Information Systems / Information Security Audit (UAE)

It is an independent review of how well your organisation's IT systems, data, and cyber security controls are actually working — not just what your policies say should happen. An IS/IT security auditor examines who has access to what, how changes to systems are approved and tracked, how data is protected, and how prepared the organisation is to detect and respond to a security incident. The result is a report to management and the Board setting out weaknesses, their business risk, and what to fix first.

No, there is no single UAE federal law mandating a stand-alone IS/security audit for every business. The obligation, where it exists, typically comes from your specific regulator, sector, or contractual relationship: Central Bank-regulated banks, finance companies and insurers operate under supervisory expectations for IT governance and cyber resilience; DIFC and ADGM entities have their own data protection compliance obligations under the applicable free zone data protection law; and many businesses commission the audit because a bank, investor, or major customer requires evidence of security controls as a condition of doing business.

Yes. UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data is the UAE's federal personal data protection law, establishing principles for lawful processing, data subject rights, and obligations on data controllers and processors. Separately, DIFC and ADGM — as financial free zones with their own civil and commercial law frameworks — each maintain their own data protection regime (the DIFC Data Protection Law and the ADGM Data Protection Regulations respectively) that applies to entities registered in those zones. An IS/security audit typically assesses whether your actual data handling practices align with whichever regime applies to your entity.

Your financial statement auditor tests IT general controls only to the extent they support the integrity of financial reporting — for example, who can post journal entries or change supplier bank details in the ERP. That work is embedded in the financial audit and is not usually reported separately. An IS/IT security audit goes much broader and deeper: it covers the full information security posture — network security, data protection, cloud and vendor risk, incident response readiness — and produces its own dedicated report to management and the Board, independent of the financial statement audit opinion.

The UAE Central Bank issues guidance and supervisory expectations around information security, technology risk management, and outsourcing arrangements for banks, finance companies, and other regulated financial institutions. An IS/security audit for a Central Bank-regulated entity is typically scoped to map findings against those specific regulatory expectations, in addition to general good-practice frameworks like ISO/IEC 27001 or the NIST Cybersecurity Framework, so the report is directly useful in your supervisory engagement.

DIFC entities are subject to the DIFC Data Protection Law, administered by the DIFC Commissioner of Data Protection, which includes registration and ongoing compliance obligations around how personal data is processed and protected. While the DIFC regime does not necessarily mandate a specific 'IT security audit' by name, demonstrating adequate technical and organisational security measures is part of compliance, and many DIFC entities commission an independent review to evidence this, particularly ahead of a DIFC Commissioner inquiry or as part of good governance practice.

Yes. ADGM has its own Data Protection Regulations, administered by the ADGM Registration Authority / Office of Data Protection, applicable to entities established in ADGM. As with DIFC, the regulation focuses on lawful processing and data subject protections, and an independent IS/security audit is a common way for ADGM entities to demonstrate that their technical and organisational security measures are adequate.

The framework depends on your driver and sector. Common baselines include ISO/IEC 27001 (the international information security management standard), the NIST Cybersecurity Framework, and — for regulated financial entities — the applicable UAE Central Bank information security and technology risk guidance. Where a customer contract specifies a particular standard (for example, requiring evidence broadly consistent with SOC 2 trust services criteria), we incorporate that into scope as well.

For a mid-sized single-entity business, a realistic timeline is 6–8 weeks from scoping to final report, assuming reasonable availability of client IT personnel and access to systems/evidence. Larger groups, multi-entity structures, or Central Bank-regulated institutions typically require a longer, phased approach, scoped and quoted individually based on the number of systems and locations involved.

We review the current user access listing for each in-scope system, test whether access levels match job roles (least-privilege principle), check for dormant or orphaned accounts belonging to former employees, examine evidence of periodic access reviews (not just the policy requiring them), and test segregation-of-duties conflicts in financial systems — for example, whether the same user can both create a vendor and approve a payment to that vendor.

Not by default. An IS/security audit primarily assesses control design and operating effectiveness through walkthroughs, configuration review, and evidence testing. Penetration testing and vulnerability scanning are specialised technical testing engagements that actively attempt to exploit weaknesses in specific systems. PNPC can coordinate a penetration test as a complementary engagement — either performed by our technical partners or reviewed as part of your existing test results — but it is scoped and quoted separately from the core IS audit.

Yes, arguably more so. A cloud-first environment shifts some infrastructure risk to the vendor but does not eliminate your organisation's responsibility for access management, data classification, vendor due diligence, and data residency/cross-border transfer compliance. We assess your shared-responsibility understanding with each cloud vendor, review the vendor's own security certifications and contractual commitments, and test your organisation's side of the access and configuration controls within those platforms.

IT general controls are the foundational controls that support the reliable operation of all systems — access management, change management, backup and recovery, and physical/environmental security. Application controls are controls embedded within a specific application to ensure accurate and complete processing of transactions — for example, a three-way match control in the ERP between purchase order, goods receipt, and invoice before payment is released. Application controls depend on the underlying ITGCs being sound; weak ITGCs can undermine even well-designed application controls.

PNPC's IS/security audit report is addressed to management and the Board/Audit Committee, not automatically filed with a regulator. Whether and how findings need to be reported externally depends on your specific regulatory relationship — for example, a Central Bank-regulated entity may have its own obligation to disclose material control weaknesses to its supervisor, separate from our reporting to you. We help clients understand this distinction and, where relevant, coordinate with legal or compliance advisors on external notification obligations.

In many cases, yes, subject to an independence assessment specific to the engagement — particularly checking that PNPC has not been involved in designing or implementing the very controls being tested, which would create a self-review threat. Where such a conflict exists, we either adjust the scope, bring in an independent reviewer for the conflicted area, or decline that specific piece of work while continuing other engagements.

The report typically includes an executive summary for the Board/Audit Committee, the scope and approach taken, detailed findings organised by control area (access management, change management, network security, data protection, business continuity, incident response), a risk rating for each finding based on likelihood and business impact, root cause analysis, and an agreed remediation roadmap with target timelines and named owners from the client's IT team.

Cost depends heavily on the number of systems in scope, the complexity of your IT environment, whether the engagement is single-entity or multi-entity/multi-jurisdiction, and whether specific regulatory frameworks (Central Bank guidance, DIFC/ADGM regimes) apply. PNPC provides a written scope and fixed fee proposal after an initial scoping conversation — we do not quote a generic figure before understanding your environment, because doing so either underestimates the work needed or overcharges a simpler engagement.

Immediately after an incident, a focused post-incident review — root cause analysis of exactly what happened, how the control failed, and what needs immediate remediation — is usually the right first step, not a full-scope audit. A broader IS/security audit is valuable afterward, once immediate fixes are in place, to check whether the same weakness exists elsewhere in the environment and whether other control areas need attention.

Yes. We review the backup policy, schedule, and retention settings, and — importantly — look for evidence that a restore or recovery test has actually been performed recently, not just that backup jobs are running. We also assess whether documented recovery time objectives (RTO) and recovery point objectives (RPO) are realistic given the business's actual tolerance for downtime and data loss.

Segregation of duties is the principle that no single individual should control all stages of a critical transaction — for example, creating a vendor, approving a purchase order, and authorising payment to that vendor. Where one person can perform all three, the risk of fraud or error goes up significantly and is very hard to detect. UAE ERPs, especially in fast-growing mid-market businesses, often have segregation-of-duties conflicts that accumulated as access was granted informally over time.

It can, if scoped in. Customer-facing applications introduce additional considerations — authentication design, session management, API security, and how customer personal data is collected, stored, and protected. We include these in scope where the business has a customer-facing digital platform handling meaningful data or transaction volume, and can bring in specialist application security testing where deeper technical testing is warranted.

Where a Board or Audit Committee exists, they are typically the ultimate recipient of the IS/security audit report, responsible for overseeing that management takes appropriate remediation action and that recurring findings are addressed structurally rather than repeatedly patched. PNPC can present findings directly to the Audit Committee and support them in framing follow-up questions to management.

Yes. Many UAE SMEs and privately-held businesses commission an IS/security audit without a formal Audit Committee structure — the report is simply addressed to the owners, managing director, or senior management team responsible for IT risk oversight. The value of the exercise does not depend on having a formal committee structure in place.

There is an indirect but real connection: IT general controls over your accounting/ERP system directly affect the reliability of the financial data used for UAE Corporate Tax computations (9% on taxable income above AED 375,000, with a 0% regime for Qualifying Free Zone Persons meeting the conditions) and VAT filings through the Federal Tax Authority's EmaraTax portal. Weak access or change controls over the general ledger or invoicing module increase the risk of errors or unauthorised changes that could distort tax filings.

EmaraTax is the Federal Tax Authority's current digital tax administration portal, used for VAT and Corporate Tax registration, filing, and correspondence, live since December 2022 (replacing the FTA legacy platform). It is not itself a system PNPC audits under an IS/security engagement, but where a business's internal systems feed data into EmaraTax filings, the integrity of those upstream systems is relevant context we consider when scoping.

No, not directly, and it is worth clarifying: ESR notification and report filing obligations were discontinued for financial years starting on or after 1 January 2023, under Cabinet Decision No. 98 of 2024. For financial years before that date, historical ESR filings may still be relevant to a company's compliance record, but ESR is not an ongoing live filing obligation for current financial years and does not form part of an IS/security audit scope.

Where relevant to the client's sector — particularly Designated Non-Financial Businesses and Professions (DNFBPs) and financial institutions subject to AML/CFT obligations — we can assess whether IT systems supporting customer due diligence, transaction monitoring, and goAML reporting have adequate access controls and data integrity safeguards. This is scoped in specifically rather than assumed as a default component, since AML/CFT compliance itself is a distinct regulatory workstream from general IT security.

We still audit the effectiveness of controls regardless of who operates them — the fact that IT is outsourced does not remove the organisation's responsibility for oversight. We review the service provider's SLA, security certifications, and the client's own vendor management and oversight process, and, where access allows, test controls directly with the service provider's cooperation.

Yes. Many of the control areas we test — access management, risk assessment, incident response, business continuity — map closely to ISO/IEC 27001's Annex A controls. An IS/security audit can serve as a useful readiness assessment before engaging an accredited certification body, helping identify and close gaps in advance rather than discovering them during the formal certification audit.

Annually is common for regulated financial institutions or businesses with significant data sensitivity, given evolving threats and system changes. Biennially can be appropriate for lower-risk, more stable environments. Trigger-based reviews — after a major system change, security incident, or ahead of a facility renewal or major customer contract — are advisable regardless of your standing cycle.

Fieldwork is designed to minimise disruption — most testing involves reviewing configuration screens, evidence, and logs alongside your IT team rather than making changes to live systems. Where any testing could touch production systems (for example, sampling live transactions), we coordinate timing with your IT team in advance to avoid impacting business operations.

Access that was appropriate when granted but never reviewed or revoked as roles changed — former employees with active accounts, staff retaining access from a previous role after an internal transfer, and segregation-of-duties conflicts in the ERP that accumulated informally. These are process gaps, not exotic technical vulnerabilities, and are usually straightforward and low-cost to remediate once identified.

A pure technical security firm may test systems well but often lacks the regulatory and financial reporting context that a Chartered Accountancy firm brings — understanding how IT controls interact with financial statement integrity, Central Bank supervisory expectations, DIFC/ADGM compliance regimes, and Board governance reporting expectations. PNPC's Dubai team combines CA-led assurance methodology with dedicated IT audit expertise, and coordinates with our India offices for any group entities with an India presence.

Yes. PNPC offers remediation tracking support and can perform a follow-up re-test 3–6 months after the report to confirm agreed actions were actually implemented, not just marked complete by management. We also remain available for ad hoc advisory questions as the IT team works through the remediation roadmap.

Yes. PNPC operates from Dubai, Chennai, Bangalore, and Hyderabad, which allows us to coordinate an IS/security audit across a group with both UAE and India entities under a single engagement team — ensuring consistent methodology and a coherent group-level report, rather than two disconnected exercises run by separate local providers.

Typically the Head of IT or IT Manager owns day-to-day evidence requests, but we also need a named business sponsor — usually the CFO, COO, or a director — who can make scope and prioritisation decisions if fieldwork surfaces something unexpected. Where a Compliance Officer or MLRO exists (common in regulated or DNFBP-sector entities), we loop them in for anything touching AML/CFT-relevant systems.

A finding is a control weakness that creates a real, risk-rated exposure — for example, dormant privileged accounts still active six months after an employee left. An observation is a lower-priority hygiene point that does not currently create material risk but is worth improving — for example, a policy document that has not been formally reviewed in three years even though practice is sound. We keep the two clearly separated so management can triage effort correctly.

Where scoped in, yes — we review email security configuration (SPF/DKIM/DMARC records, attachment and link filtering) and can assess whether the organisation runs periodic phishing-awareness simulations for staff. Email remains one of the most common initial-access vectors for UAE mid-market businesses, so we recommend including it even in a leaner-scope engagement.

All evidence reviewed during the engagement — access logs, configuration exports, incident records — is handled under the same professional confidentiality obligations that apply to our statutory audit and tax engagements, governed by our engagement letter and internal data handling policy. Working papers are stored on access-controlled PNPC systems, and evidence is not retained beyond the period required for quality review and regulatory record-keeping.

Much of the evidence review — configuration screenshots, access exports, policy documents, log extracts — can be done remotely via secure file transfer and video walkthroughs. However, we generally recommend at least one on-site session for physical and environmental security review (server room access controls, visitor logs) and for the Board/Audit Committee presentation, where a live discussion is more effective than a video call.

We discuss draft findings with management before the report is finalised, specifically to resolve factual disagreements or additional context we may have missed — for example, a compensating control we were not initially shown. Where a genuine professional disagreement remains after that discussion, we document management's response alongside the finding in the final report rather than simply removing it.

Where the organisation has implemented a PAM solution (vaulting privileged credentials, session recording, just-in-time access), we assess its configuration and actual usage patterns rather than assuming the tool alone solves the risk. Where no PAM tool exists, we assess the manual compensating controls in place — such as shared-account logging and dual-approval for privileged actions — and typically flag PAM adoption as a medium-term recommendation for higher-risk environments.

Post-merger IT integration typically means two sets of access controls, two vendor relationships, and possibly overlapping or conflicting data protection practices during the transition. We scope the audit around the current integration state — identifying which systems have been consolidated, which remain separate, and where integration gaps (duplicate accounts, inconsistent access policies across the two entities) create elevated near-term risk.

Yes, where in scope. Physical and environmental security — server room access restriction, visitor logging, CCTV retention, fire suppression and environmental monitoring for on-premise infrastructure — is a standard IT general control area we assess alongside logical access controls, particularly for businesses retaining any on-premise servers or network equipment.

A management letter point is a lower-severity observation communicated to management alongside — but separate from — the formal risk-rated findings, often relating to documentation gaps, minor process inefficiencies, or good-practice suggestions that do not rise to a control deficiency. We use this format to avoid inflating the formal findings list with items that are genuinely minor, while still ensuring nothing is left unsaid.

Yes. Many UAE businesses are asked to complete detailed vendor security questionnaires by enterprise customers, particularly in banking, insurance, and technology sectors. Where PNPC has recently completed an IS/security audit, we can help management translate the audit findings and remediation status into accurate, defensible questionnaire responses rather than guessing or overstating maturity.

We map the actual hosting and data flow arrangement first — including any intercompany service level agreement or informal arrangement with a related entity — and assess whether the same access, change management, and data protection discipline applies as it would with an unrelated third-party vendor. Related-party IT arrangements sometimes lack the same contractual and security rigour as external vendor relationships, which is itself often a finding.

Not necessarily a full-scope audit — for smaller free zone entities without a specific regulatory or contractual driver, we typically recommend a lighter, risk-focused review covering the highest-impact areas (access to the accounting/ERP system, backup integrity, and basic email/endpoint security) rather than the full multi-week programme designed for larger, more complex environments. Scope should match actual risk and system complexity, not a fixed template.

The evidence requirements are similar in principle — user access listings, role/permission configuration, audit trail/change log exports, and backup evidence — but the specific screens and reports differ by platform. We work with your finance and IT team to identify where each piece of evidence lives within your specific accounting software rather than assuming a generic ERP structure that may not match your actual system.

Our IS audit engagements are led by professionals holding relevant recognised credentials such as CISA (Certified Information Systems Auditor) and, where relevant to the engagement, complemented by staff with security-specific certifications, working alongside our Chartered Accountant-qualified assurance team so the engagement combines both financial control context and dedicated IT audit methodology.

We specifically probe for shadow IT during scoping and fieldwork — unsanctioned cloud storage, messaging apps used for business data, or spreadsheet-based 'systems' that have effectively become critical business tools without IT oversight. Where identified, we assess the data protection and access control exposure created and include it in the findings, because these tools are frequently where sensitive data ends up least protected.

We scope this around actual system boundaries rather than legal entity boundaries — if multiple licensed entities share the same ERP instance and access controls, we typically test the shared system once with entity-specific segregation-of-duties considerations layered in, rather than duplicating identical testing per licence. Where entities run genuinely separate systems, each is scoped and tested independently.

Compiling the documents on our request list in advance — current user access lists, recent change tickets, the last backup restore test evidence, and existing policy documents — is the single biggest driver of a smooth, on-schedule engagement. We also recommend briefly informing relevant IT and business staff that the audit is happening, so requests for logs or walkthroughs are not a surprise mid-engagement.

Yes — this is one of the more common commercial triggers we see. Banks increasingly ask mid-market UAE borrowers for evidence of IT governance and cyber resilience as part of covenant or facility renewal reviews, particularly where the borrower's financial reporting relies heavily on a single ERP system. Our report format can be adapted to address the specific points a lender has raised, rather than a generic audit summary that does not map to the bank's actual questions.

Yes. Our optional follow-up re-testing is typically scoped to the specific findings that were rated highest-risk in the original report, rather than a full repeat of the entire audit. This keeps the follow-up efficient and focused on confirming that the actions management committed to were genuinely implemented.

This is common in UAE SMEs, and it inherently creates segregation-of-duties limitations that cannot always be fully engineered away with a one-person IT function. Where this is the reality, we focus on compensating controls — independent management review of key changes, restricted and logged administrator access, and periodic third-party review — rather than recommending controls that assume a team size the business does not have or need.

A basic configuration review of externally-facing assets (TLS/SSL configuration, exposed admin panels, obvious misconfigurations) can be included where the business has a customer-facing website or portal handling data or transactions. Deeper technical testing of the website's application code and logic is more appropriately handled through a dedicated web application penetration test, which we can coordinate as a complementary engagement.

For a mid-sized single-entity engagement, we typically assign an engagement lead (senior IT audit/CA-qualified professional), one or two fieldwork associates handling detailed evidence testing, and a partner or director providing oversight and presenting to the Board where required. Larger, multi-entity, or Central Bank-regulated engagements are staffed proportionately based on the number of systems and locations in scope.

We do not omit material findings from the written report at management's request — doing so would undermine the independence and integrity of the assurance we are providing, and could expose both PNPC and the client if the omitted issue later causes harm that a regulator or auditor traces back. We are, however, open to discussing how a finding is framed and sequencing of remediation, which is different from removing it.

Yes. PNPC offers a shorter diagnostic-style review — typically one to two weeks — covering the highest-risk areas (access management, backup verification, and basic network security posture) as a lower-cost entry point. This is useful for businesses unsure whether a full audit is warranted, or wanting a preliminary view before committing budget to the complete engagement.