Audit Services in the UAE: What Each Engagement Actually Is

A quote headed "audit services" can mean four quite different pieces of work, carrying four different levels of assurance and four different legal consequences. Before comparing prices, establish which one you are buying.

Federal Decree-Law No. 41 of 2023, which regulates the accounting and auditing profession, draws the boundary. Article 4 puts auditing, review and other assurances and related services inside the profession's scope. Article 1 then defines Other Assurances' Services broadly — services related to the financial statements "including but not limited to the services of internal audit, consultancy reports of fiscal monitoring, reliability of electronic information systems, assessment of financial risks".

That definition matters commercially. It means an engagement can sit inside the regulated profession even when nobody calls it an audit, and it means the word "audit" on a proposal tells you almost nothing on its own.

For a mainland company, the statutory external audit is not optional and there is no size exemption. Article 27(1) of Federal Decree-Law No. 32 of 2021 requires the company to appoint an auditor to audit the accounts each year. Article 245 governs the appointment itself — the general assembly appoints the auditor for a renewable term of one year and fixes the fee.

What the auditor must then do is set out rather than left to practice. Article 247 governs the audit report and requires it to be read at the general assembly. Article 248 lists the auditor's duties, including a right of access to the company's books, records and documents at any time, and the right to require from the board the information needed to perform the work.

The corporate tax duty is separate and has its own test. Ministerial Decision No. 84 of 2025 requires audited financial statements where revenue exceeds AED 50,000,000 in the tax period, and for every qualifying free zone person regardless of revenue. Article 4 of that decision applies it to tax periods commencing on or after 1 January 2025.

The signature, not the brand, is what a regulator or a bank relies on. Article 6(1) of Federal Decree-Law No. 41 of 2023 states that no natural or juristic person shall practise the profession in the State, or render any of the services of the profession or its related services, except after obtaining the licences required under that Decree-Law.

The consequence of getting this wrong is criminal, not commercial: Article 27 sets a penalty of not less than three months' imprisonment and/or a fine of AED 100,000 to AED 2,000,000 for practising without a licence. That risk sits with the provider, but a report signed by an unlicensed person is worthless to you.

Article 15(1) adds a further restriction that catches larger engagements: an auditor may not audit or review the accounts of a public joint stock company or a mutual fund until they have completed a qualifying period in the profession. Check that separately if you are a listed entity or a fund.

The licence to practise is federal. A firm registered under Federal Decree-Law No. 41 of 2023 is registered for the State, not for an emirate, so searches for audit services in Dubai and audit services in Abu Dhabi are asking about the same regulatory regime. What changes with the address is who else has to accept the report.

Free zone authorities set their own filing conditions as part of licence renewal, and several maintain their own register of approved auditors whose reports they will accept. Those registers are live and change on every appointment and removal, so this page does not reproduce any of them, and neither should any PDF you find circulating with a year in its filename.

The financial free zones — the DIFC and ADGM — run separate civil and commercial legal frameworks with their own regulators. We could not read the DFSA rulebook to a usable standard for this page: dfsa.ae returned 403 to automated requests and difc.com returned 429 when checked. Rather than summarise a rulebook we could not open, we say so: if you are DIFC- or ADGM-licensed, take the audit requirement from your own regulator's current rulebook, not from a general UAE page.

Buying more assurance than the situation needs is expensive; buying less than the law requires is worse. The practical test is who has to rely on the report.

If the reader is the general assembly, a licensing authority, a bank's credit committee or the Federal Tax Authority, you almost certainly need the statutory audit. If the reader is your own board — testing whether a control works, whether a branch is following policy, whether a system can be trusted — that is internal audit or agreed-upon procedures, and an audit opinion adds nothing to it.

One combination to avoid: appointing the same firm to run your internal audit function and to sign your statutory audit report. Article 246 of the Commercial Companies Law bars the statutory auditor from occupying any technical, administrative or executive office in the company, which is exactly the position an internal audit function holds.

This phrase appears in real UAE searches and it is not a product any authority publishes. We could not verify any UAE regulator, ministry or court that offers or licenses a service by that name, and we will not describe a procedure we have not read in a primary source.

What the search usually reflects is one of two situations. Either a company has filed or received a criminal complaint touching its accounts and has been asked for an accountant's report, in which case the appointing authority is the court or the public prosecution and the scope is set by them, not by a firm's brochure. Or the company wants a forensic investigation of a suspected fraud for its own purposes, which is an investigation engagement, not an audit, and produces findings rather than an opinion.

If you have been asked for something by a police station or a prosecutor, ask the case officer for the written referral setting out exactly what is required and to whom it is addressed. Take the scope from that document. Do not let a provider define the scope of a criminal matter from a web page, and do not assume an ordinary statutory audit report will satisfy it.

No fee is published here because no UAE authority publishes one and audit fees are not regulated. Under Article 245 of the Commercial Companies Law the general assembly fixes the auditor's fee, which means the price is a negotiated commercial term specific to your company.

What genuinely drives the number is the volume of transactions, the number of entities and locations consolidated, the quality of the underlying bookkeeping, whether a prior year opening balance has to be verified, and whether the engagement includes anything beyond the opinion. A first-year audit of a company with incomplete records costs materially more than the same audit in year three, because the work is different.

Treat an unusually cheap quote as a question rather than a saving. Ask who signs, how many hours are budgeted for fieldwork, and whether the fee assumes your trial balance arrives already reconciled. The answers explain the gap more often than the brand does.

Most audit overruns are caused by the client, not the auditor, and an overrun is usually re-billed. The list below is the ordinary starting pack for a UAE statutory audit and is worth assembling before the engagement letter is signed.

Record retention rules sit underneath all of this and there is more than one clock. Article 26(2) of the Commercial Companies Law requires accounting registers to be kept at the head office for at least five years from the end of the fiscal year. Article 56 of the Corporate Tax Law sets seven years after the tax period for corporate tax records. Your auditor keeps its own file for at least ten years from the date the report was issued, under Article 19(1) of Federal Decree-Law No. 41 of 2023 — but that clock sits on the firm, not on you, and does not replace yours.