Internal Audit in the UAE

Internal audit is an ongoing examination of a company's own risks, controls and governance, performed for the people running the company and reported to the board or an audit committee. It can be staffed in house, co-sourced, or bought in as an outsourced engagement.

That is a different product from the audit most UAE businesses buy once a year. The statutory audit is an independent opinion on financial statements, owed to shareholders: Article 27(1) of Federal Decree-Law No. 32 of 2021 requires every joint stock company and limited liability company to have one or more auditors auditing its accounts on a yearly basis, and the auditor's report goes to the general assembly under Article 248(1), with a copy to the Authority and the competent authority.

The two are structurally different rather than merely different in emphasis, and company law makes that explicit. Article 246(3) says the auditor shall not combine the profession of auditor with the capacity of a shareholder, nor occupy the office of board member or any technical, administrative, or executive office in the company. An internal auditor holds exactly such an office. The firm signing your statutory audit therefore cannot also be your internal audit function, and a proposal that offers both to the same entity in the same year should be questioned before it is priced.

It says nothing. We searched the full English text of the Commercial Companies Law published by the Ministry of Economy and Tourism — 70 pages, read on 17 August 2026 — for the phrases internal audit, audit committee and internal control. There are no occurrences. The Decree-Law regulates the external auditor at length, in Articles 245 to 249, and does not create an internal audit function at all.

So the honest answer to is internal audit mandatory in the UAE is that there is no general federal duty on a private company, and any provider telling you otherwise should be asked to name the article. What does exist is a set of narrower routes by which the obligation reaches a particular business, and they are the ones worth checking against your own facts.

The most important of those sits in Article 6 of the Commercial Companies Law. Governance is defined in the Decree-Law as a set of controls, standards and procedures achieving corporate governance at management level, and Article 6(1) hands the making of governance decisions to the Minister for companies other than public joint stock companies, and to the Board of the Securities and Commodities Authority for public joint stock companies — while expressly preserving the Central Bank's requirements for the financial institutions under its supervision. Article 7 then says those governance decisions carry fines of up to AED 10,000,000. That is where a UAE internal audit requirement usually comes from: a governance instrument, not the company law itself.

This is the part of the topic that matters most when you are buying the service, and it is unresolved. We are setting out both halves of it rather than picking one.

Article 1 of Federal Decree-Law No. 41 of 2023, which regulates the accounting and auditing profession, defines Other Assurances' Services as services the chartered accountant and the accounting firms are licensed to provide, related to the financial statements, that provide assurances to external parties about financial information or verify compliance with accounting standards, financial rules and the internal controls of economic facilities — including, in the article's own words, the services of internal audit. Article 4 puts auditing, review, other assurances and related services inside the scope of the profession. And Article 6(1) provides that no natural or juristic person shall practise the profession in the State, or render any of the services of the profession or the related services, except after obtaining the licences stipulated in the Decree-Law and its Executive Regulation.

Read in sequence, those three articles raise a real question: does an outsourced internal audit engagement fall inside the licensed activities, so that only a firm holding the Ministry's professional licence may sell it?

We found no Ministry guidance resolving it, and we are not going to resolve it for you. There is a serious argument each way. The definition opens by describing services that licensees are licensed to provide and ties them to the financial statements, which can be read as scoping the term to work done by the profession rather than capturing every internal audit engagement in the country — and internal audit is in fact performed daily by employees and by consultancies that hold no professional licence. Against that, the words including … the services of internal audit are in the definition, and Article 6(1) is drafted broadly enough to reach any of the services of the profession.

The practical response is not to form a view. It is to ask.

Internal audit is sold under a dozen names — controls review, risk assurance, governance health check, SOX-style testing. The engagement underneath should look roughly the same regardless of the label, and if a proposal skips two of these steps you are buying a report rather than assurance.

Searches for internal audit companies in the UAE return ranked lists, and none of the ones we looked at publish a methodology. We are not going to add another. A ranking that cannot tell you how it was ordered is an advertisement with numbers on it, and the firms that pay to appear on those lists are not necessarily the firms that would staff your engagement.

The checks that separate providers are duller and far more useful. Ask for the professional licence number, as above. Ask who personally will do the work and how many days each of them is allocated — internal audit is sold by partners and delivered by juniors more often than any other assurance product. Ask for the independence position: Article 17 of Federal Decree-Law No. 41 of 2023 restricts a practitioner from contracting for services that contravene independence where independence is required, from being a partner or agent of a founder, partner or director of the entity engaged, from being its creditor or debtor beyond the fees, and from taking part in the incorporation or management of an establishment it served in the previous two years.

Two further conditions are worth asking about because they are in the same law. Article 16(2)(b) requires an accounting firm to hold professional liability insurance covering the firm and its chartered accountants, with the firm bearing the premiums. Article 18 limits confidentiality to a defined list of exceptions — the client's own request or consent, a judicial or investigating authority, a request from the Ministry, the prevention or reporting of a crime, and self-defence before an investigating or judicial body. If a provider's engagement letter gives itself wider disclosure rights than that, ask why.

The standards used by internal auditors in the UAE are not issued by a UAE authority. They are the Global Internal Audit Standards published by the Institute of Internal Auditors, a mandatory component of its International Professional Practices Framework, organised into five domains: the purpose of internal auditing, ethics and professionalism, governing the internal audit function, managing the internal audit function, and performing internal audit services. The IIA states that all internal audit functions are expected to conform.

Read that expectation correctly. It is a professional expectation set by a private body, not UAE law. It becomes binding on your company only where a regulator, a listing rule or your own internal audit charter adopts it — which is a good reason to have the charter say which version of the standards applies.

The association people are searching for is the UAE Internal Auditors Association, which describes itself as the premier professional body for internal auditors in the UAE and as part of the IIA global network, and which publishes membership, training, conference and quality-assurance services along with an events calendar. Conference and training-calendar dates change, and a date copied onto a third-party page rots quietly, so we do not reproduce them: read the association's own calendar on the day you need it.

Searches that specify an emirate — internal audit in Abu Dhabi, a conference in Abu Dhabi, internal audit in Dubai — are almost always looking for a provider or an event rather than a different rule. The federal instruments on this page apply across all seven emirates. What changes with location is the economic licence, issued by the emirate's own licensing authority under Article 14 of Federal Decree-Law No. 41 of 2023, and whether the entity sits inside a financial free zone: Article 5(1) of the Commercial Companies Law disapplies the Decree-Law to companies incorporated in a free zone where that zone's own laws so provide, and pulls them back inside it if those laws let them operate outside the zone in the State.

A large share of the searches on this topic are about roles rather than engagements — head of internal audit, internal audit director, internal audit manager, internal audit roles in Abu Dhabi and Dubai. The role taxonomy is worth stating because it also tells a buyer how an outsourced team should be structured.

The chief audit executive — commonly titled head of internal audit — is the person the standards make responsible for managing the function in accordance with the internal audit charter, and is the role that owns the reporting line into the board or audit committee. A director typically owns a portfolio of audits and the relationship with senior management. A manager runs individual engagements, supervises fieldwork and drafts findings. Where the function is outsourced, the same three layers should be visible in the fee proposal, with days attached to each; where they are not, the work is likely to be performed a level or two below what was sold.

We do not publish salary figures for internal audit roles, and the reason is specific rather than cautious. The bands circulating on UAE advisory blogs trace back to recruitment surveys that we cannot open to verify: on 17 August 2026, Cooper Fitch's salary guide sits behind a lead-capture form demanding a company email address, Michael Page's is behind a full user-registration form, and Bayt's UAE salary pages returned HTTP 403. Reproducing a number from a source we could not read would be inventing it at one remove. A recruiter who actually places internal audit roles will give you a better answer than any range we could responsibly print.

This is a reference page, and the same standard we ask you to apply to a provider applies here.

We publish no fee, day rate, package price or turnaround commitment for internal audit or for anything else — not because they are secret, but because a price quoted before anyone has seen your entity structure, systems, transaction volume and regulatory perimeter is a price for a form rather than for the work. We publish no professional licence number, no audit licence, no tax agent registration and no certification claim, because none has been verified for publication here; when one exists it will appear with its number so you can check it against the register rather than take our word for it. We publish no office address, no location claim and no telephone number. We make no claim to be able to perform or sign a statutory audit — that is a licensed activity under Federal Decree-Law No. 41 of 2023, and the auditor whose name goes on the report should be findable in the Ministry of Economy and Tourism's practising auditors register before you engage them.

And every page on this site carries a review status of draft until a person holding a UAE credential has read it and signed it off. Ask us for the same number we have told you to ask others for; the absence of an answer is itself information.