Qiyas has no levels. It has four compliance ratings per standard. The famous five levels belong to NORA, and a lot of entities mix the two up.
The DGA runs two separate instruments on entities. Qiyas checks compliance across 10 perspectives, 24 axes, and 89 standards — with four ratings per standard: full, partial, non-compliance, and not applicable. NORA scores EA practice maturity on five cumulative levels. The two complement each other, but they measure different things: Qiyas judges outputs, NORA judges capability. Mixing them up is the number-one reason unrealistic targets walk into planning meetings.
Two hours with leadership and the operational team. You leave with a clear read on where you stand in both Qiyas and NORA, and a shared understanding of the gap between reality and ambition.
We analyse how the 89 standards spread across the four ratings. The distribution itself tells you far more about structural gaps than the aggregate index ever will.
We pick the NORA target level and the desired Qiyas compliance share, based on starting point, budget, and timeline. No skipping levels.
A single plan that links raising NORA maturity to closing Qiyas gaps. Every step serves both — we do not spend budget in two separate directions.
A review session before each formal verification. We make sure the justifications hold up and the evidence meets reviewer requirements.
We diagnose your current state in Qiyas and NORA at the same time, and deliver a single report with recommendations ranked by impact and cost. Two separate reports usually confuse leadership; one report settles it.
Target levels are built on three realistic factors: starting point, budget, and timeline. We do not sell ambition. An entity at Level 1 or 2 targets Level 3 first — skipping straight to Level 4 creates organisational debt you pay back in the next cycle.
A Saudi team that knows the difference between what the Qiyas guide says and what the reviewer actually accepts at verification. A weak "not applicable" justification gets the standard pulled back as non-compliance — we write justifications that hold up.
No. Qiyas has four states per standard: full, partial, non-compliance, and not applicable. No CMM-style tiers. Entities asking about "Level 3" usually mean NORA, which is a completely different model with five levels.
Qiyas compliance is a per-standard single measure: does the evidence exist or not? NORA maturity is a composite measure of the whole EA practice. One is an output, the other is a capability.
Three factors: starting point, budget, and timeline. Entities at Level 1 or 2 target Level 3 first. Skipping straight to Level 4 creates organisational debt that catches up with you in the next cycle.
It pulls the standard out of the calculation completely — doesn't help or hurt. But the justification has to hold up with the reviewer. A weak justification gets the standard pulled back in as non-compliance.
No. NORA accreditation is available at all five levels and leadership picks the target themselves. Some entities aim for Level 4 voluntarily to align with Vision 2030. Others stop at Level 3, and that is a legitimate call.
A precise diagnostic of what evidence exists and what is missing, a short remediation plan, and a review session before the next verification. From our work: 6 to 10 weeks per standard, longer if the gap is structural.
Theoretically yes, in practice very rare. The gap between the two means outputs without capability — the entity collects evidence before verification and then forgets it. Not sustainable, and it needs real investment in internal practice.
Book a diagnostic session. Two hours is enough to leave with a clear read on where you stand in both Qiyas and NORA, and a realistic target for the next 12 months. The session is free.
Back to all services
