How Often Should a UAE Company Perform Internal Audits or Review Procedures?

While external audits happen once a year, internal reviews and audits should be an ongoing process. The right frequency depends on your company’s size, complexity, risk profile, and industry. This guide provides a practical framework for UAE businesses.

The Principle: Risk Drives Frequency

The more risk an area carries, the more frequently it should be reviewed. High-risk areas (cash handling, large contracts, regulatory compliance) need more frequent attention than lower-risk areas (office supplies, routine administrative processes).

Monthly Reviews

Every UAE business, regardless of size, should perform certain reviews monthly:

• Bank reconciliations: Reconcile all bank accounts to the general ledger every month without exception.
• Cash and petty cash: Count and reconcile petty cash monthly.
• Accounts receivable review: Review the receivables ageing and follow up on overdue accounts.
• Payroll review: Verify payroll calculations, WPS compliance, and visa status of employees.
• VAT reconciliation: Reconcile VAT records to ensure accuracy before the VAT return filing period.

Quarterly Reviews

Quarterly reviews provide a deeper look at operational processes and controls:

• Procurement and payments: Review a sample of purchase transactions for proper authorisation, supporting documents, and correct recording.
• Revenue and contracts: Review revenue recognition for major contracts and projects.
• Inventory: For businesses holding physical inventory, conduct quarterly spot checks or cycle counts.
• Compliance check: Verify compliance with VAT filing deadlines, ESR requirements, labour regulations, and trade licence conditions.
• IT and access controls: Review user access to accounting systems, ensure passwords are changed regularly, and verify backup procedures.

Semi-Annual Reviews

• Fixed asset verification: Physical verification of key fixed assets to ensure they exist and are in use.
• Related-party transactions: Review all transactions with related parties for arm’s length pricing and proper documentation.
• Insurance review: Verify that all insurance policies are current and provide adequate coverage.

Annual Reviews

• Comprehensive internal audit: A full review of all major processes and controls, ideally conducted before the external audit.
• Policy review: Review and update all company policies (finance, HR, procurement, AML, data protection).
• Risk assessment: Conduct a formal risk assessment to identify new or emerging risks and update the internal audit plan accordingly.
• Regulatory compliance review: Comprehensive check of all regulatory obligations — trade licence, visas, VAT, corporate tax, ESR, AML.
• Employee end-of-service calculation: Verify the accuracy of gratuity provisions for all employees.

Recommended Framework by Company Size

Who Should Perform Internal Reviews?

Small Businesses

The business owner or a senior manager can perform basic reviews using checklists. For the annual comprehensive review, consider engaging an external consultant.

Medium Businesses

Designate a finance manager or compliance officer to conduct regular reviews. Consider outsourcing the annual internal audit to a professional firm for independence and expertise.

Large Businesses

Establish a dedicated internal audit function or engage an outsourced internal audit firm on a retainer basis. The internal audit team should have a formal charter and report to the board or audit committee.

Making Reviews Actionable

1. Document findings: Keep a written record of every review, including what was examined, findings, and recommendations.
2. Assign responsibility: Each finding should be assigned to a specific person for resolution.
3. Set deadlines: Every action item needs a completion deadline.
4. Follow up: Track the status of action items and verify completion.
5. Report to management: Summarise findings and action status in a monthly or quarterly management report.

Conclusion

Internal audits and reviews should not be a once-a-year event. The right frequency depends on the risk and size of your business, but every UAE company should have at least monthly financial reviews and quarterly operational checks. Regular internal reviews catch problems early, reduce external audit surprises, and strengthen your overall business governance.