TRW & Co · Accounting, audit and bookkeeping
How an External Financial Statement Audit Works in the UAE
The external audit process UAE companies follow runs from engagement letter to signed opinion: planning, materiality, fieldwork, completion and a management letter. The UAE layer is legal: who may sign, what the report must state under the Companies Law, which authority receives it and how it feeds corporate tax. Here is each stage and what it demands of management.
Key pointA UAE audit report covers more than the numbers: under Article 252 of the Companies Law it must state whether violations of the law or the company's constitution occurred during the year, so corporate housekeeping problems surface in the audit.
At a glance
Eight stages, ISA based
Engagement, planning, materiality, fieldwork, completion, management letter, opinion and filing, all conducted under International Standards on Auditing with IFRS statements.
Licensed auditors only
Federal Decree-Law No. 41 of 2023 requires auditors and audit firms to be licensed by the Ministry of Economy and Tourism and independent of the client.
Report covers compliance
Mainland audit reports must address proper accounts, related-party dealings and violations of the Companies Law or constitution that affect the company.
Deadlines drive timing
An LLC's general assembly must meet within four months of year-end; DMCC allows six months; the corporate tax return is due within nine months.
Auditor liability limits
The auditor is liable to the company for the report; claims are generally time-barred one year after the general assembly where it was read.
Swipe or scroll →
External audit process UAE: the short answer
The external audit process UAE companies go through follows the same arc whether the business is a two-person startup or a regional group: an engagement letter, planning and risk assessment, materiality, fieldwork, completion, a management letter and a signed opinion. What is specific to the UAE is the legal wrapper around it: who may sign, what the report must say, which authority receives it, and how the audited figures feed corporate tax.
The auditor gives an independent opinion on whether the financial statements present a true and fair view under International Financial Reporting Standards. Management prepares those statements and remains responsible for them. Understanding that division is what makes an audit quick and uneventful rather than slow and expensive.
This guide walks through each stage, explains what the auditor is legally responsible for under UAE law, and sets out what an audit can and cannot do for the business. The accounting and audit work itself is delivered with our group company A&A Consultancy; TRW & Co, as a law firm, covers the legal and regulatory side.
The legal frame around the external audit process UAE companies follow
Three bodies of rules shape the engagement.
The Commercial Companies Law
For mainland companies, Federal Decree-Law No. 32 of 2021 on Commercial Companies requires LLCs and joint stock companies to be audited every year, and its auditor chapter applies to LLCs through Article 102. The auditor must audit the accounts, inspect the balance sheet and profit and loss account, review related-party transactions and check compliance with the law and the company's constitution (Article 248). The auditor may review all registers and documents and require explanations; if management obstructs the work, the auditor must report that in writing and, if it continues, escalate to the authority.
Article 252 lists what the report must cover, including whether proper accounts were kept, related-party and conflict-of-interest transactions, and whether violations of the law or the company's constitution occurred during the year that adversely affect the company. These go beyond a purely financial opinion, which is why UAE audit reports often contain statements that surprise foreign parents.
The auditing profession law
Federal Decree-Law No. 41 of 2023 on Regulating the Auditing and Accounting Professions, in force since March 2024, governs who may audit. Auditors and audit firms must be licensed by the Ministry of Economy and Tourism, must remain independent of the client and its related parties, and face disciplinary and criminal sanctions for misconduct, including signing a report they did not prepare or supervise.
Free zone, DIFC and ADGM rules
Free zones add their own requirements. DMCC's Approved Auditor Rules require the auditor to confirm bank balances with the banks, flag the absence of a bank account, check that salary expenses are disclosed, validate share capital against the articles and disclose revenue from activities outside the licence as other income. ADGM and DIFC have their own registered-auditor regimes. See our guide to registered auditor requirements.
The external audit process UAE auditors follow, stage by stage
Audits in the UAE are conducted under International Standards on Auditing (ISAs). The stages below map to those standards, with the UAE-specific points highlighted.
- Engagement letter. Before work starts, the auditor confirms independence, performs client due diligence and agrees terms in writing (ISA 210). The letter should name the entity, the financial year, the reporting framework, the deliverables (including any free zone summary sheet), the timetable, fees and management's responsibilities.
- Planning and risk assessment. The auditor learns the business, its controls and its legal environment, and identifies where material misstatement is likely (ISAs 300 and 315). Typical UAE risk areas are revenue recognition, related-party balances, inventory, end-of-service gratuity provisions and VAT and corporate tax balances.
- Materiality. The auditor sets a threshold for misstatements that would influence users of the accounts (ISA 320). Management does not set materiality, but it helps to understand it: small items below the threshold will not hold up sign-off.
- Fieldwork. The team tests controls and balances, sends bank and third-party confirmations (ISA 505), attends or relies on inventory counts, vouches transactions to invoices and contracts, and reviews minutes, licences and shareholder resolutions.
- Completion. The auditor reviews events after the year-end (ISA 560), assesses going concern (ISA 570) and obtains a management representation letter (ISA 580). Draft statements are finalised and adjustments agreed.
- Management letter. Significant control deficiencies are reported in writing to those charged with governance (ISA 265). This letter is not public, but lenders and buyers often ask to see it.
- Opinion and sign-off. Directors or managers approve and sign the statements; the auditor signs and dates the report (ISAs 700, 705 and 706). Under the auditing profession law, the report must carry the auditor's and the firm's licence details.
- Approval and filing. The general assembly or shareholders approve the accounts within the statutory window, and the company submits them to its free zone or registrar and keeps them for the corporate tax file.
Who does what: management versus auditor
Most delays in the external audit process UAE businesses go through come from confusion over roles. The auditor cannot prepare the company's books and then audit them without threatening independence, and in many zones the approved-auditor rules make the point expressly.
| Stage | Management (or its accountants) | External auditor |
|---|---|---|
| Engagement | Shareholder resolution appointing the auditor; KYC documents; signed engagement letter | Independence and acceptance checks; terms of engagement |
| Year-end close | Complete ledgers, reconciliations, fixed asset and inventory records, draft IFRS statements | Agrees the information request list and timetable |
| Fieldwork | Provides supporting documents, contracts, minutes, licence copies; answers queries quickly | Tests balances and controls; sends confirmations; evaluates estimates |
| Completion | Books adjustments; signs representation letter; approves statements | Evaluates misstatements, going concern and subsequent events; forms the opinion |
| Reporting | Holds the general assembly or resolution; files with the zone or registrar | Signs the report; signs free zone summary sheets where required |
Where the business does not have in-house finance capacity, bookkeeping and statement preparation should be done by a separate team from the one signing the audit report. Our guide to audit preparation lists the documents auditors typically request.
Realistic timelines for SMEs and startups
There is no fixed duration; the timetable is driven by the state of the books and the legal deadline. For a mainland LLC the general assembly must meet within four months of the year-end. DMCC companies have six months to audit and approve their accounts. The corporate tax return is due within nine months of the tax period end. Working backwards from the earliest of these gives the latest date for fieldwork.
In practice the sequence that works is: close the books in the first weeks after year-end, agree the request list early, hold fieldwork once reconciliations are complete, and leave time for the general assembly or resolution. The most common sources of delay are unreconciled bank accounts, missing related-party confirmations, unsupported inventory, and late responses from foreign shareholders who must sign resolutions.
A first-year audit takes longer than a recurring one because the auditor must verify opening balances, share capital and the constitutional documents. Startups with investor funding should also expect the auditor to examine the terms of convertible instruments and share incentive plans.
Fix the financial year-end deliberately at incorporation. The first financial year of a mainland company can run for between six and eighteen months from registration, and a year-end that falls in a busy season for your business, or alongside other group deadlines, will make every audit harder.
What auditors are legally responsible for, and the limits
Whatever the size of the engagement, the external audit process UAE law sets up provides reasonable assurance, not a guarantee. The auditor designs procedures to detect material misstatement, whether from fraud or error, but does not examine every transaction and is not a substitute for management's own controls.
Under the Commercial Companies Law, the auditor is liable to the company for the audit and for the accuracy of the statements in the report, and must compensate damage caused by its acts in performing the role; where there are joint auditors, each is liable for its own fault (Article 255). A claim against the auditor is generally time-barred one year after the general assembly at which the report was read, unless the act is a crime (Article 256).
The auditor must keep the company's information confidential, but must also notify the authority within ten days of detecting violations of the law or conduct amounting to a crime (Article 251). The auditing profession law adds a duty to report suspected fraud or money laundering. Management should therefore treat the audit as a legal process: what is shown to the auditor may be reported.
Why an audit matters beyond compliance
Audited accounts are the document most third parties rely on to assess a UAE business.
- Banks and lenders. Facility agreements usually require audited accounts within a set period after year-end, and late delivery is a default.
- Investors and buyers. Due diligence starts with audited history; gaps lead to price reductions, specific indemnities or escrow.
- Licensing and free zones. Many authorities check the audit submission before renewing licences or processing changes.
- Corporate tax. Audited statements are mandatory above AED 50 million revenue, for every qualifying free zone person and for tax groups under Ministerial Decision No. 84 of 2025, and they anchor the return for everyone else. See our guide to audited financial statements for corporate tax.
- Disputes. In shareholder and partner disputes, the audited accounts are the starting point for valuation, profit entitlement and director-liability claims.
Illustrative scenario: a startup's first audit
Illustrative only; the parties are generic. A software startup incorporated as a free zone company raised seed funding through convertible instruments and now wants to claim qualifying free zone person status. Its first financial year closes, and the founders discover they need audited statements both for the zone and for corporate tax.
The auditor's planning identifies three risk areas: revenue from multi-year subscriptions, the accounting for the convertible instruments, and intercompany charges to a founder-owned company abroad. The founders' bookkeeper has recorded subscriptions as revenue on invoicing and has no written agreement for the intercompany charges.
Fieldwork stalls until revenue is restated on a deferral basis and the intercompany arrangement is documented. The company's lawyers review the convertible instruments and the related-party arrangement so the accounting, the transfer pricing position and the qualifying income analysis are consistent. The opinion is unmodified, but the management letter recommends a related-party policy, and the investors ask for it before the next round.
Common mistakes in the external audit process
Appointing an auditor the zone does not accept
Free zones such as DMCC accept audit reports only from approved auditors and can reject a filing signed by anyone else, requiring a fresh audit. Jafza requires an auditor holding a Dubai economic department licence. Before signing an engagement letter, check the firm's Ministry of Economy and Tourism licence, the signing partner's registration and any zone listing. Our article on how to choose an audit firm sets out the checks.
Treating the auditor as the bookkeeper
When the audit firm closes the books, prepares the statements and then audits them, the independence of the opinion is compromised and the report may be challenged by lenders, buyers or the regulator. Keep preparation and audit separate. If the business needs help with both, use different teams with clear engagement letters, and record who prepared which schedules.
Missing corporate documents
Auditors verify share capital, shareholdings, manager appointments and licensed activities against the constitutional documents and registry records. Out-of-date memoranda, unregistered share transfers or activities conducted outside the licence lead to qualifications or compliance statements in the report. These are legal problems with legal fixes, and they are cheaper to resolve before fieldwork than after.
Ignoring a modified opinion
A qualified opinion, adverse opinion or disclaimer, or an emphasis of matter on going concern, has consequences beyond the accounts: it can trigger loan defaults, licence queries and corporate tax scrutiny. Understand the reason for the modification and plan remediation before the next year-end. Our guide to audit report opinions explains each type.
Cross-border groups and the external audit process UAE subsidiaries face
Foreign parents often expect the group auditor to cover the UAE subsidiary. A group audit can reduce duplication, but it does not replace the local statutory audit where UAE law or the free zone requires a UAE-licensed or approved auditor to sign. DMCC illustrates the nuance: a branch whose accounts are prepared within its parent's group accounts can fall outside its approved-auditor rules, but a standalone audit of that branch must be signed by an approved auditor.
The practical answer is to align the two engagements. Agree group reporting deadlines, materiality and the treatment of intra-group balances early, so the external audit process UAE law requires and the group audit draw on the same reconciled figures. Mismatched year-ends, unsigned intercompany agreements and management charges without documentation are the issues local auditors raise most often, and they also matter for transfer pricing and corporate tax.
Groups with parents in the UK, Singapore, India, Bangladesh or China should also plan for signatures: resolutions approving the accounts, representation letters and confirmations often need signatories outside the UAE, and late signatures are a frequent cause of missed deadlines.
What to do next
- Confirm which rule requires the audit and the earliest deadline for each entity.
- Check the auditor's licence and any free zone, DIFC or ADGM approval before engagement.
- Agree the information request list and timetable at the start, not during fieldwork.
- Tidy corporate records: shareholder registers, resolutions, licence activities and related-party agreements.
- Diarise the general assembly or shareholder approval, the zone submission and the corporate tax return.
The accounting and audit engagement is delivered with our group company A&A Consultancy. TRW & Co advises on the legal issues an audit exposes: corporate housekeeping, shareholder approvals, related-party documentation, regulatory correspondence and disputes over audited figures. We work with registered tax agents on Federal Tax Authority matters and do not act as auditors or tax agents ourselves. For background on the overall obligations, see statutory audit requirements in the UAE and our corporate governance practice. To discuss an audit issue, contact our Dubai team at info@trw.co or +971 58 942 1012.
Frequently asked questions
01How long does an external audit take in the UAE?
It depends on the size of the business and, above all, the state of its books. A small company with reconciled accounts and complete documents moves through fieldwork quickly, while a first-year audit or one with unreconciled balances takes considerably longer. Plan backwards from the binding deadline: four months from year-end for a mainland LLC's general assembly, six months for DMCC, and nine months for the corporate tax return.
02What documents does an auditor need in the UAE?
Expect requests for the trial balance and general ledger, bank statements and confirmations, sales and purchase invoices, contracts, fixed asset and inventory records, payroll and end-of-service calculations, VAT and corporate tax filings, and corporate documents such as the trade licence, memorandum of association, shareholder register and resolutions. Free zone auditors also check the licensed activities and share capital against the company's articles.
03Can my accountant also be my auditor?
Not for the same work. An auditor who prepares the books and statements and then audits them faces a self-review threat that undermines independence, which Federal Decree-Law No. 41 of 2023 and the international ethics standards are designed to prevent. Keep bookkeeping and statement preparation with a separate team, and make sure the audit report is signed by a licensed auditor who did not prepare the figures.
04What is a management letter?
A management letter is the auditor's written report to management and those charged with governance on significant control weaknesses and other matters found during the audit. It is not filed with the authorities, but banks, investors and buyers often ask for it. Treat it as a to-do list: fixing the issues before the next year-end avoids repeat findings and reduces the risk of a modified opinion.
05Does an audit detect fraud?
An audit is designed to give reasonable assurance that the statements are free from material misstatement, whether from fraud or error. It is not a forensic investigation and will not detect every fraud, particularly where collusion or forged documents are involved. If fraud is suspected, a separate investigation is needed. Under UAE law the auditor must also report certain violations and suspected crimes to the authorities.
06What happens if the auditor finds a legal violation?
Under Article 251 of the Commercial Companies Law, the auditor must notify the authority within ten days of detecting a violation of the law or conduct that constitutes a crime, and the auditing profession law requires reports of suspected fraud or money laundering. The audit report itself must state whether violations affecting the company occurred during the year. Legal advice early in the audit helps resolve issues before they are reported.
Sources and official materials
- Federal Decree-Law No. 32 of 2021 on Commercial Companies — Accounting records, annual audit for LLCs and joint stock companies, auditor appointment and rotation
- Federal Decree-Law No. 41 of 2023 on Regulating the Auditing and Accounting Professions — Licensing of auditors and audit firms, independence, discipline and offences
- Ministerial Decision No. 84 of 2025 on Audited Financial Statements — Which corporate tax payers must prepare and maintain audited financial statements
- DMCC Approved Auditor Rules — Approved auditor regime, summary sheet and consequences of using a non-approved auditor
- DMCC Approved Auditors Guidance Note — Timeline for audited accounts, auditor appointment and approval criteria
- Ministry of Economy and Tourism: Auditor Register (Individuals) — Conditions, documents and fees for registration as a practising auditor
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
