Audit evidence UAE requirements explained for finance teams

What is audit evidence in the UAE?

Audit evidence is the information your external auditor collects to form an opinion on your financial statements. In the UAE, audit evidence must follow International Standards on Auditing (ISA), mainly ISA 500. It includes invoices, contracts, bank statements, ledgers, confirmations, and management explanations. The evidence must be sufficient in quantity and appropriate in quality.

Understanding audit evidence UAE requirements helps you prepare records that satisfy your auditor, the Federal Tax Authority (FTA), and the Ministry of Finance (MoF). This guide explains the rules, the documents auditors ask for, and how to organise them. For a wider view, see our hub on Auditing in the UAE.

The legal and professional basis for audit evidence in the UAE

UAE auditors apply ISA, issued by the International Auditing and Assurance Standards Board. The MoF requires licensed auditors to follow these standards. ISA 500 covers audit evidence. ISA 230 covers audit documentation. ISA 315 covers risk assessment, which drives what evidence is collected.

Beyond ISA, UAE companies face local rules. The Commercial Companies Law sets audit obligations for mainland firms. Free zones often add their own audit filing rules. Tax law adds record-keeping duties under VAT and corporate tax. Read more on UAE Audit Standards ISA and UAE Commercial Companies Law Audit Clauses.

Who sets the rules in practice

• MoF: licenses and supervises auditors in the UAE.
• FTA: requires records that support VAT and corporate tax filings.
• Free zone authorities: set filing deadlines and accepted auditor lists.
• Audit firms: apply ISA when planning and executing fieldwork.

What makes audit evidence sufficient and appropriate

ISA 500 uses two words that drive every audit decision: sufficient and appropriate. Sufficient relates to quantity. Appropriate relates to quality. Quality has two parts: relevance and reliability.

Sufficiency

Sufficiency depends on the risk of material misstatement. Higher risk means more evidence. For a cash sale at a retail outlet, a few sampled receipts may be enough. For a related party loan of AED 5,000,000, the auditor will want the loan agreement, board minutes, bank transfers, and confirmation from the counterparty.

Appropriateness

Relevance asks whether the evidence addresses the assertion being tested. Reliability depends on the source. A bank confirmation sent directly to the auditor is more reliable than a screenshot from a finance team member. Original documents beat photocopies. External evidence beats internal evidence.

Types of audit evidence UAE auditors collect

UAE auditors use seven main procedures under ISA 500. Each produces a different kind of evidence. The table below summarises them with a UAE example.

Reliability ranking, from highest to lowest

1. External evidence obtained directly by the auditor.
2. External evidence held by the client.
3. Internal evidence with strong controls behind it.
4. Internal evidence with weak controls.
5. Oral inquiry alone, which is rarely enough.

Records UAE businesses must keep for an audit

UAE law sets minimum record retention periods. The audit team builds on these records. If you cannot find a document, the auditor may treat the area as high risk and expand testing.

Tax records

For VAT, the FTA requires retention of tax invoices, credit notes, import and export documents, and VAT return workings. The standard retention period is five years, longer for real estate transactions. For corporate tax, records must support taxable income calculations for at least seven years after the relevant tax period.

Accounting records

The UAE Commercial Companies Law requires companies to keep accounting records for at least five years from the end of the financial year. Records must show transactions clearly and allow preparation of financial statements that comply with International Financial Reporting Standards. Read more on IFRS UAE Companies Must Follow.

Other records auditors ask for

• Trade licence and shareholder register.
• Board and shareholder meeting minutes.
• Lease and tenancy contracts (Ejari).
• Loan agreements and bank facility letters.
• Employee contracts, WPS records, and end of service calculations.
• Insurance policies and asset registers.
• AML compliance files where the business falls under DNFBP rules.

How auditors test internal controls and evidence together

Strong internal controls reduce the amount of substantive testing the auditor must do. Weak controls push the auditor towards more sampling and direct verification. The auditor documents control walkthroughs, control testing results, and any deficiencies.

If your accounts payable team has no segregation of duties, the auditor may test every large supplier payment rather than a sample. That makes the audit longer and more expensive. For a deeper look, see our guide on Internal Control Audit UAE.

Documentation under ISA 230

ISA 230 requires the auditor to prepare working papers that let an experienced auditor, with no prior knowledge of the engagement, understand the work done. These working papers must be assembled within 60 days of the auditor's report date and retained for at least 5 years. UAE firms often retain papers for longer to meet local supervisory requests.

Special evidence areas in the UAE context

VAT evidence

The FTA expects tax invoices to meet specific format rules under Federal Decree-Law 8 of 2017 and its executive regulations. Auditors test a sample of invoices for compliance, including TRN (Tax Registration Number), Arabic content, and correct VAT treatment of zero-rated or exempt supplies.

Corporate tax evidence

Under Federal Decree-Law 47 of 2022, businesses pay 0% corporate tax up to AED 375,000 of taxable income and 9% above. Large multinationals with global revenue of EUR 750M or more pay a 15% Domestic Minimum Top-up Tax (DMTT) from January 2025. Auditors test the calculation of taxable income, qualifying free zone person (QFZP) status, and any small business relief claimed on revenue up to AED 3,000,000 through 2026.

E-invoicing evidence

The UAE is moving to a Peppol 5-corner Decentralized Continuous Transaction Control and Exchange (DCTCE) model in the PINT AE format. Phase 1 mandates go-live on January 1, 2027 for businesses with revenue of AED 50,000,000 or more. ASP (Accredited Service Provider) appointment is due by October 30, 2026. Small and medium businesses follow on July 1, 2027. Auditors will increasingly check whether your invoicing flow matches the e-invoicing records.

AML evidence

If you are a Designated Non-Financial Business or Profession, you must keep AML files, suspicious activity reports, and customer due diligence records. The audit covers compliance with these duties. See AML Audit Requirements UAE.

Common evidence problems and how to avoid them

Penalties and consequences of weak audit evidence

If audit evidence is poor, the auditor may issue a modified opinion. There are several types, ranging from qualified to adverse to disclaimer. The wrong opinion can affect bank facilities, tenders, and shareholder confidence. See Audit Opinion Types for the full list.

Tax penalties apply when records are missing. Under FTA rules, failing to keep records can lead to fines starting at AED 10,000 for the first offence. E-invoicing penalties under Cabinet Decision 106 of 2025 range from AED 2,500 to AED 50,000 per violation. For official guidance, see the UAE Federal Tax Authority and the UAE Ministry of Finance.

A simple checklist before your auditor arrives

1. Close the trial balance and lock the period.
2. Reconcile every bank account to the statement.
3. Pull all tax invoices and credit notes for the year.
4. Print or export the general ledger and sub-ledgers.
5. Gather contracts: leases, loans, key customer and supplier deals.
6. Prepare a fixed asset register with additions and disposals.
7. List related party balances and transactions.
8. Document any unusual or one off entries.
9. Confirm the year end stock count plan.
10. Save board minutes, shareholder resolutions, and trade licence updates.

If you want a broader plan for the year ahead, our Auditing in the UAE hub walks through standards, deadlines, and filing rules step by step.

How EInvoice Direct supports your audit evidence

Clean e-invoicing data makes audit evidence easier to find. EInvoice Direct stores every UAE tax invoice in PINT AE format with a full audit trail, so your auditor can sample invoices directly. An accredited service provider is included at no extra charge. To see how this fits your firm, get UAE e-invoicing pricing.