UAE, Saudi Arabia and Qatar
AI-led internal audit, ICOFR and finance controls for the Middle East
IRA, IRAME's AI auditor, tests controls on every transaction for internal audit, GRC and finance teams in the UAE, Saudi Arabia and Qatar. The application, data and AI models stay in-region or on your premises.
Used by teams at
IRAME was built for internal audit first.
Your team plans the engagement; IRA tests every transaction in scope.
Reports follow Finding, Impact, Risk and Recommendation. Each finding goes to an owner and is tracked to closure in Action Hub.
Risk Register, Control Library and Attestation Cycles sit in ControlDesk.
Key controls run on every transaction as it posts. ICOFR key controls are tested with evidence your auditor can re-perform.
Describe each control to IRA once; it serves every team.
AP control, AR and revenue assurance, reconciliation and AI-led dashboards are live. Record to report, the vendor query assistant and treasury are in early access.
IRAME is building passenger and cargo revenue audit for a Gulf national airline group, hosted in its home region.
Medhara by IRAME, in early access, reads everything IRA finds and tells the CFO what to act on first.
Plain summaries, not legal advice.
| Rule | What it asks |
|---|---|
| UAE PDPL | Federal Decree-Law No. 45 of 2021 sets rules for personal data in the UAE. |
| Saudi PDPL | Saudi Arabia's Personal Data Protection Law is enforced by SDAIA. |
| Qatar PDPPL | Law No. 13 of 2016 sets rules for personal data in Qatar. |
| SAMA | The Saudi Central Bank sets governance, internal audit and cyber rules for banks and insurers. |
| CMA | Saudi listed companies keep an internal control system and an audit committee. |
| NCA | The Essential Cybersecurity Controls apply to government bodies and critical infrastructure. |
| DIFC | DIFC Data Protection Law No. 5 of 2020 covers firms in the DIFC. |
| ADGM | The ADGM Data Protection Regulations 2021 cover firms in ADGM. |
IRAME runs in a UAE, Saudi or Qatar cloud region, in IRAME's cloud or your own tenancy, or on-premise with on-premise AI models.
When IRAME runs in your environment, the data stays there.
The AI model endpoint runs in the same region. Customer data never trains a model.
Access can be limited to your own virtual desktop (VDI).
SOC 2 Type II audited, ISO/IEC 27001:2022 certified, independently VAPT tested.
Write to sales@irame.ai with the process you want tested. We will show you the controls, the exceptions and the evidence.
Where can IRAME host our data in the Middle East?
IRAME can pin the application, data and AI models to a UAE, Saudi or Qatar cloud region, in line with local data residency rules. It can also run in your own cloud tenancy, or on-premise with on-premise AI models. Customer data never trains a model.
Does IRAME support ICOFR testing?
IRAME's AI, IRA, tests ICOFR key controls on the full population. Each test keeps its evidence, so your external auditor can re-perform it and get the same result.
Does IRAME make us PDPL compliant?
IRAME does not give legal advice or certify compliance. It can run in your own environment, so personal data stays under your control.
How do we start with IRAME in the GCC?
IRAME starts with one process you pick. Write to sales@irame.ai or book a demo, and we will show you the controls, the exceptions and the evidence.
Stop sampling. Let IRA test everything.
Bring one process. In 30 minutes we show you the exceptions IRA finds and the evidence behind each one.