TRW & Co · Accounting, audit and bookkeeping
Setting Up an Internal Audit Function in the UAE
Internal audit services Dubai companies use give boards independent assurance that controls, risk management and governance work in practice. Internal audit is mandatory for listed companies and banks and expected of many regulated firms; for others it is a governance choice. This guide covers legal triggers, IIA standards, delivery models and the link to AML and corporate tax.
Key pointThe charter matters more than the provider: an internal audit function without a board-approved mandate, a direct line to the audit committee and unrestricted access to records will not satisfy a regulator, a lender or a court.
At a glance
Required for listed companies
The capital markets regulator's governance guide requires public joint stock company boards to establish an internal audit department and approve written internal audit procedures.
Required for banks
Central Bank Circular No. 161/2018 requires an independent, permanent and effective internal audit function reporting to the board or its audit committee.
IIA standards in force
The Global Internal Audit Standards, released in January 2024, became effective on 9 January 2025 and are the benchmark most UAE functions follow.
Three delivery models
In-house, co-sourced and fully outsourced models all work if the charter, reporting line and independence from the external auditor are right.
Tax and AML link
Internal audit tests the controls behind corporate tax returns, kept for seven years under Article 56, and the AML programme supervisors expect to be independently tested.
Swipe or scroll →
Internal audit services Dubai: the short answer
Internal audit services Dubai businesses buy are an independent, objective review of how well the company's controls, risk management and governance actually work. Unlike the annual external audit, which gives an opinion on the financial statements, internal audit looks forward: it tests whether processes are designed properly, whether people follow them and whether the board is getting reliable information.
For most private companies there is no general statutory duty to have an internal audit function. The duty is sector-specific. Listed public joint stock companies must have one under the governance rules of the capital markets regulator, banks must have one under Central Bank regulation, and other regulated financial firms face similar expectations from their supervisors. For everyone else, internal audit is a governance choice, but one that lenders, investors, regulators and tax inspectors increasingly expect to see.
This guide explains when an internal audit function is required, which standards it should follow, how to choose between in-house, co-sourced and outsourced models, and how internal audit supports anti-money laundering (AML) and corporate tax governance. The internal audit and accounting work itself is delivered with our group company A&A Consultancy; TRW & Co, as a law firm, covers the legal and regulatory side: mandates, charters, board reporting, regulatory interaction and what happens when an audit finds something serious.
When an internal audit function is legally required
The UAE has no single "internal audit law". The obligation, where it exists, comes from the rules of the regulator that supervises the business. The main categories are set out below.
Listed public joint stock companies
The governance guide for public joint stock companies issued by the capital markets regulator (formerly the Securities and Commodities Authority, now the Capital Market Authority) under Chairman's Decision No. 3/R.M of 2020 requires the board to ensure efficient internal auditing, approve an internal audit policy and written procedures, and establish an internal audit department to follow up compliance with laws, regulations, supervisory requirements and board policies. The same guide requires a compliance function and board committees, including an audit committee.
In January 2025 the regulator amended the guide to strengthen board responsibility for internal control and risk management. Boards must approve a framework based on the COSO internal control model and evaluate its effectiveness, and the changes were phased in with management self-assessments of internal control over financial reporting and, for the later phase, an external auditor's report with an opinion on the effectiveness of internal control. Internal audit is usually the team that runs or validates the self-assessment. Our note on internal controls over financial reporting covers that regime in more detail.
Banks and other Central Bank-licensed firms
The Central Bank's Internal Controls, Compliance and Internal Audit Regulation (Circular No. 161/2018) requires every bank to have an independent, permanent and effective internal audit function sized to its business. Internal audit must report to the board or the board audit committee, have full access to staff and records, and be headed by someone who follows the IIA's international standards. The audit committee approves an internal audit charter and an annual risk-based audit plan. Banks must also notify the Central Bank when the head of internal audit resigns and obtain its no-objection before appointing a replacement.
Insurers, finance companies, exchange houses and payment firms face their own Central Bank governance requirements, and firms regulated in the DIFC or ADGM must meet the systems-and-controls expectations of the DFSA or the FSRA. In each case the regulator expects a function that is independent of the business lines it reviews. See our overview of banking and finance regulation in the UAE.
AML-regulated businesses
Financial institutions and designated non-financial businesses and professions (DNFBPs), such as real estate brokers, dealers in precious metals and stones, corporate service providers, lawyers and accountants, must run AML and counter-terrorist financing programmes under Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025, which replaced Cabinet Decision No. 10 of 2019. Supervisors expect those programmes to be tested independently. For a smaller DNFBP, an outsourced internal audit of the AML framework is often the most practical way to show that.
Everyone else
Private LLCs and free zone companies are not generally required to have internal audit. The Commercial Companies Law requires an external auditor for LLCs and joint stock companies, not an internal one. But directors and managers owe duties of care and can be personally liable for mismanagement, and a board that never asks for independent assurance will find that hard to defend when a fraud or a regulatory breach comes to light. Our page on directors' duties and liability explains the exposure.
Standards: what good internal audit looks like
The global benchmark is the Institute of Internal Auditors' Global Internal Audit Standards. They were released in January 2024 and, according to the IIA, became effective on 9 January 2025, replacing the earlier International Professional Practices Framework standards. The Central Bank regulation for banks refers to the IIA standards directly, and most listed companies and serious providers of internal audit services Dubai boards appoint work to them.
The practical requirements that matter most for a UAE board are:
- A board-approved charter. It sets the mandate, scope, authority, access rights and reporting lines of internal audit. Without one, auditors can be refused access and findings can be ignored.
- Independence and objectivity. The chief audit executive should report functionally to the board or audit committee and administratively to senior management. Internal auditors should not audit work they designed or performed.
- A risk-based plan. The annual plan should follow the company's risk assessment, not simply rotate through departments. Our guide to building a risk management framework explains how the two connect.
- Quality assurance. The function should run an internal quality programme and obtain an external quality assessment periodically.
- Clear reporting. Findings should be rated, assigned to an owner with a deadline, and tracked to closure in reports to the audit committee.
Two other frameworks are commonly used alongside the IIA standards: the COSO internal control framework (which the capital markets regulator now expects listed companies to apply) and the "three lines" model, which separates management (first line), risk and compliance functions (second line) and internal audit (third line).
In-house, co-sourced or outsourced: choosing a model
The biggest decision when buying internal audit services Dubai companies face is who does the work. There are three models, and many groups move between them as they grow.
| Model | How it works | Best for | Watch out for |
|---|---|---|---|
| In-house | Employed chief audit executive and team reporting to the audit committee | Banks, listed companies, large groups with continuous audit needs | Cost, limited specialist skills (IT, tax, AML), risk of familiarity with management |
| Co-sourced | In-house head of internal audit supported by an external provider for specialist or peak work | Mid-size and growing groups; regulated firms needing specialist reviews | Clear allocation of responsibility; the in-house head still owns the opinion |
| Fully outsourced | External firm acts as the internal audit function under a board-approved charter | Family businesses, private companies, free zone entities, smaller DNFBPs | Regulator conditions on outsourcing; independence from the external auditor; continuity of knowledge |
Two legal points often decide the choice. First, regulated firms that outsource a control function generally remain responsible for it and may need to notify or obtain approval from their regulator, so the outsourcing agreement must give the regulator and the board full access rights. Second, the external auditor of a company should not also act as its internal audit function, because that threatens the external auditor's independence. Choose a separate provider, and record the independence analysis in the board minutes.
An outsourced internal auditor is only as effective as its mandate. Before the first review, have the board approve a charter that names the audit committee as the reporting line, grants unrestricted access to records and staff, and requires management to respond to findings within set deadlines. Without that document, a provider of internal audit services Dubai management finds inconvenient can simply be starved of information.
Setting up an internal audit function step by step
- Confirm the legal driver. Identify whether a regulator, a listing, a lender or a parent company requires internal audit, and what it specifies about independence, reporting lines, outsourcing and qualifications.
- Constitute the audit committee. Appoint members with financial literacy and, where possible, independence from management. For smaller private companies, the board itself may perform the role.
- Approve the charter. The board approves a charter covering mandate, scope, authority, access, independence, reporting and quality assurance.
- Choose the model and engage the provider. Decide between in-house, co-sourced and outsourced delivery. For an external provider, sign an engagement agreement with confidentiality, data protection, access, liability and termination terms.
- Run a risk assessment. Map the company's main risks (revenue, procurement, inventory, cash, payroll, IT, tax, AML, regulatory) and rate them by likelihood and impact.
- Approve a risk-based audit plan. Typically one to three years, with the highest-risk areas reviewed first and the plan refreshed annually.
- Execute, report and track. Each review produces rated findings, agreed management actions, owners and deadlines. The audit committee sees open findings at every meeting until they close.
- Assess quality. Review the function annually against the charter and the standards, and arrange an external quality assessment periodically.
Our internal audit checklist sets out the area-by-area test steps that usually follow once the function is running.
Integrated audits, AML and corporate tax governance
An integrated audit reviews a process end to end, covering its financial, operational, compliance and IT controls in one engagement rather than separately. For a procurement cycle, that means testing vendor onboarding and sanctions screening, purchase approvals, goods receipt, three-way matching, VAT on invoices, payment authorisation and system access in a single review. The result is fewer disruptions for management and a clearer picture for the board.
Supporting the AML programme
For AML-regulated firms, internal audit tests whether customer due diligence is performed and documented, whether risk ratings are reasonable, whether sanctions screening works, whether suspicious transactions are escalated and reported through goAML, and whether staff are trained. Supervisors look for evidence that weaknesses found by internal audit were fixed. See our guidance on AML compliance in the UAE.
Supporting corporate tax governance
Corporate tax has made internal control a tax matter. Article 56 of the Corporate Tax Law requires taxable persons to keep records supporting their returns for seven years after the end of the tax period.
Internal audit can test the controls that feed the return: related-party pricing and documentation, the qualifying income and de minimis tests for free zone companies, non-deductible expense tracking, and the reconciliation from accounting profit to taxable income. With phase 2 of the national e-invoicing programme going live on 1 July 2027, it can also review system readiness before the deadline. For the tax rules themselves, see our page on corporate tax in the UAE.
Illustrative scenario
This scenario is illustrative and does not describe a real client.
A family-owned trading group with a mainland LLC and a free zone distribution company has grown quickly. A bank refinancing its facilities asks for evidence of internal control, and the second-generation shareholders want assurance before agreeing dividend policy. The group has no internal audit function and a small finance team.
The board adopts a charter, appoints two family members and an independent adviser as an audit committee, and engages an outsourced provider, separate from the external auditor, to deliver internal audit services Dubai and free zone operations alike. The first risk assessment ranks inventory, related-party balances, procurement and free zone tax status as the top risks.
The first review finds that a manager can create vendors and approve payments, and that intra-group sales to the mainland company have not been analysed for free zone tax purposes. Management fixes the segregation-of-duties gap within a month. The tax point goes to the group's tax adviser for a formal view, and the legal team updates intra-group agreements. The bank receives a summary of the internal audit plan and closure of findings as part of the refinancing.
Risks and common mistakes
Internal audit reports to the CFO instead of the board
If the chief audit executive or outsourced provider reports only to the finance director, the function cannot credibly audit finance, which is usually where the largest risks sit. Regulators and lenders look at reporting lines first. The fix is simple: the audit committee or board should approve the plan, receive reports directly, meet the auditor without management present at least once a year, and decide on the appointment and removal of the head of internal audit or the outsourced firm. Administrative matters such as budgets and logistics can still run through management.
Using the external auditor as the internal auditor
Asking the statutory auditor to perform internal audit work appears efficient, but it creates a self-review threat: the external auditor would be relying on controls it designed or tested as part of management's own function. Independence rules for auditors restrict this, and the audit firm may have to decline or limit the engagement. Even where some work is allowed, the board loses the benefit of two independent perspectives. Appoint separate providers and document the independence assessment.
Findings that never close
The most common failure is not a lack of findings but a lack of follow-through. A finding with no owner, no deadline and no escalation path will still be open two years later, and that record is damaging in a regulatory inspection, a dispute with a co-shareholder or a sale process. Each finding should carry a risk rating, an agreed action, a named owner and a due date. The audit committee should see overdue items and decide whether to accept the risk formally or escalate.
Treating legally sensitive findings as routine
Internal audit sometimes uncovers potential fraud, bribery, sanctions breaches or reportable AML matters. Circulating a draft report widely at that stage can prejudice an investigation, tip off a suspect, create discoverable documents and complicate later reporting obligations. The charter should set an escalation route for suspected misconduct to the audit committee and legal counsel, so the matter can be handled as a structured internal investigation with proper evidence handling.
Cross-border groups
Many UAE businesses are part of groups headquartered in India, Bangladesh, the UK, Singapore, China or Saudi Arabia, or they hold subsidiaries in those countries.
Group internal audit often sits outside the UAE, and its methodology may follow the parent's law and listing rules. Two issues come up repeatedly. First, data protection: sending personal data from the UAE to a group audit team abroad needs a lawful basis and appropriate transfer safeguards under the applicable UAE regime (federal, DIFC or ADGM). Second, local regulatory requirements: a UAE bank or regulated firm must satisfy its UAE regulator even if the group function is overseas, and some regulators expect a local presence or specific approvals for outsourcing.
The practical answer is a written protocol: who audits the UAE entity, under which charter, how findings are reported to the local board, and how UAE regulatory and data rules are respected. That protocol often matters more than the choice of provider.
How we work and what to do next
The internal audit fieldwork, testing and reporting are delivered with our group company A&A Consultancy. TRW & Co is a law firm, not an audit firm: we advise on whether and how internal audit is required, draft charters, audit committee terms of reference and outsourcing agreements, map regulatory expectations, and step in when a finding raises a legal issue such as fraud, an AML reporting decision or a dispute between shareholders. See our wider work on corporate governance in the UAE.
A short checklist for boards considering internal audit services Dubai providers offer:
- Is internal audit required by a regulator, a listing or a financing agreement, and what conditions apply?
- Do we have a board-approved charter and a functioning audit committee?
- Is the provider independent of the external auditor and of the processes it will review?
- Is the audit plan based on a current risk assessment that includes tax, AML and IT?
- Do findings have owners, deadlines and a reporting route to the board?
- Is there an escalation protocol for suspected misconduct?
To discuss your governance framework, contact TRW & Co at info@trw.co or +971 58 942 1012.
Frequently asked questions
01Is internal audit mandatory for companies in the UAE?
Not for every company. Listed public joint stock companies must establish an internal audit department under the capital markets regulator's governance guide, and banks must maintain an independent internal audit function under Central Bank regulation. Other regulated financial firms face similar supervisory expectations, and AML-regulated businesses are expected to have their programmes tested independently. Private LLCs and free zone companies have no general statutory duty, but lenders, investors and parent companies often require internal audit, and directors who never seek assurance may find it harder to show they acted with due care.
02What is the difference between internal audit and external audit?
External audit is a statutory engagement in which a licensed auditor gives an opinion on whether the financial statements present a true and fair view. It looks back at a financial year and reports to shareholders. Internal audit is an independent function serving the board: it reviews whether controls, risk management and governance processes are designed and operating effectively across the business, including operations, IT, compliance and tax. It reports during the year and focuses on improvement. The two should be performed by different providers to protect independence.
03Can we outsource internal audit in Dubai?
Yes. Many private companies and smaller regulated firms use a fully outsourced or co-sourced model. The board must still approve a charter, appoint the provider, receive its reports directly and decide on findings. Regulated firms should check their regulator's outsourcing rules, which may require notification or approval and guaranteed access rights for the regulator. The outsourced provider should be independent of the company's external auditor and of the processes it reviews. In our group, internal audit fieldwork is delivered with A&A Consultancy, while TRW & Co advises on the legal framework.
04Which standards should an internal audit function follow?
The benchmark is the Institute of Internal Auditors' Global Internal Audit Standards, which became effective on 9 January 2025. The Central Bank regulation for banks requires the head of internal audit to follow the IIA standards. Functions commonly also use the COSO internal control framework, which the capital markets regulator now expects listed companies to apply, and the three lines model to define responsibilities between management, risk and compliance functions, and internal audit. A board-approved charter should state which standards apply.
05Who should internal audit report to?
Functionally, internal audit should report to the board or its audit committee, which approves the charter and audit plan, receives reports and decides on the appointment or removal of the head of internal audit or the outsourced firm. Administratively, it can report to the chief executive for budgets and logistics. Reporting only to the finance director undermines independence because finance is usually a key area under review. Central Bank regulation requires bank internal audit to report to the board or its audit committee.
06How does internal audit help with corporate tax?
Corporate tax returns depend on reliable accounting records and correct tax adjustments. Internal audit can test controls over related-party transactions and transfer pricing documentation, the qualifying income tests for free zone companies, tracking of non-deductible expenses, and the reconciliation of accounting profit to taxable income. Records supporting returns must be kept for seven years under Article 56 of the Corporate Tax Law. Weak controls found early can be fixed before the Federal Tax Authority reviews a return.
Sources and official materials
- Institute of Internal Auditors: Global Internal Audit Standards — The global professional standards for internal audit, effective 9 January 2025
- Central Bank of the UAE: Internal Controls, Compliance and Internal Audit Regulation — Circular No. 161/2018 on bank internal audit functions
- Capital Market Authority — Regulator of listed companies and issuer of the governance guide for public joint stock companies
- Federal Decree-Law No. 32 of 2021 on Commercial Companies — Accounting records, external audit and directors' responsibilities
- Federal Decree-Law No. 47 of 2022 (Corporate Tax Law) — Article 56 on record keeping for corporate tax
- UAE Financial Intelligence Unit — goAML reporting for financial institutions and DNFBPs
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
