# Internal control audit in the UAE explained for finance teams > Internal control audit UAE guide covering scope, COSO framework, ISA 315, testing steps, and reporting for finance teams. See pricing inside. Source: https://einvoicedirect.ae/auditing-uae/internal-control-audit-uae Last updated: 2026-06-05 Publisher: EInvoice Direct (Massive FZCO), UAE e-invoicing software. ## What is an internal control audit in the UAE? An internal control audit UAE is a structured review of the policies, processes, and IT systems a business uses to safeguard assets, produce reliable financial statements, and comply with UAE law. It tests whether controls are designed properly and operating effectively. External auditors use it to plan financial audits, and management uses it to reduce fraud and error. Internal controls are the day-to-day rules that keep a company honest. Think approval limits, segregation of duties, bank reconciliations, and access rights in your accounting system. An internal control audit UAE checks those rules in two ways: design effectiveness and operating effectiveness. It is now central to compliance with VAT, corporate tax, and the upcoming e-invoicing mandate in the UAE. For background on the wider regime, see our hub on [Auditing in the UAE](https://einvoicedirect.ae/auditing-uae). ## Why internal control matters more in 2025 and 2026 Three changes have raised the bar for UAE businesses. Federal Decree-Law 47 of 2022 introduced corporate tax, with a 0% rate up to AED 375,000 of taxable income and 9% above that. VAT at 5% has been in force since January 1, 2018 under Federal Decree-Law 8 of 2017. And the Peppol-based e-invoicing model is rolling out, with large taxpayers going live on January 1, 2027. Every one of those regimes assumes you can produce accurate, traceable records on demand. That only happens with working internal controls. Weak controls now create direct tax risk, not just audit findings. ### Who needs an internal control audit - Mainland LLCs preparing audited financial statements under the UAE Commercial Companies Law. - Free zone companies, especially Qualifying Free Zone Persons (QFZPs) that must keep audited accounts to retain the 0% rate. - Groups within scope of the 15% Domestic Minimum Top-up Tax (DMTT) for multinationals with EUR 750M or more in global revenue, effective from January 2025. - Regulated entities such as DFSA, ADGM FSRA, SCA, and CBUAE licensees. - Designated Non-Financial Businesses and Professions (DNFBPs) under anti-money laundering rules. ## The frameworks UAE auditors use UAE auditors do not invent control criteria. They apply globally recognised frameworks adapted to local law. The two most important are COSO 2013 and ISA 315 (Revised 2019). ### COSO 2013 internal control framework COSO stands for the Committee of Sponsoring Organizations of the Treadway Commission. Its 2013 framework defines internal control across five components: control environment, risk assessment, control activities, information and communication, and monitoring activities. Most UAE audit firms and large corporates map their controls to these five components. ### ISA 315 risk assessment International Standards on Auditing (ISAs) are mandatory for statutory audits in the UAE. ISA 315 requires the auditor to understand the entity and its environment, including its internal control, to identify risks of material misstatement. Read more in our guide to [UAE Audit Standards ISA](https://einvoicedirect.ae/auditing-uae/uae-audit-standards-isa). ### Local law layers On top of these, UAE auditors apply Federal Decree-Law 32 of 2021 (Commercial Companies Law), Federal Decree-Law 47 of 2022 (corporate tax), and Federal Decree-Law 8 of 2017 (VAT). Free zone authorities and the Federal Tax Authority (FTA) add their own record-keeping rules. The official source list is published by the [UAE Ministry of Finance](https://mof.gov.ae) and the [Federal Tax Authority](https://tax.gov.ae). ## The five COSO components, explained simply | Component | What it means | UAE example | | --- | --- | --- | | Control environment | Tone at the top, ethics, board oversight, HR policies. | Documented code of conduct signed by all staff annually. | | Risk assessment | Identifying and analysing what could go wrong. | Annual risk register covering VAT, corporate tax, and AML. | | Control activities | Specific actions that mitigate risks. | Two-person approval for payments above AED 50,000. | | Information and communication | Capturing and sharing relevant data. | Monthly management accounts reviewed by the CFO. | | Monitoring activities | Ongoing checks that controls still work. | Quarterly internal audit testing of key controls. | ## How an internal control audit works step by step An internal control audit UAE follows a predictable path. The auditor plans, walks through processes, tests, and reports. Each step has a clear output. ### Step 1: Planning and scoping The auditor agrees objectives, scope, and timing with management. Scope can be entity-wide or limited to key cycles: revenue, procurement, payroll, treasury, tax, and IT general controls. The plan documents materiality, locations, and assertions covered. ### Step 2: Process understanding The auditor maps each in-scope process using walkthroughs and interviews. Outputs include flowcharts, narratives, and a risk and control matrix (RCM) that lists every risk and the control that addresses it. ### Step 3: Design assessment For each key control, the auditor asks: if this control runs as described, would it prevent or detect the risk? Controls that fail design testing are flagged before any operating testing begins. ### Step 4: Operating effectiveness testing The auditor selects samples and tests whether the control actually ran during the period. Sample sizes depend on control frequency. A daily control typically needs 25 to 40 samples, a monthly control needs 2 to 5, and an annual control needs 1. Evidence gathering follows ISA 500. See [Audit Evidence UAE Requirements](https://einvoicedirect.ae/auditing-uae/audit-evidence-uae-requirements) for the detail. ### Step 5: Deficiency evaluation and reporting The auditor classifies each gap as a deficiency, significant deficiency, or material weakness. A written report goes to management and those charged with governance, with remediation deadlines. ## Common control gaps in UAE businesses Across SME and mid-market clients in the UAE, the same gaps appear repeatedly. Knowing them helps you self-audit before the external team arrives. - One person handling invoicing, collections, and bank reconciliation. - Generic admin logins shared across the finance team. - No formal VAT return review before submission to the FTA. - Manual journal entries posted without independent approval. - Vendor master file edits with no second-person check. - No periodic user access review in the accounting system. - Petty cash counts performed by the custodian only. - Tax invoices missing the Tax Registration Number (TRN) or other mandatory fields. ## Internal control audit deliverables | Deliverable | Purpose | Audience | | --- | --- | --- | | Risk and control matrix | Lists risks, controls, owners, and test results. | Finance, internal audit | | Process narratives and flowcharts | Documents how each cycle actually runs. | Operations, IT, audit | | Deficiency log | Tracks issues by severity and remediation status. | CFO, audit committee | | Management letter | Formal report of findings and recommendations. | Board, shareholders | | Remediation plan | Actions, owners, and deadlines to fix gaps. | Process owners | ## How internal control links to other UAE compliance areas An internal control audit rarely sits alone. The same control failures that trigger audit findings also trigger tax, AML, and corporate law issues. ### Financial statements and IFRS Reliable financial statements depend on reliable controls. UAE companies follow IFRS, with IFRS for SMEs available for smaller entities. See [IFRS UAE Companies Must Follow](https://einvoicedirect.ae/auditing-uae/ifrs-uae-companies-must-follow) for the detail. ### Commercial Companies Law obligations Federal Decree-Law 32 of 2021 requires audited accounts for many entities and sets minimum book-keeping standards. Our guide to [UAE Commercial Companies Law Audit Clauses](https://einvoicedirect.ae/auditing-uae/uae-commercial-companies-law-audit-clauses) walks through the specific articles. ### Anti-money laundering controls DNFBPs and financial institutions must run AML controls including customer due diligence, sanctions screening, and suspicious transaction reporting. Read [AML Audit Requirements UAE](https://einvoicedirect.ae/auditing-uae/aml-audit-requirements-uae) for the obligations. Audit opinions depend on controls