- +971-4-572 9701
- chirag@athosauditors.com
Internal audit is an independent review of how effectively a company manages risk, operates its internal controls and follows its governance and compliance procedures. It gives management, the board or the audit committee an objective view of whether important business processes are working as intended.
An internal audit may cover finance, procurement, sales, inventory, payroll, information systems, regulatory compliance, fraud risk, delegation of authority and other areas that affect the company’s operations.
Internal audit does not replace management or take ownership of business controls. Management remains responsible for designing controls, maintaining records and implementing agreed corrective actions.
The Institute of Internal Auditors describes internal auditing as an independent assurance and advisory service that evaluates governance, risk management and control processes. Its current Global Internal Audit Standards became effective on 9 January 2025.
Internal audit is not mandatory for every private mainland or free zone company in the UAE. Whether a company must maintain an internal audit function depends on its legal form, sector, regulator, governance framework and licence conditions.
The annual audit required under the UAE Commercial Companies Law is an external financial statement audit. Article 102 of Federal Decree-Law No. 32 of 2021 requires limited liability companies to appoint an auditor, but this should not be confused with an internal audit.
Internal audit requirements apply more directly to certain regulated businesses. The CBUAE Rulebook requires banks to maintain an independent and effective internal audit function. Similar requirements apply to other CBUAE-regulated businesses according to their applicable regulations.
Under DFSA GEN Rule 5.3.13, an authorised person must establish an internal audit function that is independent from operational and business functions, subject to the stated venture capital fund exception. Certain ADGM-regulated managers must also maintain internal audit arrangements appropriate to the size and complexity of their operations, which may be outsourced to an independent provider.
Public joint-stock companies and other listed or regulated entities may have additional requirements under the relevant SCA, CBUAE, DFSA or FSRA governance rules.
Even where it is voluntary, internal audit is commonly used by growing companies, family businesses, corporate groups and organisations with multiple branches, large transaction volumes or weak internal controls.
Athos Auditors can perform a full outsourced internal audit function, support an existing internal audit department or carry out a focused review of a particular process or risk area.
We begin by understanding the company’s activities, structure, systems, reporting lines and regulatory environment. Key financial, operational, compliance and technology risks are assessed according to their likelihood and possible impact.
The risk assessment is used to define the audit universe and prepare a risk-based internal audit plan. Higher-risk processes receive greater audit coverage instead of applying the same checklist to every department.
Our internal auditors review whether the company’s controls are properly designed, documented and operating in practice. The work can cover approval limits, segregation of duties, system access, reconciliations, physical controls, record keeping and management supervision.
The review distinguishes between a missing control, a poorly designed control and a control that exists but is not being followed. This allows management to address the actual cause of the weakness.
We examine the controls supporting financial statements, management reports and accounting records. This may include revenue recognition, expenses, receivables, payables, bank reconciliations, journal entries, fixed assets, inventory and related-party transactions.
The purpose is not to issue an external audit opinion. It is to assess whether financial information is complete, supported, reviewed and reported through an effective control process.
An operational audit examines whether business processes are controlled and working according to approved policies. We review the movement of transactions from their starting point through approval, processing, recording and reporting.
The scope may cover procurement, order-to-cash, inventory management, payroll, treasury, project management, branch operations or another process selected by management.
A compliance audit checks whether the company is following the laws, licence conditions, internal policies, contracts and regulatory requirements that apply to its activities.
The exact scope depends on the company’s industry and regulator. It may include corporate governance, AML and CFT controls, VAT procedures, corporate tax controls, employment processes, data handling or free zone requirements.
An internal compliance audit identifies control gaps and areas of non-compliance. It does not replace legal advice, tax filing or the company’s responsibility to comply with the relevant rules.
Internal audit can assess where fraud, unauthorised payments, asset misuse or management override may occur. We examine access rights, approval procedures, supporting records, supplier controls, cash handling, inventory movement and unusual transactions.
Where a specific allegation or suspected irregularity already exists, a separate forensic investigation may be more appropriate than a routine internal audit.
Where technology risks fall within the agreed scope, we review user access, privileged accounts, system changes, data backups, incident response, third-party access and business continuity controls.
The objective is to determine whether technology controls support the reliability of financial and operational information and protect critical business systems.
Policies and standard operating procedures should reflect how the company currently operates. We compare documented procedures with actual practice and identify outdated, incomplete or conflicting requirements.
Where necessary, recommendations are made to clarify responsibilities, approval limits, required evidence and escalation procedures.
An internal audit is not complete when the report is issued. A follow-up review checks whether management has implemented the agreed corrective actions and whether the revised controls are working.
Outstanding findings are reported according to their risk level, responsible owner and agreed completion date.
| Area | Internal audit | External audit |
|---|---|---|
| Main purpose | Reviews governance, risk management, internal controls and operations | Provides an independent opinion on financial statements |
| Primary users | Management, board and audit committee | Shareholders, regulators, banks and other external users |
| Scope | Determined by risk, management needs and regulatory requirements | Focused mainly on financial statements and applicable reporting standards |
| Frequency | Continuous, annual, quarterly or project-based | Usually performed once per financial year |
| Report | Findings, risk ratings, causes and corrective actions | Independent auditor’s opinion |
| Follow-up | Tracks management action until findings are addressed | Usually does not manage corrective actions |
| Requirement | Depends on the company and regulator | May be required by company law, a free zone, regulator, bank or shareholder |
A company may require both services because they answer different questions. External audit considers whether the financial statements are fairly presented, while internal audit examines how effectively the company manages risks and controls throughout the year.
Under an outsourced arrangement, Athos Auditors performs the agreed internal audit function for the company. This can include the risk assessment, audit plan, individual audits, reporting to management or the audit committee and follow-up of findings.
Outsourcing is often suitable for SMEs, family-owned businesses and companies that require an independent internal audit function without maintaining a permanent in-house department.
Co-sourcing combines the company’s internal audit team with external audit specialists. Athos Auditors can support particular risk areas, locations, business processes or technical reviews that require additional capacity or experience.
The company retains its existing internal audit leadership while gaining outside support for the agreed work.
A focused review covers one process, department or identified risk. It may examine procurement, payroll, inventory, revenue, expenses, branch operations, system access or another specific concern.
This option is suitable when management does not require a complete outsourced function but needs an independent review of a high-risk area.
A company should consider an internal audit when management cannot obtain a clear view of how controls are working across the organisation. Common warning signs include repeated accounting errors, unexplained stock differences, delayed reconciliations, weak supporting documents, unauthorised transactions or recurring external audit findings.
Internal audit is also useful during rapid growth, business restructuring, system implementation, the opening of new branches, acquisitions or changes in senior management. These events can create control gaps because processes and responsibilities change faster than the company’s policies.
Corporate groups and family-owned businesses can use internal audit to standardise controls across subsidiaries and reduce dependence on individual employees. Regulated companies may require a formal annual audit plan and reporting line to the board or audit committee.
Athos Auditors provides internal audit services for UAE mainland companies and businesses operating in free zones such as DMCC, JAFZA, DAFZA, Dubai South, RAKEZ, IFZA and Meydan.
A free zone requirement to submit audited financial statements normally relates to an external audit. It does not automatically mean that every free zone company must maintain an internal audit function.
However, an internal audit can help a free zone business review its accounting controls, qualifying income procedures, related-party transactions, substance, documentation and compliance processes before problems affect its annual audit or corporate tax position.
The required scope should be determined by the company’s activities, free zone rules, tax position, group reporting requirements and identified risks.
The audit scope changes according to the company’s industry and operating model. A trading company may require controls over purchasing, inventory, supplier payments and receivables. A construction company may need project costing, subcontractor, procurement and contract reviews.
For real estate businesses, the focus may include tenant collections, service charges, escrow controls, property expenses and contractor payments. Healthcare businesses may require reviews of billing, insurance claims, inventory, payroll and regulatory procedures.
Hospitality and restaurant audits commonly cover cash, point-of-sale systems, food costs, stock movement, purchasing and revenue controls. Professional service businesses may require time recording, project billing, receivables and expense controls.
The audit plan should reflect the risks of the individual company rather than applying a standard industry checklist.
We meet management to understand the reason for the audit, the company’s structure, key concerns, available records and reporting requirements. The scope, responsibilities, document requirements, fees and timeline are then confirmed.
The audit team reviews background information, policies, previous reports and business processes. The main risks are identified and used to develop the audit programme and testing procedures.
We review records, interview relevant employees, observe procedures and test selected transactions and controls. The testing method and sample size depend on the scope, risk level and quality of the available records.
Potential findings are discussed with the responsible management team before the draft report is issued. This allows factual matters to be confirmed and gives management an opportunity to explain existing controls or provide missing evidence.
The report presents the scope, work performed, findings, risk ratings, business impact, root causes and recommended corrective actions. Management responses, responsible owners and target dates can be included in the final report.
A follow-up review assesses whether agreed corrective actions have been completed. Findings that remain unresolved are reported to management, the board or the audit committee according to the agreed reporting structure.
The report begins with the audit objective, scope, period covered and work performed. It then presents each finding with the relevant evidence and explains why the issue matters to the business.
Findings may be rated according to their possible financial, operational, regulatory or reputational impact. The report should explain the root cause instead of describing only the visible problem.
Each agreed action should have a responsible owner and completion date. This gives management and the board a practical way to monitor whether important control weaknesses are being addressed.
Outsourcing gives the company access to independent auditors without the fixed cost of maintaining a full internal audit department. The scope can be adjusted when the company changes, enters a new market or needs specialist support.
An external provider can also give the board or management a more independent view of controls that are operated by the company’s own employees. Independence is particularly useful where senior management requires assurance over multiple departments or branches.
The company remains responsible for its controls and corrective actions. The internal auditor evaluates the controls, reports weaknesses and follows up on management’s agreed response.
Athos Auditors is a Dubai-based audit and assurance firm providing external audit, internal audit, forensic audit, financial reporting and advisory services to companies across the UAE.
Athos Auditors LLC is listed as an approved auditor with DMCC, in the official Dubai Airport Freezone Auditors List and the RAKEZ Approved Auditors’ List. Athos Auditors is also a member of EAI International.
Each engagement receives partner involvement during the planning, review and reporting stages. The internal audit scope is based on the company’s actual risks, records and operating structure rather than a standard checklist.
Before work begins, we confirm the scope, required documents, reporting line, fees and expected timeline. Material findings are discussed during the audit so management is aware of important issues before the final report is issued.