TRW & Co · Accounting, audit and bookkeeping
Building an Enterprise Risk Management Framework in the UAE
A risk management framework UAE companies can rely on combines a board-approved risk appetite, a working risk register, clear ownership and an assurance map. Banks, insurers, listed companies and DIFC or ADGM firms must have one; private groups need one to satisfy investors and protect directors. This guide covers regulators, methods, implementation and the legal value of the record.
Key pointThe legal protection a framework gives directors comes from minuted decisions on top risks against appetite, not from the register itself; a long register with no recorded decisions can count against a board.
At a glance
Banks face strict rules
The Central Bank Risk Management Regulation requires board-approved risk appetite, limits for each risk category and an independent chief risk officer reporting to the board.
Listed companies included
The amended governance guide requires listed companies to adopt a risk management framework, with COSO recommended and internal audit assessing its effectiveness.
Three common methods
ISO 31000, COSO Enterprise Risk Management and the IIA Three Lines Model are combined by most UAE groups, with sector rules layered on top.
Assurance map reveals gaps
Mapping first, second and third line assurance against each top risk shows the board where independent assurance is missing or duplicated.
Records protect directors
Documented appetite, quarterly risk reports and minuted decisions show that directors exercised care under company law and in regulatory or insolvency reviews.
Swipe or scroll →
Risk management framework UAE companies: the short answer
A risk management framework UAE companies can defend to a regulator, lender or court has five working parts: a board-approved risk appetite, a risk register that is actually used, clear ownership of each risk, controls and assurance mapped to the biggest risks, and regular reporting that leads to decisions. Everything else, including software, heat maps and committee names, is secondary.
For banks, insurers, listed companies and firms in the DIFC and ADGM, a formal framework is a regulatory requirement. For private groups, it is how directors show they exercised care, how lenders and investors judge governance, and how the business avoids being surprised by tax, AML, cyber and contract risks that UAE law now treats seriously.
The risk assurance reviews and internal audit work described below are delivered with our group company A&A Consultancy. TRW & Co, as a law firm, covers the legal and regulatory side: mapping regulatory obligations, drafting board and committee mandates and policies, and advising directors on liability.
Which UAE regulators expect formal risk management
Expectations differ sharply by sector, and the risk management framework UAE companies need depends first on whether they are regulated. The most demanding regimes are summarised here; where a group has a regulated subsidiary, its framework usually becomes the template for the whole group.
Banks and finance companies
The Central Bank's Risk Management Regulation and accompanying Standards (Circular 153/2018) require the board to own a risk governance framework proportionate to the bank's size and complexity, approve a risk appetite statement with limits for each material risk category, and appoint a chief risk officer who leads an independent risk function reporting directly to the board or its risk committee. Significant breaches of appetite must be acted on immediately and, where material, notified to the Central Bank. The Corporate Governance Regulation for banks adds board committee and control function requirements. Islamic banks have further standards covering Shari'ah-specific risks.
Insurers
Insurance companies, now supervised by the Central Bank following the merger of the former Insurance Authority, face governance and risk management requirements tailored to underwriting, reserving, reinsurance and investment risk. Our page on insurance and reinsurance in the UAE covers the licensing context.
Listed companies
The corporate governance guide for public joint stock companies, administered by the Capital Market Authority (formerly the Securities and Commodities Authority), was amended in 2024 to require a risk management framework, with COSO recommended. Internal audit must independently assess risk management effectiveness, and the audit committee reports on failures and corrective plans. Published commentary on the regulator's internal control circulars indicates that risk management will be brought within the reporting scope from 2028, after the internal controls over financial reporting phase.
DIFC and ADGM firms
The DFSA and the ADGM Financial Services Regulatory Authority require authorised firms to maintain risk management systems and controls appropriate to their business, with clear senior management responsibility and, for larger firms, an independent risk function. See our pages on DIFC financial regulation and ADGM financial regulation.
Every business: AML, tax, data and climate
Even unregulated companies face risk-based legal duties. The AML framework under Federal Decree-Law No. 10 of 2025 requires financial institutions and designated non-financial businesses to assess and document their money laundering risks and apply proportionate controls, with suspicious transactions reported to the Financial Intelligence Unit. The personal data protection law expects security proportionate to risk, and the climate law requires emitting entities to measure and report greenhouse gas emissions. A framework that ignores these legal risks is incomplete.
Choosing a framework: ISO 31000, COSO ERM and the Three Lines Model
No UAE regulator mandates one methodology for all companies, but three international references dominate any risk management framework UAE companies build.
| Framework | Strength | Best suited to | Watch out for |
|---|---|---|---|
| ISO 31000 (Risk management guidelines) | Short, principles-based, easy to scale; widely recognised internationally | Private groups, family businesses, government suppliers and companies starting out | Gives principles, not detailed controls; needs internal procedures to work |
| COSO Enterprise Risk Management (2017) | Links risk to strategy and performance; same family as the COSO internal control framework auditors use | Listed companies and groups building ICFR alongside ERM | Can become heavy if applied mechanically to a small business |
| IIA Three Lines Model | Clarifies who owns, oversees and independently assures risk | Any organisation with a board, management and an internal audit function | Describes roles, not a full risk process; use with ISO 31000 or COSO |
| Sector rules (Central Bank, DFSA, FSRA) | Mandatory; set specific roles such as the chief risk officer and risk committee | Banks, insurers, finance companies and authorised firms | Must be followed even where a general framework suggests otherwise |
Most UAE groups combine them: COSO or ISO 31000 for the process, the Three Lines Model for roles, and any sector rules on top.
The building blocks: register, appetite and assurance map
Risk register
The register lists each material risk with a description of cause and consequence, an owner, inherent and residual ratings, key controls, key risk indicators and action plans. It should cover strategic, financial, operational, legal and regulatory, technology, people and reputational risk. UAE-specific entries commonly include licence and activity compliance, Emiratisation targets, corporate tax and transfer pricing, VAT, AML and sanctions exposure, data protection, concentration on a few customers or a single free zone, and foreign exchange or banking access risk.
Risk appetite
Appetite statements turn the board's attitude into limits management can apply. Good statements are specific: "no tolerance for sanctions breaches", "customer concentration not to exceed a stated share of revenue", "no material unreconciled VAT differences at any quarter end". Each statement should have a metric, a threshold and an escalation trigger.
Assurance map
An assurance map shows, for each top risk, who provides assurance and how strong it is: management self-assessment (first line), risk and compliance oversight (second line), internal audit (third line) and external sources such as the statutory auditor, regulators or specialist reviewers. Gaps and duplication become obvious, and the board can direct internal audit to where assurance is weakest.
Key risk indicators
Indicators give early warning before a risk crystallises. Useful examples include receivables ageing on government contracts, the number of unreconciled intercompany items at month end, overdue sanctions screening alerts, staff turnover in finance, and open regulatory findings. The best indicators in a risk management framework UAE companies run are already produced by existing systems, so monitoring them costs little.
Proportionality for smaller businesses
A small or owner-managed business does not need a chief risk officer or a separate risk committee. A risk management framework UAE companies of that size can sustain might be a two-page policy, a register of fifteen to twenty risks reviewed by the owners each quarter, and an annual external check. What matters is that it is real, current and recorded, and that it grows as the business takes on investors, lenders or regulated activities.
A register with sixty risks and no decisions attached is a liability, not a defence. Boards should see a short list of top risks against appetite each quarter, with a recorded decision on each: accept, treat, transfer or exit. Those minutes are what demonstrate care if something goes wrong.
Implementing a risk management framework UAE companies can sustain
- Map obligations. List the laws, regulators, licences and contracts that impose risk-related duties, from Central Bank rules to lender covenants and free zone conditions.
- Set governance. Approve a risk policy, define board and committee responsibilities, and appoint a risk lead with access to the board.
- Agree appetite. Hold a board workshop to set appetite statements, metrics and thresholds for each risk category.
- Identify and assess. Run structured workshops with each business unit to populate the register, rating likelihood and impact consistently.
- Link controls and indicators. Map existing controls to each risk, identify gaps and define key risk indicators that warn early.
- Build the assurance map. Record who provides assurance on each top risk and plan internal audit coverage accordingly.
- Report and decide. Establish quarterly reporting to the risk or audit committee, with escalation rules for breaches.
- Review annually. Refresh the register, appetite and assurance map, and commission an independent review of the framework periodically.
Risk assurance reviews and directors' protection
A risk assurance review is an independent assessment of whether the framework is designed sensibly and working in practice: whether appetite is respected, risks are rated consistently, controls exist and key indicators are reported. Internal audit, or an external reviewer where the function is small, typically performs it.
The legal value lies in the record. Under the Commercial Companies Law, managers and directors must act with care and can be liable for mismanagement and breaches of law. In regulated sectors, senior individuals can face personal enforcement. Insolvency rules allow courts to look at how management behaved as a company declined. In each setting, the question is what the board knew and what it did. Documented appetite, risk reports and minuted decisions answer that question; their absence leaves directors relying on memory. Our guide to directors' duties and liability covers the standards.
A risk management framework UAE companies actually use is the clearest evidence that directors exercised care.
Directors' and officers' insurance also interacts with the framework. Insurers ask about governance and risk processes at renewal, and policy exclusions for known circumstances make early identification and notification of risks important.
Illustrative scenario
This scenario is illustrative only and does not describe a real client. A family-owned contracting and facilities group with onshore entities in Dubai and Abu Dhabi and a free zone procurement company plans to bring in a private equity investor. Due diligence questions reveal that the group has no risk register and that the board has never discussed risk appetite.
The group adopts ISO 31000 and the Three Lines Model. Workshops identify top risks including payment delays on government projects, concentration on a small number of main contractors, subcontractor safety, corporate tax treatment of intra-group procurement margins, and sanctions screening of suppliers. Appetite statements are set for receivables ageing, customer concentration and sanctions exposure. An assurance map shows that tax and sanctions risks have no independent assurance, so internal audit coverage is added.
On the legal side, the board adopts a risk policy and committee terms of reference, the shareholders' agreement with the incoming investor references the framework and reporting rights, and supplier contracts are updated with sanctions and compliance clauses. The investor's diligence findings narrow, and the governance covenants in the investment documents reflect what the business already does.
Risks and common mistakes
Copying a template register
Generic registers list risks that could apply anywhere and miss the ones that matter in the UAE, such as licence activity mismatches, Emiratisation shortfalls, free zone restrictions on onshore trading, or corporate tax exposure on related-party transactions. They also give the board false comfort. Build the register from workshops with the people who run the business, then challenge it against the regulatory map and recent incidents. A shorter, specific register that drives decisions is worth more than a long generic one.
No link between appetite and limits
Appetite statements written in general language ("low appetite for compliance risk") cannot be monitored and therefore cannot be breached. Regulators, particularly the Central Bank, expect appetite to cascade into measurable limits with escalation when a limit is approached or exceeded. Private companies benefit from the same discipline. Each statement needs a metric, a threshold, an owner and a defined response, and the board should see the metrics regularly rather than only when something has already gone wrong.
Treating legal and regulatory risk as someone else's job
Finance-led frameworks often rate legal risk generically and leave it to external counsel when a dispute arrives. In the UAE, legal and regulatory change is frequent: new company, civil transactions, AML, capital markets and tax rules took effect in 2025 and 2026. The framework should include a regulatory horizon scan, owners for each major obligation, and a process for assessing contract and dispute exposure. Legal input at the design stage is far cheaper than at the enforcement stage.
Internal audit marking its own homework
Where the same person designs risk processes and then audits them, the board loses independent assurance. Smaller groups often combine risk and internal audit roles to save cost. If that is unavoidable, outsource or co-source the assurance review of the risk function, keep internal audit's reporting line direct to the audit committee, and record how independence is protected. Regulated firms should check whether their regulator's rules prohibit the combination outright.
Cross-border and group considerations
Groups headquartered in the UAE with subsidiaries abroad, or UAE subsidiaries of foreign groups, need a framework that satisfies more than one regulator. A UAE bank's foreign branch must meet host-country rules; a UAE subsidiary of a Saudi or United Kingdom listed group will report into that group's framework. The usual solution is a single group methodology with local annexes for sector and country rules.
For groups operating in Bangladesh, India, Singapore or China, where TRW & Co's network is active, the risk map should include foreign exchange controls, repatriation limits and local licensing risks, which often matter more than the UAE-side exposures.
What to do next
- Map the regulators, licences and contracts that impose risk management duties on each group entity.
- Choose ISO 31000 or COSO ERM for process and the Three Lines Model for roles, and record the choice in a board-approved policy.
- Run a board appetite workshop and set measurable thresholds.
- Build a specific register and an assurance map for the top risks.
- Commission a periodic independent risk assurance review.
- Minute board decisions on top risks every quarter.
The framework sits above the controls described in our guide to internal controls over financial reporting, and connects to corporate governance and AML compliance. To review your governance documents or regulatory obligations, contact TRW & Co on info@trw.co or +971 58 942 1012.
Frequently asked questions
01Is risk management a legal requirement for UAE companies?
It is an explicit requirement for banks, finance companies and insurers under Central Bank rules, for listed companies under the governance guide administered by the Capital Market Authority, and for authorised firms in the DIFC and ADGM. Other companies have no single risk management statute, but company law requires directors and managers to act with care, AML law requires regulated businesses to assess risk, and lenders and investors routinely require a framework. In practice, a documented framework is expected of any substantial business.
02What should a risk register contain?
Each entry should describe the risk, its causes and consequences, the owner, inherent and residual ratings for likelihood and impact, the key controls, key risk indicators and any action plan with dates. The register should cover strategic, financial, operational, legal and regulatory, technology, people and reputational risks. UAE groups should include licence compliance, Emiratisation, corporate tax and VAT, AML and sanctions, data protection and banking access risks where relevant.
03What is a risk appetite statement?
It is a board-approved statement of how much risk the organisation is willing to accept in pursuit of its objectives, broken down by risk category. Effective statements are measurable: each has a metric, a threshold and an escalation trigger. For example, a company may have no tolerance for sanctions breaches and a stated maximum customer concentration. The Central Bank requires banks to have one; other companies benefit from the same discipline.
04What is the difference between ISO 31000 and COSO ERM?
ISO 31000 is a short, principles-based guideline that scales easily and suits private groups and organisations starting out. COSO Enterprise Risk Management links risk to strategy and performance in more detail and shares a family with the COSO internal control framework auditors use, which makes it attractive to listed companies building internal controls over financial reporting. Many UAE groups use one for process and the IIA Three Lines Model to define roles.
05What is a risk assurance review?
It is an independent assessment of whether the risk management framework is designed appropriately and operating as intended. It checks that appetite is respected, risks are rated consistently, controls exist and work, key indicators are reported, and the board receives and acts on information. Internal audit usually performs it, or an external reviewer where the internal function is small or not independent of risk management. The findings go to the audit or risk committee.
06How does TRW & Co work with A&A Consultancy on risk frameworks?
Risk assurance reviews, internal audit and control testing are delivered with our group company A&A Consultancy. TRW & Co is a law firm and covers the legal and regulatory side: identifying which regulators and laws apply, drafting risk policies, committee terms of reference and delegations of authority, reviewing contracts that transfer risk, and advising directors on their duties and exposure. We do not act as auditors.
Sources and official materials
- Central Bank of the UAE Corporate Governance Regulation (C 83/2019) — Board, committee and control function requirements for banks
- Capital Market Authority — Governance guide for listed companies, including risk management
- COSO — Enterprise risk management and internal control frameworks
- IIA Three Lines Model — Roles of governing body, management and internal audit
- ADGM Financial Services Regulatory Authority — Systems and controls rules for ADGM authorised firms
- Federal Decree-Law No. 32 of 2021 on Commercial Companies — Duties and liability of directors and managers
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
