TRW & Co · Accounting, audit and bookkeeping
Internal Controls over Financial Reporting (ICFR) for UAE Companies
Internal controls over financial reporting UAE companies rely on are moving from good practice to tested obligation. Listed companies face phased ICFR reporting under the Capital Market Authority, Abu Dhabi government entities report to ADAA, and banks answer to the Central Bank. This guide explains the rules, the COSO method, testing steps and the legal value of strong controls.
Key pointMost first-year ICFR failures in the UAE are evidence failures, not design failures: a review that is not signed, dated and retained counts as a control that did not operate, so agree evidence standards with the auditor before testing begins.
At a glance
No single ICFR law
Requirements come from company law, the CMA governance guide, ADAA rules, Central Bank regulations and DFSA or FSRA rulebooks, depending on the entity.
Listed companies phased in
A January 2025 circular phased in management self-assessment and auditor reporting on ICFR, and a later circular extended the trial phase through 2026.
COSO is the benchmark
The COSO 2013 framework, with five components and seventeen principles, is the reference model UAE regulators accept and auditors use to test controls.
Tax records last seven
Records supporting a corporate tax return must be kept for seven years after the tax period, so control evidence must be retained at least as long.
Legal and audit split
Control testing and audit work is delivered with A&A Consultancy, while TRW & Co handles governance documents, regulatory interpretation and legal exposure.
Swipe or scroll →
Internal controls over financial reporting UAE: the short answer
Internal controls over financial reporting UAE companies operate are the policies, approvals, reconciliations and system rules that stop errors and fraud from reaching the financial statements. For most private companies they are a governance expectation rather than a stand-alone statutory regime. For listed companies, Abu Dhabi government-linked entities, banks and insurers, they are now a formal, tested and increasingly reported obligation.
The practical answer is the same for everyone: document the material processes, identify what could go wrong in each, design a control for each risk, test that the controls actually operate, and fix what fails. The international reference point is the COSO Internal Control – Integrated Framework, which UAE regulators expressly accept.
The accounting, control testing and audit work described in this guide is delivered with our group company A&A Consultancy. TRW & Co, as a law firm, covers the legal and regulatory side: governance documents, board and audit committee mandates, regulatory interpretation, and what control failures mean for directors, tax positions and AML exposure.
The legal and regulatory framework
There is no single UAE "ICFR law". Instead, the rules on internal controls over financial reporting UAE entities follow come in several layers that point in the same direction, and which layers apply depends on the entity.
Company law: the baseline for every company
The Commercial Companies Law (Federal Decree-Law No. 32 of 2021, as amended, including by Federal Decree-Law No. 20 of 2025 in force since late 2025) requires companies to keep accounting records that show their financial position accurately, to prepare annual financial statements and, for most company forms, to appoint an auditor. Managers and directors owe duties of care to the company and can be liable for mismanagement, fraud and breaches of the law or the constitution. A board that cannot show how it knows the numbers are right is exposed when they turn out to be wrong. Our guide to directors' duties and liability explains that exposure in detail.
Listed companies: the Capital Market Authority governance regime
Public joint stock companies are subject to the corporate governance guide originally issued by the Securities and Commodities Authority, now the Capital Market Authority (CMA). The guide was amended in 2024 to require boards to put an internal control framework in place, with COSO accepted as the reference model, and to enable the external auditor to express a view on the effectiveness of internal control and risk management.
A circular issued in January 2025 then phased in internal controls over financial reporting: senior management self-assesses ICFR, the board approves the framework, and the external auditor first reports to the board and later gives an opinion. Published commentary on a further circular in late 2025 indicates that the trial phase was extended through the 2026 financial year, with public ICFR reporting expected from 2027 and risk management brought into scope from 2028. Listed issuers should confirm the current text of the circulars with the CMA and their auditor before fixing their timetable.
Abu Dhabi government entities
The Abu Dhabi Accountability Authority (ADAA) has for several years required entities under its oversight, including many government-controlled companies, to assess and test ICFR, and its audit standards require the external auditor to report separately on ICFR effectiveness. Entities in this group should treat ICFR as an annual compliance cycle, not a project.
Banks, insurers and financial free zones
The Central Bank's Corporate Governance Regulation for banks makes the board responsible for an effective internal control system, supported by independent risk, compliance and internal audit functions. Insurers are subject to parallel governance and control requirements under the Central Bank's insurance rules. In the DIFC and ADGM, the DFSA and FSRA rulebooks require authorised firms to maintain systems and controls appropriate to their business, and listed issuers on Nasdaq Dubai face disclosure and governance rules of their own.
Tax and AML rules that depend on reliable controls
Article 56 of the Corporate Tax Law requires records supporting a tax return to be kept for seven years after the tax period ends, and Ministerial Decision No. 84 of 2025 requires audited financial statements from larger and certain other taxpayers. The Federal Tax Authority can audit VAT and corporate tax positions, and the AML framework under Federal Decree-Law No. 10 of 2025 expects regulated businesses to evidence their controls. Weak financial controls rarely stay a pure accounting problem for long.
How the COSO framework structures ICFR
COSO's 2013 framework organises internal control into five components supported by seventeen principles. UAE auditors and regulators use its vocabulary, so it is worth adopting even where it is not mandatory.
| Component | What it means in practice | Typical UAE evidence |
|---|---|---|
| Control environment | Tone at the top, board oversight, ethics, competence and clear accountability | Board and audit committee charters, delegation of authority matrix, code of conduct, finance job descriptions |
| Risk assessment | Identifying where the financial statements could be materially misstated, including fraud risk | Scoping memo, materiality calculation, risk and control matrix, fraud risk assessment |
| Control activities | Approvals, reconciliations, segregation of duties, system access and IT general controls | Signed reconciliations, approval logs, ERP access reviews, change management tickets |
| Information and communication | Reliable data flows and clear reporting to management and the board | Month-end close calendar, management accounts, reporting packs to the audit committee |
| Monitoring | Ongoing and separate evaluations, with deficiencies reported and fixed | Internal audit reports, control self-assessments, remediation trackers |
Controls are also classified by type. Entity-level controls set the environment; process-level controls sit inside revenue, purchasing, payroll, treasury, inventory and the financial close; and IT general controls protect the systems the other controls rely on. Preventive controls stop an error happening, while detective controls find it afterwards. A balanced design uses both.
How to build internal controls over financial reporting UAE auditors accept
A first ICFR programme typically takes several months for a mid-sized group and longer for a listed group with many subsidiaries. The sequence below is the one most UAE audit firms and regulators expect to see.
- Scope and materiality. Set overall materiality, then identify the significant accounts, disclosures, locations and subsidiaries. Newly acquired businesses and foreign subsidiaries need an explicit scoping decision.
- Document processes. Prepare narratives or flowcharts for each significant process, from transaction initiation to the general ledger, including the ERP modules and spreadsheets involved.
- Map risks to controls. Build a risk and control matrix listing what could go wrong, the control that addresses it, the owner, frequency and evidence. Gaps become design deficiencies.
- Test design. Walk through one transaction per process to confirm that each control exists and, if it operated, would address the risk.
- Test operating effectiveness. Sample control instances across the period. A monthly reconciliation needs several months tested; an automated control may need one test plus strong IT general controls.
- Evaluate deficiencies. Classify each failure as a control deficiency, significant deficiency or material weakness, considering likelihood and magnitude of misstatement.
- Remediate and retest. Fix the root cause, allow the new control to operate long enough to be tested, then retest before year end.
- Report. Management concludes on effectiveness, the audit committee reviews the conclusion, and the external auditor reports where the regime requires it.
The single most common reason a UAE ICFR programme fails its first audit is evidence, not design. A finance manager who reviews a reconciliation but does not sign, date and retain it has, for testing purposes, not performed the control. Agree evidence standards before testing starts.
Who needs what: the requirements compared
The table summarises how the expectations differ across entity types. Where an entity falls into more than one row, the strictest standard applies in practice.
| Entity type | Main driver | What is expected | External reporting |
|---|---|---|---|
| Listed public joint stock company | CMA governance guide and ICFR circulars | Board-approved framework, management self-assessment, remediation of gaps | Auditor report to the board in the trial phase, then auditor opinion and public reporting as phased in |
| Abu Dhabi government entity or government-controlled company | ADAA requirements | Annual ICFR assessment and testing | Separate auditor report on ICFR effectiveness |
| Bank or insurer | Central Bank governance and control rules | Independent risk, compliance and internal audit functions; effective control system | Supervisory reporting and auditor reporting under Central Bank rules |
| DIFC or ADGM authorised firm | DFSA or FSRA systems and controls rules | Controls proportionate to the business, with clear senior management responsibility | Auditor and regulatory returns under the relevant rulebook |
| Private LLC or free zone company | Company law duties, tax and lender requirements | Adequate records and controls; often required by lenders, investors and parent groups | Usually none specific, but the auditor reports control weaknesses in a management letter |
Companies preparing for a listing should start ICFR well before the prospectus stage, because underwriters and the regulator will ask how the numbers are controlled. Our page on IPOs and listings in the UAE covers the wider readiness process.
Financial control audits, internal audit and the external auditor
Three different reviews are often confused. A financial control audit is a targeted review, usually by internal auditors or an outside adviser, of whether controls over bookkeeping, approvals and reporting are adequate and working. Internal audit is the permanent function that tests controls across the business and reports to the audit committee; our guide to the internal audit function in the UAE explains how to set one up. The external auditor gives an opinion on the financial statements and, where a regime requires it, a separate opinion or report on ICFR.
These reviews should be coordinated, not duplicated. External auditors may rely on internal audit work if it is competent and objective, which reduces cost. Internal audit should not design the controls it later tests. And a financial control audit commissioned by the board should be scoped to answer a clear question, such as whether a subsidiary's controls are strong enough to integrate after an acquisition.
Why ICFR matters for tax, AML and directors
Good controls have a legal value that goes beyond a clean audit.
- Corporate tax. Taxable income starts from accounting profit. If revenue cut-off, related-party pricing or expense classification is unreliable, the return is unreliable. Documented controls over these areas are the best defence in a Federal Tax Authority audit and support positions under our guide to corporate tax in the UAE.
- VAT. Reconciling VAT returns to the ledger each period, checking tax invoices before input tax is claimed and controlling credit notes prevent the errors that trigger voluntary disclosures and penalties. See our page on VAT in the UAE.
- AML. Payment approval controls, vendor onboarding checks and cash handling rules overlap with AML obligations. Regulated businesses must be able to show that suspicious activity would be detected; our AML compliance page sets out those duties.
- Directors. A board that has approved a framework, received regular reports and acted on deficiencies is far better placed to show it exercised proper care than one that relied on assurances.
Internal controls over financial reporting UAE boards can evidence are as much a legal defence as an accounting tool.
Illustrative scenario
This scenario is illustrative only and does not describe a real client. A Dubai-headquartered distribution group with an onshore LLC, a free zone trading entity and a subsidiary in another GCC state is preparing for a listing. Its auditor has issued management letters in two consecutive years noting manual journals posted without review and unreconciled intercompany balances.
The group adopts COSO, scopes all three entities, and documents revenue, purchasing, inventory, treasury, payroll and the financial close. Testing shows that the free zone entity's sales staff can create customers and change credit limits in the ERP, a segregation-of-duties failure. Remediation removes those access rights, introduces a monthly intercompany reconciliation signed by both entity controllers, and requires second-person approval for manual journals above a threshold.
On the legal side, the board and audit committee charters are updated to reflect the governance guide, the delegation of authority is rewritten, and the board minutes record its review of the deficiency log. When the corporate tax return is later reviewed, the intercompany reconciliations and transfer pricing documentation support the related-party figures without restatement.
Risks and common mistakes
Treating ICFR as a documentation exercise
Thick process manuals do not equal effective controls. Regulators and auditors look for evidence that a specific person performed a specific check at a specific time and acted on what they found. Programmes that spend months on narratives and weeks on testing usually discover at year end that controls were not operating. Keep documentation proportionate and invest the time in operating effectiveness testing, evidence standards and remediation. Ask control owners to sign off their own controls quarterly so problems surface early rather than during the external audit.
Ignoring IT general controls and spreadsheets
Automated controls in an ERP are only as reliable as the access, change management and backup controls around the system. If finance users can change their own access or post to closed periods, automated controls cannot be relied on. Many UAE groups also run key calculations, such as revenue recognition schedules, provisions or the end-of-service gratuity accrual, in spreadsheets with no version control or review. Inventory these end-user computing tools, lock formulas, and evidence review of inputs and outputs each period.
Leaving subsidiaries and acquisitions out of scope
A group's ICFR is only as strong as its weakest material subsidiary. Free zone entities, newly acquired businesses and foreign subsidiaries are often excluded informally and then cause the largest adjustments. Where a regime allows a temporary exclusion, document it, disclose it if required, and plan integration. Acquisition agreements should give the buyer access to the target's control documentation before closing so that post-completion remediation can be costed and, where appropriate, reflected in the price or warranties.
No link between deficiencies and the board
Deficiencies that are logged but never reach the audit committee create legal risk. If a material weakness later causes a misstatement, the question will be who knew and what they did. Each deficiency should have an owner, a remediation date and a status reported to the audit committee, with minutes recording discussion and decisions. Where a deficiency affects tax filings or regulatory returns, take legal advice on whether a voluntary disclosure or notification is required before the next filing.
Cross-border groups
UAE groups with parents or investors abroad often face more than one ICFR standard, so internal controls over financial reporting UAE subsidiaries operate must satisfy two masters. A subsidiary of a United States registrant may need to comply with the parent's Sarbanes-Oxley programme; a subsidiary of a United Kingdom or Saudi listed group will follow that group's governance code. The most efficient approach is to build one control set that satisfies the strictest applicable regime and map it to each framework, rather than running parallel programmes.
Groups with operations in Bangladesh, India, Singapore or China, where TRW & Co's network is active, should also check local statutory requirements for internal financial controls and auditor reporting, which may differ in scope and timing from the UAE regime.
What to do next: a checklist
- Confirm which regimes govern your internal controls over financial reporting UAE obligations: CMA, ADAA, Central Bank, DFSA, FSRA, a foreign parent's rules, or lender covenants.
- Adopt COSO as the framework and record that decision in a board resolution.
- Approve or update audit committee and internal audit charters, and the delegation of authority.
- Scope significant accounts and entities, including free zone and foreign subsidiaries.
- Build a risk and control matrix and agree evidence standards with the external auditor.
- Test design and operating effectiveness, then remediate and retest before year end.
- Report deficiencies to the audit committee and minute the response.
- Link controls to tax, VAT and AML obligations so one programme supports all three.
Our related guide on building a risk management framework covers the enterprise-wide layer that sits above ICFR, and our page on corporate governance in the UAE covers board structures. To discuss your governance documents or a control failure with legal consequences, contact TRW & Co on info@trw.co or +971 58 942 1012.
Frequently asked questions
01Is ICFR mandatory for private companies in the UAE?
There is no stand-alone ICFR statute for private LLCs or free zone companies. However, company law requires accurate accounting records and an annual audit for most company forms, and managers owe duties of care that are hard to discharge without adequate controls. Lenders, investors and foreign parent groups also frequently require documented controls. In practice, a private company that cannot show how its numbers are controlled faces qualified audit opinions, weaker tax audit positions and greater personal exposure for its managers.
02What do listed UAE companies need to do on ICFR?
Listed public joint stock companies must have a board-approved internal control framework, with COSO accepted as the model. Under the phased approach introduced by a January 2025 circular, senior management self-assesses ICFR, remediates gaps, and the external auditor reports to the board before moving to a formal opinion. Published commentary indicates a later circular extended the trial phase through the 2026 financial year, with public reporting expected from 2027. Confirm the current requirements with the Capital Market Authority and your auditor.
03What is the difference between ICFR and a financial control audit?
ICFR is the system itself: the controls that keep financial reporting reliable. A financial control audit is a review of that system, usually by internal auditors or an adviser, testing whether controls over bookkeeping, approvals and reporting are adequate and working. An external auditor may also report on ICFR where the regime requires it. The three should be coordinated so that internal work can be relied on and nobody tests controls they designed.
04How long does it take to implement ICFR?
For a mid-sized single-entity business, documenting processes, building a risk and control matrix, testing and remediating usually takes several months. For a listed group with multiple subsidiaries, foreign operations and an ERP migration, a first full cycle can take a year or more. The timeline depends mainly on how well processes are already documented, the quality of IT general controls, and how quickly control owners fix deficiencies. Starting with the highest-risk processes gives early value.
05What is a material weakness?
A material weakness is a deficiency, or combination of deficiencies, creating a reasonable possibility that a material misstatement in the financial statements will not be prevented or detected on time. Lesser deficiencies are classified as significant deficiencies or control deficiencies. The classification matters because material weaknesses are usually reported to the audit committee and, under some regimes, publicly. They also attract scrutiny from tax authorities, lenders and regulators, and may affect directors’ positions if a misstatement occurs.
06Can TRW & Co carry out ICFR testing?
The accounting, control testing and audit work is delivered with our group company A&A Consultancy. TRW & Co is a law firm and does not act as an auditor. We cover the legal and regulatory side: interpreting CMA, ADAA, Central Bank and free zone requirements, drafting board and committee charters and delegations of authority, advising directors on their exposure, and handling the legal consequences of control failures, including tax disclosures, AML issues and disputes.
Sources and official materials
- Federal Decree-Law No. 32 of 2021 on Commercial Companies — Accounting records, audit and directors’ duties
- Capital Market Authority — Governance guide and ICFR circulars for listed companies
- COSO Internal Control – Integrated Framework — Five components and seventeen principles of internal control
- Central Bank of the UAE Corporate Governance Regulation (C 83/2019) — Board responsibility for internal control in banks
- Federal Decree-Law No. 47 of 2022 (Corporate Tax Law) — Article 56 record keeping for seven years
- Federal Tax Authority — VAT and corporate tax audits and guidance
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
