UAE audit standards and the ISA framework explained
What are UAE audit standards (ISA)?
UAE audit standards ISA are the International Standards on Auditing issued by the IAASB (International Auditing and Assurance Standards Board) that licensed UAE auditors apply when auditing financial statements. The UAE Ministry of Economy requires registered auditors to follow ISA, and the standards work alongside IFRS (International Financial Reporting Standards), UAE company law, and tax rules to produce a credible audit opinion.
If you run a UAE company, ISA shapes almost every interaction you will have with your external auditor. It dictates how they plan the audit, what evidence they collect, how they assess fraud risk, and what wording appears in the final report. Knowing the basics helps you prepare faster, reduce auditor queries, and avoid surprises at sign-off. For the wider picture, see our hub on Auditing in the UAE.
Who sets and enforces ISA in the UAE?
Three bodies matter here. The IAASB writes the standards globally. The UAE Ministry of Economy licenses audit firms and requires ISA compliance. The Federal Tax Authority (FTA) and free zone authorities accept audited financials prepared under ISA for tax filings and licence renewals.
The IAASB and ISA
The IAASB publishes the ISA series, the ISQM (International Standards on Quality Management) series, and related ethics guidance. Updates are released regularly, and UAE auditors must apply the latest effective versions on each engagement.
UAE Ministry of Economy
The Ministry of Economy registers audit firms under Federal Law 12 of 2014 on the regulation of the auditing profession. To stay on the register, firms must follow ISA, maintain quality control under ISQM 1, and submit to periodic inspections.
FTA and free zone authorities
The FTA accepts ISA-compliant audited accounts to support corporate tax and VAT (Value Added Tax) positions. Free zones such as DMCC, JAFZA, and ADGM require audited financials, prepared under ISA and IFRS, at annual renewal.
When does ISA apply to your UAE business?
ISA applies whenever a UAE-licensed auditor signs off on your financial statements. Audit obligations are triggered by company law, free zone rules, tax law, and sector regulations. The table below summarises the most common triggers.
| Entity type | Audit required | Standards applied |
|---|---|---|
| Mainland LLC (Commercial Companies Law) | Yes, annual | ISA plus IFRS |
| Free zone company (most zones) | Yes, annual | ISA plus IFRS |
| QFZP (Qualifying Free Zone Person) for corporate tax | Yes, mandatory | ISA plus IFRS |
| Branch of a foreign company | Usually yes | ISA plus IFRS |
| Sole establishment, small revenue | Often optional | ISA if audited voluntarily |
| Listed company (DFM, ADX) | Yes, annual plus interim review | ISA plus IFRS |
For deeper detail on company law triggers, read our guide to UAE Commercial Companies Law Audit Clauses. For accounting framework rules, see IFRS UAE Companies Must Follow.
How ISA is organised
The ISA library is grouped into six families, numbered ISA 200 through ISA 800. Each family covers a stage of the audit. Knowing the structure helps you understand why your auditor asks for certain documents at certain times.
ISA 200 series: general principles
These standards set the overall objectives of an audit, define professional scepticism, and explain the auditor's responsibilities. ISA 200 is the starting point. ISA 210 covers engagement letters, the document that locks in scope and fees before fieldwork begins.
ISA 300 and 400 series: risk and planning
ISA 300 requires a written audit plan. ISA 315 (revised) drives risk assessment, including how the auditor evaluates your internal controls and IT environment. ISA 330 covers the auditor's response to identified risks. If you want to prepare for these procedures, see our article on Internal Control Audit UAE.
ISA 500 series: audit evidence
The 500 series is where most field testing sits. ISA 500 sets the evidence framework. ISA 505 covers external confirmations (the letters sent to your banks and customers). ISA 530 covers sampling. ISA 540 governs accounting estimates, which has grown in importance under IFRS 9 and IFRS 15. Our deep dive on Audit Evidence UAE Requirements walks through what auditors typically request.
ISA 600 series: group audits and other auditors
ISA 600 (revised) covers group audits, including how component auditors in other countries feed into the UAE group audit. This matters for holding companies with subsidiaries in the GCC or beyond.
ISA 700 series: reporting
ISA 700, 701, 705, and 706 govern the audit report itself. ISA 705 covers modified opinions: qualified, adverse, or disclaimer. For a breakdown of what each report wording means, read Audit Opinion Types.
ISA 800 series: special engagements
These cover audits of single financial statements, summary financial statements, and compliance reports. They are less common but used for regulator-specific filings.
The ISA audit cycle in practice
A typical UAE audit runs in four stages. Understanding the cycle helps you know what to expect each month.
1. Engagement and planning
The auditor issues an engagement letter under ISA 210. They then perform risk assessment under ISA 315, which usually means walkthroughs of your sales, purchases, payroll, and treasury cycles. Expect questions about your Chart of Accounts, ERP system, and any related-party transactions.
2. Interim fieldwork
Interim testing covers controls and transactions for the first 9 to 10 months of the year. The auditor will test journal entries, sample invoices, and review reconciliations. If you are subject to anti-money laundering rules, the auditor will also test your AML controls. Our guide to AML Audit Requirements UAE covers what they look for.
3. Year-end fieldwork
Year-end work focuses on the balance sheet: stock counts, debtor confirmations, bank confirmations, and fixed asset verification. ISA 540 procedures on estimates apply here, including provisions, impairments, and fair value measurements.
4. Reporting and sign-off
The auditor drafts the report under ISA 700. Listed companies also get Key Audit Matters under ISA 701. The partner signs after a quality control review under ISQM 1 and ISQM 2.
Key ISA standards UAE finance teams should know
You do not need to memorise the full ISA library. These ten standards drive most auditor requests.
| Standard | Topic | Why it matters to you |
|---|---|---|
| ISA 210 | Engagement terms | Defines scope, fees, and deliverables |
| ISA 240 | Fraud | Drives questions about override of controls |
| ISA 250 | Laws and regulations | Covers VAT, corporate tax, and licensing compliance |
| ISA 260 | Communication with governance | Defines what is reported to your board or owners |
| ISA 315 | Risk assessment | Shapes the volume of testing you face |
| ISA 330 | Response to risk | Determines sample sizes and procedures |
| ISA 500 | Audit evidence | Sets the bar for documents you must provide |
| ISA 540 | Estimates | Covers ECL, impairment, and inventory provisions |
| ISA 570 | Going concern | Requires forecasts and management assessments |
| ISA 700/705 | Auditor's report | Determines the opinion you receive |
Going concern under ISA 570
ISA 570 requires the auditor to assess whether your business can continue operating for at least 12 months from the reporting date. You will need to provide cash flow forecasts, loan covenant calculations, and shareholder support letters where relevant.
Fraud under ISA 240
ISA 240 makes fraud a default risk. Auditors will interview management, test journal entries for unusual patterns, and review estimates for management bias. Honest, prompt answers shorten this work.
ISA and UAE corporate tax
Corporate tax under Federal Decree-Law 47 of 2022 has expanded the role of audited accounts. The headline rates are 0% up to AED 375,000 taxable income, 9% above that, and 15% Domestic Minimum Top-up Tax (DMTT) for large multinationals with global revenue of EUR 750 million or more from January 2025.
Tax returns are due within 9 months of the financial year end. QFZPs (Qualifying Free Zone Persons) must maintain audited financial statements prepared under IFRS and audited under ISA to keep the 0% rate on qualifying income. Small business relief is available for revenue up to AED 3 million through 2026.
ISA quality management: ISQM 1 and ISQM 2
From December 2022, audit firms must operate a System of Quality Management under ISQM 1, and engagement quality reviews under ISQM 2. This is why your auditor cannot simply sign off the day fieldwork ends. The file goes through an independent partner review, which can take one to three weeks for larger or more complex audits.
How to prepare for an ISA audit
A short readiness checklist saves weeks of back and forth.
- Close the books within 30 days of year-end and lock the ledger.
- Prepare a trial balance, general ledger, and supporting schedules for every material balance.
- Reconcile bank, VAT, payroll, and intercompany accounts monthly through the year.
- Maintain a fixed asset register with additions, disposals, and depreciation working.
- Document related-party transactions with contracts and transfer pricing files.
- Keep VAT returns, corporate tax workings, and FTA correspondence in one folder.
- Run a stock count on or near year-end and document the procedure.
- Prepare a 12-month cash flow forecast to support going concern.
- Map your internal controls and keep evidence of control operation (approvals, reviews, reconciliations).
Common ISA audit pitfalls in the UAE
Three issues come up again and again in UAE audits. First, missing or weak audit trails for cash transactions, especially in retail and hospitality. Second, related-party balances without written agreements, which forces the auditor to expand procedures. Third, late or incomplete bank confirmations, which delay sign-off because ISA 505 requires the auditor, not the client, to send and receive confirmations directly.
You can avoid most of these by tightening controls before the year begins, not during fieldwork. Our article on Internal Control Audit UAE covers the control areas auditors test first.
Official sources
For primary references, see the UAE Ministry of Finance and the Federal Tax Authority. For accounting and audit framework recognition, the Ministry of Economy publishes registration rules for auditors and licensed audit firms.
If you also handle e-invoicing readiness, the broader compliance picture includes corporate tax, VAT, AML, and from 2027, mandatory e-invoicing through Peppol. See our hub on Auditing in the UAE for a wider compliance map.
Get UAE compliance support
If your firm advises UAE clients on audit, tax, and e-invoicing readiness, EInvoice Direct includes an accredited service provider (ASP) at no extra charge and integrates with Zoho Books, QuickBooks, Xero, Tally, Sage, SAP, Oracle NetSuite, Microsoft Dynamics 365, and Odoo. To get UAE e-invoicing pricing for your practice, contact our team.
Questions, answered
Are ISA mandatory in the UAE?
Yes. UAE-licensed auditors must apply International Standards on Auditing (ISA) issued by the IAASB on every financial statement audit. The Ministry of Economy enforces this requirement through Federal Law 12 of 2014 on the audit profession. Audit firms also follow ISQM 1 for quality management. ISA-compliant audits are accepted by the FTA, free zone authorities, and banks across the UAE.
What is the difference between ISA and IFRS in the UAE?
ISA covers how auditors do their work: planning, testing, evidence, and reporting. IFRS covers how companies prepare their financial statements: recognition, measurement, and disclosure. A UAE audit applies both. The auditor uses ISA procedures to test financial statements that the company prepared under IFRS. Both are mandatory for most UAE entities, including mainland LLCs and free zone companies.
Which UAE companies must have an ISA audit?
Mainland LLCs under the Commercial Companies Law, most free zone companies, branches of foreign companies, listed companies on DFM and ADX, and Qualifying Free Zone Persons all require annual ISA audits. Regulated sectors like banking, insurance, and DIFC entities have additional requirements. Sole establishments with small revenue may be exempt, but many still audit voluntarily for banking or tax purposes.
How long does an ISA audit take in the UAE?
Most SME audits take 4 to 8 weeks from kickoff to signed report. Larger or group audits can take 3 to 4 months. Time depends on the quality of your books, the speed of bank and customer confirmations, and how quickly you respond to auditor queries. Closing books within 30 days of year-end and reconciling key accounts monthly is the fastest way to shorten the cycle.
What is ISA 315 and why does it matter?
ISA 315 (revised) is the risk assessment standard. It requires auditors to understand your business, controls, and IT environment before testing transactions. Stronger controls usually mean less substantive testing and a smoother audit. Weaker controls trigger larger sample sizes, more documentation requests, and higher fees. ISA 315 is the main reason auditors ask about your processes early in the engagement.
Do free zone companies follow the same ISA rules?
Yes. Free zones including DMCC, JAFZA, DAFZA, ADGM, and DIFC require audited financial statements prepared under IFRS and audited under ISA. Some free zones publish their own auditor approval lists, but the underlying standards are the same. ADGM and DIFC have additional rules for regulated financial services firms, but the ISA framework is the consistent baseline across the UAE.
What happens if an ISA audit produces a qualified opinion?
A qualified opinion means the auditor found a material issue but the rest of the accounts are fair. It is not a clean opinion. Banks may restrict lending, free zones may ask questions at renewal, and the FTA may scrutinise the underlying transactions. Adverse and disclaimer opinions are more serious. Read our guide on audit opinion types to understand the wording your auditor may use.
How often are ISA standards updated?
The IAASB updates ISA regularly. Recent significant changes include ISA 315 (revised 2019, effective 2021), ISA 540 (revised, on estimates), ISA 600 (revised, on group audits, effective 2023), and the ISQM suite (effective December 2022). UAE auditors must apply the latest effective version on each engagement. Ask your auditor which version applies to your current year audit.
Keep reading
IFRS standards UAE companies must follow for financial reporting
IFRS UAE companies must follow covers full IFRS for mainland firms, IFRS for SMEs options, and free zone rules.
Read the guide →Auditing in the UAEUAE Commercial Companies Law audit clauses: a plain English guide
UAE Commercial Companies Law audit clauses cover auditor appointment, records, reports, and shareholder rights.
Read the guide →Auditing in the UAEAML audit requirements in the UAE: what businesses must do
AML audit requirements UAE explained: who must comply, what auditors check, penalties under Federal Decree-Law 20 of 2018, and how to prepare.
Read the guide →This content is informational and does not constitute tax, legal, or financial advice. Consult an FTA-registered tax agent or a licensed UAE audit firm before acting on this information.
Get UAE e-invoicing pricing for your business
Tell us about your setup and we reply with clear pricing within one UAE business day. Accredited ASP included at no extra charge.
Get Pricing →