement for internal audit was found: it is a board decision based on risk. It often suits companies that have grown faster than their controls, run several sites or branches, handle large volumes of cash or stock, or want an independent view without hiring a full team. Our internal audit and internal controls and risk advisory pages describe these services.
Why your external auditor cannot be your internal auditor
The external auditor gives an independent opinion on the financial statements. If the same firm also designed or tested the controls behind those statements, it would be reviewing its own work, and Qatari law addresses this directly.
Under Law No. 8 of 2020, an auditor may not audit a company to which it provides any consultancy work (Article 27), and may not carry out any work that conflicts with the audit work it performs (Article 26). The Income Tax Executive Regulations add that the auditor of the final accounts cannot be a person who took part in preparing them (Article 34(4)).
In practice, use different firms: one for the statutory audit, and another for internal audit, controls work or accounting. When you speak to any firm, ask which role it will play for you, and confirm that the other roles sit with someone else.
Which one does your company need?
Work through these questions in order. More than one answer can apply.
- Are you a limited liability company or a joint stock company? You need an external audit every year.
- Is your main office outside Qatar, or is your capital above QAR 200,000 or your income above QAR 500,000? Audited accounts go with your income tax return.
- Are you listed on the Qatar Stock Exchange? You need an internal audit function, and your external auditor must also be on the QFMA’s list of auditors.
- Are you regulated by the Qatar Central Bank, the QFC Regulatory Authority or another regulator? Check its rules on audit and internal audit.
- Has a bank, partner or tender asked for figures? Ask in writing whether it needs “audited” or “reviewed” figures, and for which period.
- Do you want a check on your controls and risks during the year? Consider internal audit, in-house or from a firm that is not your external auditor.
If none of the legal duties apply and the only reader is the owners, a review may be enough. If a legal duty applies, a review can add to the audit but cannot replace it.
What to do next
Write down your company type, your capital and income, who has asked for figures and why, and whether you already have an auditor. With that list, it is clear which engagement you need and which firm can take it on.
Our external audit, internal audit and review of financial statements pages describe each service. To discuss your needs, tell us who audits your accounts today and request a proposal.
Frequently asked questions
What is the main difference between internal and external audit?
Internal audit works for the board and management during the year, checking processes, controls and risks. External audit gives the shareholders an independent opinion on the annual financial statements under the International Standards on Auditing, and in Qatar it is required every year for limited liability and joint stock companies.
Can a review replace a statutory audit in Qatar?
No. Limited liability and joint stock companies must appoint an auditor every year (Commercial Companies Law Articles 141 and 260), and the GTA asks for audited accounts in the cases set out in Executive Regulations Article 33. A review gives limited assurance and is not an audit.
Is internal audit mandatory in Qatar?
For companies listed on the Qatar Stock Exchange, yes, under the QFMA Governance Code for Listed Companies. Banks and other regulated firms should check their regulator’s rules. For other companies, it is a board decision based on risk.
Can the same firm do our internal audit and our external audit?
No. Law No. 8 of 2020 bars an auditor from auditing a company to which it provides any consultancy work (Article 27) and from any work that conflicts with its audit work (Article 26). Use different firms for the two roles.
Who can carry out a review of financial statements?
ISRE 2400 (Revised) is written for a practitioner who is not the company’s auditor. In Qatar, the law on the auditing profession covers “auditing and reviewing accounts”, so ask whether the person signing the review is a registered auditor.
Which standards apply to each engagement?
External audits follow the International Standards on Auditing, reviews follow ISRE 2400 (Revised), and internal audit follows the IIA Global Internal Audit Standards, effective from 9 January 2025.
Will my bank accept a review instead of an audit?
Only the bank can say. Check the facility letter and ask the bank in writing whether it needs audited or reviewed figures. No public rule on this was found.
Sources
Laws and regulations
Standards
This article is general information, not legal or audit advice for your company. The laws, regulations and standards cited were checked on 16 October 2026; English descriptions of Arabic legal texts are our own. A firm that audits your financial statements cannot also provide your internal audit.