The Internal Auditor in the UAE: Role, Regulation and Certification

The statutory auditor gives an independent opinion on whether the financial statements give a true and fair view, is appointed by the general assembly under Article 245 of the Commercial Companies Law, and reports to the shareholders. The internal auditor is inside the organisation: an ongoing assessment of risk, controls and governance, reporting to the board or an audit committee.

The law keeps them apart deliberately. Article 246(3) of the Commercial Companies Law provides that the statutory auditor may not occupy the office of board member or any technical, administrative or executive office in the company. An internal audit function holds exactly such an office. That is the legal reason one firm cannot sensibly do both for the same entity, and it is worth raising before appointment rather than at the report date.

The practical difference matters too. An external audit answers one annual question for outsiders. Internal audit answers whatever question the board is worried about this quarter, and its output is a finding and a recommendation, not an opinion.

This is the point most guidance gets wrong. A full-text search of the Ministry of Economy and Tourism's English text of Federal Decree-Law No. 32 of 2021 returns no occurrence of "internal audit", "audit committee" or "internal control". The Commercial Companies Law simply does not impose an internal audit obligation.

Where the duty exists, it arrives by another route. Article 6 of the Commercial Companies Law empowers the Minister to issue governance decisions for companies other than public joint stock companies, and the Securities and Commodities Authority Board to issue them for PJSCs — expressly without prejudice to the Central Bank's requirements for financial institutions. Article 7 backs those decisions with fines of up to AED 10,000,000.

So the honest answer to "is an internal auditor mandatory in the UAE?" is: not by company law, and not for a typical private LLC. It becomes mandatory through a listing, a sector regulator, a group policy or a contractual covenant. Establish which of those applies to you before buying the function, and take the requirement from that instrument rather than from a general article.

There is a genuine unresolved point here, and this page states it rather than resolving it.

Article 1 of Federal Decree-Law No. 41 of 2023 defines Other Assurances' Services as services a chartered accountant and accounting firms are licensed to provide relating to the financial statements, "including but not limited to the services of internal audit, consultancy reports of fiscal monitoring, reliability of electronic information systems, assessment of financial risks". Article 4 places other assurance and related services inside the scope of the profession. Article 6(1) then prohibits any person from practising the profession "or rendering any of the services of, or the related services of the profession" without the required licences.

Read together, those provisions can be taken to mean that an outsourced internal audit engagement is a licensed activity. No Ministry guidance resolving the point was found when this was checked on 21 August 2026, and we are not going to decide it for you in either direction.

What you can do is manage the exposure. Article 27 of the same Decree-Law sets a penalty of not less than three months' imprisonment and/or a fine of AED 100,000 to AED 2,000,000 for practising without a licence. Ask any external internal-audit provider for its Ministry of Economy and Tourism professional licence number, in writing, before signing. A licensed provider answers immediately; an unlicensed one is the party carrying the risk, and you are the one carrying the report.

The Certified Internal Auditor designation is awarded by The Institute of Internal Auditors, a global professional body. Its published exam structure is three parts, read on the Institute's own certification page on 21 August 2026.

What the CIA is not is a UAE licence. It does not appear in the Ministry of Economy and Tourism's licensing framework for the accounting and auditing profession, and it does not entitle anyone to sign a statutory audit report in the State. That entitlement comes only from registration under Federal Decree-Law No. 41 of 2023. A CIA holder who is not a registered practising auditor cannot sign your annual accounts, and a registered practising auditor does not need the CIA to do so.

Within its own lane the designation does real work: it is the recognised credential for the internal audit function itself, and UAE employers advertising internal audit roles ask for it routinely.

Internal audit training in the UAE is a private market. There is no ministry-approved curriculum for internal auditors as such, which is a different position from the statutory auditor route — there, the Ministry's Auditor Register conditions for individuals do reference approved courses and a post-qualification experience requirement.

That gap is why provider selection matters. Two checks separate a serious course from a brochure. First, ask which certification the course prepares you for and whether the provider is recognised by that certifying body, rather than accepting a generic "internationally recognised" claim. Second, ask what the course does not cover — a CIA preparation course is not UAE tax or company law training, and neither is a substitute for the other.

The UAE Internal Auditors Association runs conferences and training and describes itself as part of the Institute of Internal Auditors' global network. Its programme is a reasonable starting point for what the local market treats as current.

Internal auditor vacancies in the UAE cluster around a few recognisable shapes, and reading the shape tells you what the employer actually wants.

A group internal audit role in a large private or family group is usually risk-based work across subsidiaries with heavy travel between entities. A bank or insurer role is regulator-facing and the rulebook, not the audit plan, sets the agenda. A first internal audit hire in a mid-sized company is often a governance project in disguise: the company is building the function because a lender, a shareholder or a prospective investor asked for it.

Qualification expectations follow the same pattern. The CIA is the designation named most often for the function itself; accounting qualifications appear where the role sits close to financial reporting. Neither replaces the licensing question above if the work is being sold from outside the company.

There is no publishable internal auditor salary band for the UAE, so this page does not print one.

No UAE authority publishes occupational pay data for internal auditors. The Ministry of Human Resources and Emiratisation does not publish salary bands by profession, and the UAE Labour Law does not stipulate a statutory minimum wage — Article 27 of the law leaves a minimum to a Cabinet resolution. The figures circulating in search results come from recruitment agency surveys and self-reported job-board aggregates, neither of which is a primary source and neither of which discloses its sample.

If you need a number for a negotiation, get it from live advertised roles matching your sector, entity size and years of experience, and from more than one source. Treat any single quoted range as marketing until you can see how it was measured.

The professional body for internal auditors in the country is the UAE Internal Auditors Association, which describes itself as part of the Institute of Internal Auditors global network and runs conferences, events and training locally. Its site is at uaeiaa.org, confirmed reachable on 21 August 2026.

One warning is worth more than the rest of this section. A similarly spelled domain, iiauae.org, was serving an Indonesian-language online gambling site when checked on both 17 and 21 August 2026 — not the association, and nothing to do with internal auditing. Anyone reversing the letters while typing from memory lands on it.

This is a general lesson about UAE professional bodies rather than a one-off. Association domains lapse and get re-registered. Reach a body from a link on a page you already trust, and check the site actually describes the body before relying on anything it says.