TRW & Co · Audit and assurance
Review Engagements vs Audits in the UAE: When a Review Is Enough
The review engagement vs audit choice turns on assurance. An audit gives reasonable assurance and a positive opinion; a review under ISRE 2400 (Revised) gives limited assurance from inquiry and analytics. In the UAE a review cannot replace a legally required audit, but it can satisfy owners, investors and some lenders. This guide explains the standards, costs and when each is accepted.
Key pointA review never satisfies a statutory audit duty, and a qualifying free zone person needs audited accounts whatever its size, so the first question is legal, not commercial: check company law, free zone and corporate tax rules before comparing fees.
At a glance
Two levels of assurance
An audit gives reasonable assurance and a positive opinion; a review gives limited assurance with a negative-form conclusion based mainly on inquiry and analytics.
Reviews cannot replace audits
LLCs, joint stock companies, most free zone companies, qualifying free zone persons, tax groups and taxpayers above AED 50 million need audited accounts.
Agreed-upon procedures give findings
ISRS 4400 (Revised) engagements report factual findings with no assurance and do not require independence unless the parties agree it.
ADGM small companies
ADGM allows qualifying small companies to file unaudited accounts, so a review can give owners and banks comfort at lower cost.
Interim review standard changing
The IAASB issued an exposure draft revising ISRE 2410 on interim reviews in May 2026; consultation closed in September 2026.
Swipe or scroll →
Review engagement vs audit: the short answer
The review engagement vs audit choice comes down to the level of assurance a reader needs. An audit gives reasonable assurance: the auditor tests transactions, balances and controls, gathers external evidence and expresses a positive opinion that the financial statements give a true and fair view. A review gives limited assurance: the practitioner relies mainly on inquiry and analytical procedures and concludes, in negative form, that nothing has come to their attention suggesting the statements are materially misstated.
A review is cheaper and quicker, but it is not a substitute where UAE law, a free zone, a tax rule or a regulator requires an audit. Mainland LLCs and joint stock companies, most free zone companies, qualifying free zone persons, tax groups and taxpayers with revenue above AED 50 million need audited accounts. A review is useful for entities outside those rules, for interim periods, and for owners, investors and lenders who want independent comfort without the cost of a full audit.
This guide explains the international standards behind reviews, agreed-upon procedures and compilations, how they differ from an audit in assurance and cost, and when UAE authorities, banks and free zones are likely to accept them. The review and audit work itself is delivered with our group company A&A Consultancy; TRW & Co, as a law firm, covers the legal and regulatory side.
The four engagement types and their standards
All four engagement types are set by the International Auditing and Assurance Standards Board and are used in the UAE.
- Audit (International Standards on Auditing). Reasonable assurance and a positive opinion. Requires risk assessment, tests of controls where relied on, substantive testing and external confirmations.
- Review of historical financial statements (ISRE 2400 (Revised)). Limited assurance and a negatively expressed conclusion. Performed by a practitioner who is not the entity's auditor.
- Review of interim financial information by the entity's auditor (ISRE 2410). Used mostly for half-year or quarterly statements. According to the IAASB's project tracker, an exposure draft revising ISRE 2410 was issued in May 2026 and consultation closed in September 2026.
- Agreed-upon procedures (ISRS 4400 (Revised)). No assurance. The practitioner performs procedures agreed with the engaging party and reports factual findings. The revised standard does not require independence by default, although the parties may agree it.
- Compilation (ISRS 4410 (Revised)). No assurance. The accountant helps management prepare and present financial information. The report makes clear that it is not an audit or review.
| Feature | Audit | Review | Agreed-upon procedures | Compilation |
|---|---|---|---|---|
| Assurance | Reasonable | Limited | None | None |
| Main procedures | Risk assessment, controls testing, substantive testing, confirmations | Inquiry and analytical procedures, with more work if issues appear | Specific procedures agreed in advance | Preparing and presenting financial information |
| Report | Positive opinion | Negative-form conclusion | Factual findings | Compilation report |
| Independence | Required | Required | Not required unless agreed | Not required |
| Relative cost and time | Highest | Moderate | Depends on scope | Lowest |
| Satisfies a UAE statutory audit duty? | Yes, if signed by a licensed auditor | No | No | No |
"Limited assurance" is meaningful, but it is not a lighter audit. A reviewer does not normally confirm balances with banks or customers, attend stock counts or test controls. If inquiry and analytics point to a problem, the reviewer must do more work, but absent such indicators the procedures stay narrow.
When an audit is required and a review will not do
For many UAE businesses, the review engagement vs audit question is answered by law before cost enters the picture.
- Mainland companies. The Commercial Companies Law (Federal Decree-Law No. 32 of 2021, as amended most recently by Federal Decree-Law No. 20 of 2025, in force since late 2025) requires LLCs and joint stock companies to have their accounts audited each year by a licensed auditor.
- Free zone companies. Most free zones require annual audited accounts, often from an approved auditor, as a condition of licence renewal.
- Corporate tax. Ministerial Decision No. 84 of 2025 requires audited financial statements from a taxable person with revenue above AED 50 million, from every qualifying free zone person, whatever its size, and from every tax group. Our guide to audited financial statements for corporate tax explains the detail.
- Regulated firms. Banks, insurers, DFSA and FSRA authorised firms and other regulated entities face audit requirements under their regulators' rules.
The auditor signing a statutory audit must be licensed under Federal Decree-Law No. 41 of 2023 and, where relevant, approved by the free zone or regulator. A review report, however well performed, will not satisfy those requirements. See our guide to statutory audit requirements for the entity-by-entity position.
When a review may be enough
Outside the mandatory audit categories, the review engagement vs audit decision is a commercial one. A review is often appropriate in the following cases.
Entities without a statutory audit duty
The Commercial Companies Law's annual audit requirement applies to LLCs and joint stock companies. Sole establishments and some other forms fall outside it, although they remain subject to corporate tax rules, and licensing authorities may set their own conditions for branches. In ADGM, companies that qualify under the small companies regime may file unaudited accounts, as explained on the ADGM annual accounts page. For businesses like these, a review can give owners and banks independent comfort without a full audit.
Corporate tax below the thresholds
A standalone taxpayer with revenue of AED 50 million or less, that is not a qualifying free zone person or part of a tax group, has no corporate tax audit requirement. It still needs financial statements prepared under an accepted framework. A review can improve the reliability of those statements before the return is filed, particularly in the first years of the regime.
Interim periods and covenants
Lenders often require annual audited accounts plus quarterly or half-year management accounts. Where they want more comfort on interim figures, a review (or agreed-upon procedures on specific covenant figures) is a common compromise. Our page on secured lending in the UAE covers how reporting covenants are negotiated.
Banks and smaller facilities
Banks set their own credit policies. For small facilities some accept reviewed or management accounts; for larger facilities audited accounts are usually required. There is no general rule, so the borrower should ask the bank what it will accept before commissioning work.
Independent accounting reviews for owners and investors
Owners and investors often want an independent view of the numbers without commissioning a statutory audit. Typical cases include:
- Minority shareholders and family members who do not run the business and want comfort on the accounts management presents. A shareholders' agreement can give a right to commission a review or agreed-upon procedures at defined intervals. See our guide to shareholders' agreements.
- Investors before a funding round who want a quick, independent look at the latest management accounts, often alongside or before full financial due diligence.
- Owners managing from abroad who rely on local management and want periodic independent checks on cash, receivables and payables.
- Founders preparing for an audit for the first time, who use a review to clean up the books before the statutory auditor arrives.
For these users, agreed-upon procedures are often more useful than a review. They can target the exact risk (for example, testing that all bank accounts are recorded, or that related-party payments were approved) and report findings without the cost of a full review. The engagement letter should name the users entitled to rely on the report and set out the procedures precisely.
Before commissioning any engagement, ask the person who will read the report a simple written question: "Which standard and which type of report will you accept, and from whom?" The answer usually settles the review engagement vs audit choice and avoids paying for work that is rejected.
How a review engagement works
- Agree terms. The engagement letter sets the framework (for example IFRS or IFRS for SMEs), the standard (ISRE 2400 (Revised)), the intended users and the form of report.
- Understand the business. The practitioner learns the entity, its industry, accounting systems and the areas where material misstatement is likely.
- Make inquiries. Management is asked about accounting policies, significant transactions, related parties, going concern, subsequent events and fraud.
- Perform analytical procedures. Ratios, trends and relationships are compared with expectations, prior periods and budgets, and unexpected movements are investigated.
- Do additional work if needed. Where inquiry and analytics suggest a material misstatement, the practitioner performs further procedures until satisfied or unable to conclude.
- Obtain written representations. Management confirms its responsibilities and the completeness of information given.
- Issue the report. The conclusion is unmodified, or modified (qualified, adverse or disclaimed) where issues remain.
An illustrative scenario
Illustrative only; the parties and facts are hypothetical.
A family business group has a mainland LLC, a sole establishment and an ADGM holding company that qualifies as small. A family member living abroad holds a minority stake in the LLC and asks for "independent accounts" for all three entities.
Analysis of the review engagement vs audit options shows that the LLC needs a statutory audit under the Commercial Companies Law regardless of the family's wishes. The sole establishment has no statutory audit duty and revenue below the corporate tax audit threshold, so a review under ISRE 2400 (Revised) gives the family comfort at lower cost. The ADGM holding company can file unaudited accounts under the small companies regime; the family opts for agreed-upon procedures on its bank balances and intercompany loans. The shareholders' agreement is updated to give the minority holder a right to these reports each year.
Risks and common mistakes
Commissioning a review where an audit is legally required
A review does not satisfy the Commercial Companies Law, free zone audit rules or corporate tax audit requirements. If an LLC or qualifying free zone person files reviewed rather than audited accounts, the licensing authority may refuse renewal and the company may lose tax status or face penalties. Check the legal requirement first; the cost saving of a review disappears if the work has to be redone as an audit under deadline pressure.
Misdescribing the report to third parties
Calling reviewed accounts "audited" in a bank application, investor deck or tender response is a misrepresentation that can give rise to liability and, in serious cases, criminal exposure. Use the exact description in the practitioner's report, and attach the report itself where accounts are shared. The same applies to agreed-upon procedures, which provide no assurance at all and must not be presented as a review or an audit.
Unclear reliance and liability terms
Reviews and agreed-upon procedures are often commissioned by one party for the benefit of another, such as an owner for a lender or an investor. If the engagement letter does not name who may rely on the report, disputes about reliance and liability can follow. Agree the intended users, any limitation of liability and whether third parties may receive the report, and reflect those terms in the shareholders' or facility agreement.
Treating limited assurance as a fraud check
A review is designed to detect material misstatement through inquiry and analysis, not to uncover concealed fraud. Owners who suspect irregularities should not rely on a review. A targeted forensic engagement or agreed-upon procedures focused on the specific concern, such as cash, payroll or related-party payments, is more appropriate and produces evidence that can be used if a dispute follows.
Cross-border groups and the review engagement vs audit question
For UAE subsidiaries of foreign groups, the review engagement vs audit decision is often shaped by the parent's reporting, not only by UAE rules. Three situations come up regularly.
- Group audit instructions. When a parent in the UK, India, Singapore, China or elsewhere is audited, the group auditor decides how much work it needs on each component. It may ask for a full-scope audit of a significant UAE subsidiary, a review of a smaller one, or specified procedures on particular balances. Those instructions are separate from, and additional to, any UAE statutory audit the subsidiary needs.
- Inbound investment and joint ventures. Foreign investors in a UAE company often negotiate information rights that specify audited annual accounts and reviewed interim accounts. The wording should match what UAE law already requires, so the company does not commission two overlapping engagements.
- UAE parents with foreign subsidiaries. A UAE holding company may need reviewed or audited figures from subsidiaries abroad to prepare its own audited statements. Local law in each country determines whether those subsidiaries need their own statutory audit.
Coordinating the UAE statutory auditor, the group auditor and any reviewer from the start avoids duplicated work and conflicting timetables. Where a single firm or network can deliver the statutory audit and the group reporting package together, cost and timing usually improve.
Timing and cost in practice
A review is typically completed faster than an audit because it involves no external confirmations, stock count attendance or controls testing. But speed depends on the books. A reviewer who finds unreconciled bank accounts, missing invoices or unexplained movements must investigate before concluding, and that can erode the cost advantage. Businesses that keep monthly reconciliations up to date get the most value from the review engagement vs audit trade-off.
Checklist: choosing between a review and an audit
- Identify every legal and regulatory audit requirement for each entity: company law, free zone rules, corporate tax and any regulator.
- Ask each user of the report (bank, investor, shareholder, authority) what standard and report type they accept.
- Use a review where limited assurance is enough and no audit is legally required.
- Use agreed-upon procedures where a user needs findings on specific items rather than the whole statements.
- Name the intended users and reliance terms in the engagement letter.
- Describe the report accurately whenever accounts are shared.
Reviews, audits, agreed-upon procedures and compilations are delivered with our group company A&A Consultancy. TRW & Co advises on the legal side: which engagement satisfies company law, free zone and tax rules, reporting rights in shareholders' and facility agreements, and reliance and liability terms. Our guide to the types of audit in the UAE covers related engagements. To discuss your entities, contact our Dubai team at info@trw.co or +971 58 942 1012.
Frequently asked questions
01What is the difference between a review engagement and an audit?
An audit provides reasonable assurance: the auditor assesses risk, tests controls and transactions, obtains external confirmations and expresses a positive opinion on whether the financial statements give a true and fair view. A review under ISRE 2400 (Revised) provides limited assurance: the practitioner relies mainly on inquiry and analytical procedures and concludes that nothing has come to their attention indicating material misstatement. A review is quicker and cheaper but does not involve the same depth of evidence.
02Can a review replace a statutory audit in the UAE?
No. Where the Commercial Companies Law, free zone regulations, corporate tax rules or a regulator require audited financial statements, only an audit by a licensed (and, where needed, approved) auditor will satisfy the requirement. This covers mainland LLCs and joint stock companies, most free zone companies, every qualifying free zone person, every tax group and taxpayers with revenue above AED 50 million. A review is an option only for entities and purposes outside those rules.
03Will a UAE bank accept reviewed financial statements?
It depends on the bank's credit policy and the size of the facility. Some banks accept reviewed or management accounts for small facilities or for interim reporting, while larger facilities usually require audited annual accounts. Facility agreements often specify exactly what must be delivered. Ask the relationship manager in writing what will be accepted before commissioning work, and make sure the facility agreement reflects the agreed reporting.
04What are agreed-upon procedures used for?
Agreed-upon procedures under ISRS 4400 (Revised) are used where a user needs factual findings on specific items rather than assurance on whole financial statements. Examples include checking covenant calculations for a lender, verifying royalty or turnover figures for a franchisor or landlord, testing grant expenditure, or confirming bank balances and intercompany loans for a shareholder. The practitioner reports what was done and found, and the user draws its own conclusions. No opinion or assurance is given.
05Is a review cheaper than an audit?
Generally yes, because a review involves fewer procedures: mainly inquiry and analytics, without routine confirmations, stock count attendance or controls testing. The actual fee depends on the size and complexity of the business, the quality of the books and whether issues arise that require additional work. A poorly maintained ledger can make a review expensive. Agreed-upon procedures can be cheaper still if the scope is narrow, and a compilation is usually the least costly.
06Who performs reviews and audits at TRW & Co?
TRW & Co is a law firm and is not a registered auditor. Reviews, audits, agreed-upon procedures and compilations are delivered with our group company A&A Consultancy. TRW & Co advises on the legal and regulatory side: which engagement satisfies company law, free zone and tax requirements, reporting rights in shareholders' and facility agreements, reliance and liability terms, and any dispute that arises from the figures.
Sources and official materials
- IAASB: Standards and pronouncements — ISAs, ISRE 2400 (Revised), ISRE 2410, ISRS 4400 (Revised) and ISRS 4410 (Revised)
- IAASB: Latest on our projects — Status of the ISRE 2410 revision
- Federal Decree-Law No. 32 of 2021 on Commercial Companies — Annual audit duty for LLCs and joint stock companies
- Ministerial Decision No. 84 of 2025 on Audited Financial Statements — Who must prepare audited financial statements for corporate tax
- ADGM Registration Authority: Annual Accounts — Filing deadlines and the small companies audit exemption
- Federal Decree-Law No. 41 of 2023 on Regulating the Auditing and Accounting Professions — Licensing of auditors who sign statutory audit reports
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
