UAE internal audit is not legally mandated for most businesses but is strongly recommended for companies with 50+ employees, multiple related parties, FTA audit history, or free zone + mainland operations. Scope: financial controls, VAT compliance, payroll (WPS, GPSSA), related party transactions, and IT access controls. Can be outsourced to a specialist firm for AED 15,000–50,000/year.
When UAE businesses need internal audit
- FTA audit history: If the FTA has audited you and raised findings — even if settled — internal audit demonstrates remediation and reduces future audit risk.
- Multiple related parties: Group companies, director loans, management fees, and intercompany transactions need ongoing arm’s-length verification. Internal audit provides this assurance independently.
- 50+ employees: At this scale, payroll fraud, expense abuse, and purchase order manipulation become realistic risks. Internal audit deters and detects.
- Free zone + mainland operations: Dual-structure businesses with both QFZP and mainland entities must correctly allocate income and expenses between qualifying and non-qualifying activities. Internal audit verifies this allocation.
- External investor or bank requirements: Lenders and PE investors increasingly require quarterly or annual internal audit reports for UAE borrowers and portfolio companies.
What UAE internal audit covers
| Area | What is reviewed |
|---|---|
| Financial controls | Segregation of duties, authorisation limits, bank signatory controls, payment approval |
| VAT compliance | Output VAT completeness, input VAT eligibility, blocked input tax, return reconciliation |
| CT compliance | Related party arm’s length, expense deductibility, QFZP income allocation |
| Payroll and WPS | WPS SIF reconciliation, GPSSA registration accuracy, off-payroll payment risk |
| Procurement | PO process, three-way matching, supplier concentration, fictitious vendor risk |
| Asset management | Fixed asset existence verification, disposal process, register completeness |
| IT access controls | Accounting system access levels, password policy, bank token security |
In-house vs outsourced internal audit for UAE businesses
Most UAE SMEs do not need a full-time internal auditor. Two practical models:
- Co-sourced model: An external internal audit firm conducts one or two cycles per year. Cost: AED 15,000–50,000 per cycle depending on scope. The firm prepares the audit plan, conducts fieldwork, and delivers a report with findings and recommendations. Best for businesses up to 200 employees.
- In-house: A dedicated internal audit manager or department. Cost: AED 25,000–50,000/month in salary. Only justifiable for businesses with 200+ employees, listed status, or mandatory regulatory requirements (banks, insurance companies).
No internal audit function yet?
We provide co-sourced UAE internal audit — financial controls, VAT compliance, and payroll review. Fixed annual fee.
Frequently asked questions
Is internal audit mandatory in UAE?
Not for most businesses. UAE Companies Law does not require an internal audit function for private companies. However, UAE banks and insurance companies are required by the UAE Central Bank to have internal audit. Listed companies are also expected to have an audit committee and internal audit function under SCA guidelines.
What is the difference between internal audit and external audit in UAE?
External audit: an independent auditor verifies the financial statements are true and fair (statutory requirement for free zone companies). Internal audit: an independent internal function reviews controls, compliance, and risk — not the financial statements themselves. External audit is annual and backward-looking. Internal audit is ongoing and forward-looking.
How much does outsourced internal audit cost in UAE?
AED 15,000–50,000 per audit cycle for an SME engagement. The range depends on scope, number of entities, and complexity (e.g., multiple free zones, related party transactions). Annual retainer models (quarterly reviews) run AED 30,000–100,000/year.
What does an internal audit report include?
Executive summary (overall risk rating and top 3 findings), detailed findings by area (risk level, observation, root cause, recommendation, management response), and a management action plan with owner and deadline for each finding. The report is provided to the board, senior management, and external auditors on request.