Internal Audit (UAE)

There is no blanket federal law requiring every mainland or free zone company to maintain an internal audit function. The position differs for DIFC and ADGM entities, particularly those regulated by the DFSA or FSRA — the applicable rulebook for licensed financial services firms in those jurisdictions typically expects an internal audit function proportionate to the firm's size, complexity, and risk profile. For most mainland and other free zone companies (JAFZA, DMCC, RAK ICC, and similar), internal audit is voluntary but frequently driven by bank covenants, investor conditions, or board-level governance decisions rather than statutory obligation.

Statutory audit expresses an independent opinion on whether your financial statements present a true and fair view, for the benefit of shareholders and your licensing authority. Internal audit is a broader, board-facing function that assesses whether risk management, internal controls, and governance processes are designed well and operating effectively — covering financial, operational, compliance, and IT risk, not just the year-end numbers. Most companies with a mature governance structure run both, and they complement rather than duplicate each other.

For the engagement to have real value, internal audit should report to the audit committee or the board — not to the CFO or finance director whose department and controls are being reviewed. This independence is formally documented in the Internal Audit Charter that PNPC drafts at the start of the engagement, and it is the single most important structural decision in the entire exercise.

A typical first cycle — charter, risk assessment, 2–3 prioritised process reviews, and a final report to the board — runs approximately 8–10 weeks from initial scoping conversation to final report. This varies with group complexity, the number of legal entities in scope, and the readiness of the client's data and system access.

Yes. Many UAE companies — particularly those below the size where a dedicated in-house internal audit department is cost-justified — outsource the entire function to an external firm on a recurring annual cycle with quarterly reporting to the audit committee. PNPC structures this as an ongoing retainer rather than a single project, which allows the audit plan to build year-on-year institutional knowledge of the business.

Co-sourcing means the client has an in-house internal audit team or function, and engages PNPC to supplement it — typically for specialist skills the in-house team does not have, such as IT general controls testing, forensic techniques, treasury risk review, or additional capacity during a busy reporting period. It is common for larger groups that want to retain institutional knowledge in-house while accessing specialist external expertise for specific engagements.

The specific scope depends on the risk assessment, but common areas include procurement-to-pay, order-to-cash and revenue recognition, payroll and WPS compliance, treasury and bank reconciliations, inventory and logistics (for trading and manufacturing businesses), contract management, IT general controls and access management, related-party transactions and intercompany flows, and compliance controls around VAT, Corporate Tax positions, and — where relevant — AML/CFT obligations.

Internal audit tests the controls around your VAT and Corporate Tax positions — for example, whether input VAT is being correctly classified, whether related-party transactions are properly documented for transfer pricing purposes, and whether the conditions for any Qualifying Free Zone Person 0% Corporate Tax treatment are being monitored and evidenced on an ongoing basis. It does not replace dedicated VAT return preparation or Corporate Tax compliance and advisory work, which are separate engagements, though findings from an internal audit frequently identify gaps that then feed into that tax advisory work.

EmaraTax is the Federal Tax Authority's current digital portal for VAT and Corporate Tax registration, filing, and correspondence, live since December 2022. During an internal audit, we check that the client's FTA filings and reconciliations are being maintained through EmaraTax correctly and that access to the portal is properly controlled — an outdated reference to an older FTA filing reference in a client's internal procedures is itself a minor finding, since that portal has been superseded.

ESR notification and report filing obligations were discontinued for financial years starting on or after 1 January 2023, under Cabinet Decision No. 98 of 2024. For current and future financial years, ESR is not a live, ongoing filing obligation to test. Where an internal audit engagement covers historical periods before that date, ESR compliance for those earlier financial years may still be relevant, including any outstanding penalties or unresolved notices from that period.

Certain UAE businesses — including real estate brokers/agents, dealers in precious metals and stones, and independent legal/accounting professionals providing specified services, among others — fall within the DNFBP category under Cabinet Decision No. 10 of 2019 and must maintain AML/CFT policies, conduct customer due diligence, and register on the goAML platform. Internal audit tests whether these controls are actually operating — customer due diligence completeness, suspicious transaction reporting discipline, and staff training records — rather than simply confirming a policy document exists.

The Wage Protection System (WPS) is the electronic salary transfer system mandated by the Ministry of Human Resources and Emiratisation (MOHRE) for tracking timely payment of wages to employees through registered UAE banks or exchange houses. Internal audit tests whether payroll processing and WPS submissions are timely, accurate, and properly authorised, since WPS non-compliance can trigger MOHRE penalties and, in serious or repeated cases, restrictions on a company's ability to process new work permits.

Internal audit procedures — particularly data analytics, segregation-of-duties testing, and exception testing — are designed to identify red flags and control weaknesses that could enable fraud, and can and do uncover suspected irregularities. However, internal audit is not itself a forensic investigation. Where a credible fraud indicator is identified, we recommend escalating to a dedicated forensic investigation engagement with a different evidentiary standard, methodology, and (where appropriate) legal counsel involvement, rather than continuing under the standard internal audit scope.

Where the client's systems support it, we run data analytics across the full population of relevant transactions — for example, testing for duplicate payments, unusual vendor master changes, weekend or after-hours system postings, round-sum invoices, and segregation-of-duties conflicts within the ERP access profile — in addition to traditional manual sample testing of walkthroughs and control operation.

PNPC rates each finding by risk level (typically high, medium, or low) based on the likelihood of the control failure occurring again and the potential financial, regulatory, or reputational impact if it does. A high-risk finding is one where a material control is missing or not operating, with meaningful potential impact — for example, no segregation of duties between vendor master creation and payment approval. Ratings drive prioritisation of both the audit committee's attention and management's remediation timeline.

No. Every final report includes an agreed management action plan with named owners and committed remediation dates. PNPC tracks these actions and reports status at each subsequent audit committee cycle, and typically conducts a formal follow-up review 3–6 months later to re-test whether the previously flagged controls have actually been remediated and are operating effectively.

Yes. PNPC operates from offices in the UAE (Dubai) and India (Chennai, Bangalore, Hyderabad), and for groups with cross-border structures we run internal audit engagements that specifically test intercompany transactions, transfer pricing documentation, and related-party disclosure consistency across both jurisdictions under one coordinated engagement — rather than splitting the work between two disconnected advisors who lose context in the handoff.

With management's consent, PNPC shares relevant internal audit findings with the client's external auditor to avoid duplicated testing effort and to flag matters relevant to the year-end statutory audit — for example, a control weakness in revenue recognition that the external auditor would want to factor into their own audit risk assessment. This coordination typically reduces the overall burden on the finance team during year-end audit season.

It can be, but a full internal audit cycle may not be proportionate for a very small business with limited transaction volume and no bank covenant, investor, or regulatory driver. In these cases, a lighter-touch internal controls health check — a focused, one-off review of the highest-risk processes such as cash handling, procurement authorisation, and payroll — is often a more proportionate and cost-effective starting point than establishing a recurring internal audit function.

PNPC's internal audit engagements are led by Chartered Accountants with practising experience across statutory audit, internal audit, and forensic engagements in both the UAE and India since 1986. Where an engagement requires specialist IT audit or data analytics skills, we bring in the relevant specialist as part of the engagement team rather than stretching a generalist auditor beyond their expertise.

PNPC agrees a fixed fee for each defined engagement — whether that is a first-cycle scoping and 2-3 process reviews, an ongoing outsourced internal audit retainer, or a targeted single-process review — confirmed in writing before work begins. Fee depends on the number of legal entities in scope, the complexity and risk profile of the processes under review, and whether data analytics and specialist IT audit skills are required.

Indirectly, yes. Internal audit may identify weaknesses in how related-party transactions are documented, how a Qualifying Free Zone Person's income is tracked and evidenced against the qualifying conditions, or how transfer pricing policies are actually being applied in practice versus how they are documented on paper — all of which are directly relevant to a company's Corporate Tax position under Federal Decree-Law No. 47 of 2022. Where such gaps are found, we recommend they feed into a dedicated Corporate Tax advisory review rather than being left as an internal audit finding alone.

A risk heat-map is a visual summary — typically plotting likelihood against impact — that gives the board a quick, prioritised view of where the organisation's control weaknesses sit relative to each other, before they read the detailed findings. It helps a busy audit committee focus discussion time on the highest-priority items first rather than working through every finding in the order it happened to be written up.

DIFC and ADGM regulated firms operate under the DFSA or FSRA rulebook respectively, which typically expects an internal audit function proportionate to the firm's category and risk profile, and may prescribe specific areas of focus (client money handling, prudential capital adequacy monitoring, conduct risk). A mainland trading company under DED licensing has no equivalent regulator-driven internal audit expectation, so the scope is shaped purely by the board's own risk appetite, bank covenants, or investor requirements rather than a regulatory rulebook.

We discuss draft findings with process owners before finalising the report specifically to correct any factual errors and to reach an agreed, realistic remediation timeline. Where management genuinely disagrees with the risk rating or the recommendation itself (rather than a factual detail), the disagreement and management's rationale is documented transparently in the final report to the audit committee — the board, not the auditor or management alone, makes the final call on residual risk acceptance.

IT general controls — user access management, segregation of duties within the ERP, change management over system configurations, and backup/business continuity arrangements — are a standard component of most internal audit scopes. A deep technical cybersecurity penetration test or vulnerability assessment is a more specialist, separate engagement, though internal audit will review whether such testing has been performed and whether its findings have been actioned.

At minimum annually, at the start of each new audit cycle — but also whenever a significant structural change occurs, such as a new Corporate Tax filing position, a new AML/CFT DNFBP designation, a new bank facility with fresh covenants, or expansion into a new jurisdiction. A risk assessment that is not refreshed continues testing yesterday's risks while missing new exposures the business has taken on.

Cost varies significantly with the number of legal entities in scope, the number and complexity of processes under review, whether data analytics and specialist IT audit skills are required, and whether the engagement is a single project or an ongoing annual retainer. Rather than quoting a generic figure that would be misleading across very different engagement sizes, PNPC scopes each engagement individually and provides a fixed, written fee quote before work begins.

Yes. Lenders and investors increasingly expect to see evidence of a functioning internal control environment and, in many cases, an internal audit report or management letter as part of due diligence. An internal audit review ahead of a facility renewal or funding round can identify and help remediate control gaps before an external party's due diligence team finds them — putting the company in a stronger negotiating position.

Yes, this is frequently one of the highest-priority areas in an internal audit scope for group structures, particularly given the transfer pricing documentation and related-party disclosure requirements introduced under the UAE Corporate Tax regime. Internal audit tests whether related-party transactions are properly authorised, priced on an arm's-length basis where required, and adequately documented to support the company's Corporate Tax position.

A management letter from the external auditor typically flags control observations that came to light incidentally during the statutory financial statement audit — it is a by-product of that audit, not its main purpose, and is usually narrower in scope. An internal audit report is the direct output of a dedicated, independent review specifically scoped to assess risk management, controls, and governance across the areas identified in the risk assessment — broader in scope and intent than an audit by-product.

Where PNPC provides both internal audit and other services (accounting, tax advisory) to the same client, we structure the engagement teams separately and document the independence safeguards in the Internal Audit Charter and engagement letter — the internal audit team does not review its own work product from another service line without appropriate safeguards, and we discuss any potential conflict transparently with the client's board before accepting the engagement.

We flag this immediately to the audit committee and recommend the client's tax advisor (PNPC or otherwise) assess whether a voluntary disclosure to the Federal Tax Authority via EmaraTax is appropriate to correct the error, given that timely voluntary disclosure is generally treated more favourably than an error later identified through an FTA audit or enforcement action.

Internal audit scales to the size and complexity of the business. A mid-sized UAE company with growing headcount, multiple free zone or mainland entities, bank facilities, or investor involvement is often exactly the profile where internal controls have not kept pace with growth — making a proportionate, risk-based internal audit review particularly valuable, well before the company reaches the scale where a large corporate would typically establish the function.

PNPC brings decades of practising Chartered Accountancy experience across both the UAE and India, giving genuine cross-border coordination for group structures rather than a handoff between disconnected firms. Unlike a large network firm, our engagement teams are led by partners directly involved in scoping, fieldwork, and board reporting — not delegated substantially to junior staff with limited partner oversight. Unlike a low-cost generic provider, we scope from a genuine risk assessment specific to your business rather than a templated checklist, and we build in follow-up review as standard rather than treating the final report as the end of the engagement.

A first-cycle engagement is usually staffed with a partner or director for scoping, charter drafting, and the final board presentation, plus one or two seniors for fieldwork — process walkthroughs, control testing, and draft findings work. Specialist resources (IT audit, data analytics) are added only where the risk assessment identifies a genuine need for that skill set, rather than being bundled into every engagement by default.

Where full-population data analytics are in scope — testing for duplicate payments, unusual vendor master changes, or segregation-of-duties conflicts — a clean, complete data extract for the review period is usually sufficient and preferred over live read-only access, since it avoids any risk of the audit team inadvertently changing production data. Live read-only access is occasionally requested for walkthrough purposes, always agreed explicitly in the engagement letter and access arrangements.

Where the client's ERP or accounting system cannot readily produce a clean transaction-level extract, PNPC falls back to structured manual sample testing based on statistically reasoned sample sizes rather than pretending full-population analytics occurred. This is flagged transparently in the final report as a scope limitation, and often becomes a recommendation in itself — poor system reporting capability is frequently a control weakness worth reporting on its own.

Fieldwork is scheduled around process-owner availability, typically requiring a few hours of walkthrough time per process from each relevant staff member plus document/system access, rather than a continuous on-site presence. For most mid-sized UAE businesses, a first-cycle engagement's fieldwork can be completed with a handful of scheduled sessions per process rather than an extended embedded presence that disrupts daily operations.

Much of an internal audit engagement — document review, data analytics, draft findings discussion, and even walkthroughs where screen-sharing is practical — can be conducted remotely. Certain elements benefit materially from an on-site presence: physical inventory or asset verification, observing segregation of duties in a warehouse or retail environment, and the final board presentation, which we generally recommend delivering in person where feasible.

We test whether the loan is properly authorised under the delegation of authority matrix, documented with formal loan terms and interest treatment consistent with arm's-length pricing expectations under the UAE Corporate Tax related-party rules, and correctly reflected as a related-party transaction in both the UAE entity's and the Indian entity's books. Gaps here are flagged as a priority finding given the direct Corporate Tax and transfer pricing exposure on the UAE side.

A design deficiency means the control itself is inadequate even if performed exactly as intended — for example, an approval limit that lets one person authorise both the purchase order and the payment. An operating deficiency means the control design is adequate on paper but is not actually being performed consistently in practice — for example, a required three-way match that is regularly skipped under time pressure. The two require different remediation: design deficiencies need a policy or system change, operating deficiencies need enforcement, training, or workload correction.

Yes, vendor master file integrity is a standard component of procurement-to-pay testing — we check who can create or amend a vendor record, whether new vendors require independent verification (bank account confirmation, trade licence check, sanctions screening where relevant), and whether historical vendor master changes show any unusual patterns such as changes shortly before a large payment run.

Yes, cash-handling and till reconciliation controls are a common focus area for multi-outlet retail and F&B clients — testing includes till count versus system reconciliation, manager override authority for discounts/voids, cash deposit timing and custody, and whether outlet-level exceptions are escalated and reviewed centrally rather than resolved locally without visibility.

We coordinate with the external auditor, with management's consent, specifically to avoid duplicating tests already performed for the statutory audit — internal audit typically goes deeper on operational effectiveness and root cause than a statutory audit's control reliance testing, so genuine overlap is usually limited, but where it exists we scope around it to reduce the burden on the finance team.

We treat the free zone entity and the mainland branch as related but distinct licensing and regulatory profiles — testing whether intercompany transactions between them are properly documented, whether each maintains the records its specific licensing authority requires, and whether Qualifying Free Zone Person conditions (if claimed) are being tracked with the discipline the Corporate Tax regime requires, since mixing mainland and free zone activity incorrectly can jeopardise the 0% qualifying income treatment.

We can share an anonymised excerpt of a prior internal audit charter and a redacted sample findings format during the scoping conversation, so the board or owner understands what the deliverable actually looks like before signing the engagement letter. We do not, however, hand over a generic full template for self-service use, since a charter and findings report only have value when built around your specific entity structure and risk profile.

For a pure holding company, the internal audit scope shifts toward governance of the group's investment and intercompany activity — board minute quality and authorisation for major decisions, intercompany loan and guarantee documentation, consolidation and related-party disclosure accuracy, and oversight controls over the operating subsidiaries — rather than transaction-level testing of procurement or payroll, which sits at the operating-entity level instead.

Common red flags include inventory shrinkage not reconciled to a documented cause, customs declarations that don't tie to purchase invoices or the importer/exporter code registration, credit terms extended to related parties outside normal approval limits, and unusual patterns in freight-forwarder or customs-agent selection without a documented vendor approval process.

Spreadsheet-based environments require a different testing approach — we focus heavily on version control (is there one authoritative file or several competing copies), formula integrity (are formulas being overwritten with hardcoded values), access control (who can edit versus view), and reconciliation discipline, since the absence of system-enforced controls means procedural discipline is doing all the work that an ERP's access controls would normally do.

Internal audit typically reviews insurance as a risk-management control point — whether coverage levels are periodically reassessed against actual asset values and operational risk, whether renewal decisions are documented and approved at an appropriate level, and whether claims history reveals a recurring operational weakness (for example, repeated inventory loss claims pointing to a warehouse security gap) — rather than assessing whether the specific policy terms themselves are commercially optimal, which is an insurance broker's role.

Findings are reported factually and risk-rated on the same basis regardless of who is involved — the Internal Audit Charter's independence provisions exist precisely to protect this. Where a finding involves a senior individual, we document it directly to the audit committee or board rather than softening it in discussion with the individual concerned, and we discuss escalation sensitivities candidly with the board chair before the finding is finalised, particularly in family-owned structures where a shareholder may also hold an operational role.

Where a business holds client money — real estate escrow accounts, law firm client accounts, or similar fiduciary arrangements — internal audit specifically tests segregation of client funds from company operating funds, reconciliation frequency and independence, and whether the relevant regulator's client-money rules (RERA escrow requirements for real estate, or DFSA/FSRA client-money rules for regulated firms) are being evidenced, not just assumed to be followed.

Post-acquisition, we typically prioritise testing whether the acquired entity's controls, chart of accounts, and approval matrix have actually been integrated into the group's standards — rather than left running on the target's legacy (and often less rigorous) processes — and whether opening balance sheet items and any completion accounts adjustments were properly supported and reconciled.

Yes — for entities where governance maturity is part of the risk assessment (family businesses professionalising ahead of investment, DIFC/ADGM regulated firms), we review whether board and audit committee minutes evidence genuine discussion and decision-making on material matters, rather than being a brief formality, and whether conflicts of interest and related-party approvals are properly disclosed and minuted.

A focused, single-process pilot review — commonly procurement-to-pay or payroll/WPS, since these are usually the highest-materiality, highest-risk processes — lets the board see the quality and format of an actual internal audit deliverable before committing to a broader annual plan or an outsourced function retainer.

Where contract management is in scope, we test whether customer and supplier contracts are reviewed and approved within delegated authority limits, whether key commercial terms (payment terms, penalty clauses, termination rights) are consistently tracked against what is actually being invoiced or paid, and whether contract renewal dates are monitored so the business doesn't inadvertently auto-renew on unfavourable terms.

For a business preparing its first Corporate Tax return, internal audit focuses on whether the underlying accounting records, related-party transaction documentation, and Qualifying Free Zone Person analysis (where relevant) are actually capable of supporting the return before it is filed. For a business several cycles in, the focus shifts to whether positions taken in prior returns have been consistently applied and whether the seven-year record retention requirement under Federal Decree-Law No. 47 of 2022 is being met in practice, not just assumed.

Internal audit can flag where intercompany transactions, shared cost structures, or common control between UAE entities suggest a VAT group registration under Federal Decree-Law No. 8 of 2017 may simplify compliance and cash flow — but the decision itself, and the formal VAT group registration application via EmaraTax, sits with dedicated VAT advisory work, not internal audit itself.

We address resistance directly and early — reminding the finance team that internal audit exists to strengthen the control environment they operate within, not to catch individuals out, and that draft findings are always discussed with process owners before finalisation specifically so factual context isn't missed. Where resistance persists, we escalate transparently to the audit committee, since a finance team actively obstructing evidence access is itself a governance matter the board should know about.

Both — we confirm the documents exist and are current, and then test actual transactions against them: does the person who approved this purchase order actually hold that authority level under the matrix, does the reporting line on the org chart match who actually reviews and signs off in practice. A delegation of authority matrix that exists on paper but is routinely overridden in practice is one of the most common findings in a first-cycle review.

The review period is agreed at scoping and is usually the most recently completed financial year or the trailing twelve months, though specific higher-risk items — an unusual related-party arrangement, a prior control incident — may be traced back further where relevant to understanding the full pattern. We do not default to reviewing multiple years of transaction detail across every process, since that materially increases cost without proportionate additional assurance value for most engagements.

A genuinely clean report — where testing finds controls designed and operating well across the reviewed scope — is a legitimate and valuable outcome, not a sign of a weak review; it gives the board real assurance and is useful evidence for a bank, investor, or regulator. We document the specific tests performed and the sample sizes used regardless of outcome, so a clean result is demonstrably the product of real testing rather than a lack of scrutiny.

Where a company has a history of WPS submission delays or MOHRE penalties, payroll and WPS testing is elevated in priority within the risk-ranked audit universe, and the review specifically traces recent submissions against the underlying payroll register and bank payment records to confirm whether the root cause (system issue, cash flow timing, administrative error) has actually been addressed rather than assuming a penalty payment alone resolved the underlying control gap.

Yes, where a whistleblower or grievance channel exists (a requirement or best practice for DIFC/ADGM regulated firms and increasingly common for larger mainland groups), internal audit tests whether reports received are logged, investigated, and closed out with a documented outcome, and whether the channel is genuinely accessible and known to staff rather than existing only in a policy document nobody has seen.

We test whether management or service fee charges from an overseas (commonly Indian) parent to the UAE entity are supported by an actual service agreement, are priced consistently with an arm's-length rationale, and are recognised consistently in both entities' books — since undocumented or inconsistently applied management fees are a recurring source of both Corporate Tax related-party scrutiny and inter-company reconciliation discrepancies.