Is an internal audit required by law in the UAE?

Not for most private companies. Listed companies, banks and insurers have their own rules. For everyone else it is a choice, usually made when a bank, an investor or the owner wants to know that the controls actually work.

What is the difference between internal and external audit?

An external audit is an independent opinion on your financial statements, for the license, the bank, the FTA and the shareholders. An internal audit looks at how the company runs, its controls and its risks, and reports to the owner rather than to a regulator. They are separate engagements with separate reports.

Can you do our internal audit if you are also our external auditor?

Only with the work separated: different people, a different engagement letter, and nothing in the internal audit that amounts to running the company's controls for it. Where independence rules do not allow both, we say so before the engagement letter and do one or the other.

What documents do you need?

The policies and procedures that exist, who approves what, the accounting records for the area under review, the list of who can access which system, and the contracts and license conditions the company is bound by. If the books are in Zoho, QuickBooks or Odoo, read access replaces most of that list.

A fixed fee, quoted within one business day of agreeing the area to be reviewed, before any work starts.

Internal audit in Dubai | Control, risk and compliance reviews

What it is

An external audit tests the numbers once a year. An internal audit tests the way the business works.

Whether the controls over cash, purchasing, payroll and stock do what the owner thinks they do. Whether the company keeps to the laws, license conditions and contracts it is bound by. And where money or time leaks out without anyone noticing.

It is for owner-managed companies that have grown past the point where the owner sees every payment. Most private companies in the UAE are not required by law to have one; listed companies, banks and insurers have their own rules. For everyone else it is asked for by a bank, an investor or a new partner, or chosen by an owner who wants to know rather than hope.

The work is done under the Institute of Internal Auditors' Global Internal Audit Standards, in force since 9 January 2025. Each engagement is scoped on its own: one area, one process or one site, agreed in the engagement letter before we start, so the fee and the report stay in proportion to the question.

The three reviews

Three kinds of review are the usual ask.

OperationalWhether a process, purchasing, sales, payroll or stock, does what it should at the cost it should, and where it is wasting money or time.
ComplianceWhether the company keeps to the laws, license conditions and contracts it is bound by: VAT, corporate tax, the licensing authority's rules, the bank's covenants.
Internal controlWhether the controls over cash, approvals, access to systems and the owner's account actually stop the errors and losses they exist to stop, including a risk assessment of where they would fail first.

How an engagement runs

From the first question to the follow-up.

PlanScope and risk assessmentThe area, the risks in it and what will be tested, agreed in the engagement letter
ReviewRecords, policies and walk-throughsHow the process is written down, and how it actually runs
TestThe controls, on real transactionsSamples chosen by us, not handed to us
ReportFindings, each one ratedWhat we tested, what we found and how serious each finding is
AgreeA management action planWho fixes each finding, how, and by when, agreed with you before the report is final
Follow upOn the date agreed in the letterWhat was fixed, and what still needs to be

Independence

Kept apart from the external audit, and never a substitute for management.

Where we sign the audit opinion, the internal audit work is done by different people under a different engagement letter. Where independence rules do not allow both, we say so before the engagement letter and do one or the other.

An internal audit reports on the controls; it does not run them. Deciding what to fix and fixing it stays with the owner and the managers, which is why the action plan names them and not us.

External audit

Questions we are asked

Five straight answers.

01
Is an internal audit required by law in the UAE?
Not for most private companies. Listed companies, banks and insurers have their own rules. For everyone else it is a choice, usually made when a bank, an investor or the owner wants to know that the controls actually work.
02
What is the difference between internal and external audit?
An external audit is an independent opinion on your financial statements, for the license, the bank, the FTA and the shareholders. An internal audit looks at how the company runs, its controls and its risks, and reports to the owner rather than to a regulator. They are separate engagements with separate reports.
03
Can you do our internal audit if you are also our external auditor?
Only with the work separated: different people, a different engagement letter, and nothing in the internal audit that amounts to running the company's controls for it. Where independence rules do not allow both, we say so before the engagement letter and do one or the other.
04
What documents do you need?
The policies and procedures that exist, who approves what, the accounting records for the area under review, the list of who can access which system, and the contracts and license conditions the company is bound by. If the books are in Zoho, QuickBooks or Odoo, read access replaces most of that list.
05
What does it cost?
A fixed fee, quoted within one business day of agreeing the area to be reviewed, before any work starts.

Service

Tell us which part of the business worries you. A scope, a price and a date within one business day.

Get a fixed quote

Internal audit in Dubai: how the company actually runs, reported to the owner.