Audit and Accounting

Three authorities can ask for your numbers, and they are not asking the same question

"Do I need an audit?" is not one question. It is three, with three different answers, decided by three different bodies.

Company law decides whether your entity must appoint an auditor at all. Your free zone decides whether audited statements must reach the authority before it renews your licence, and by when. The Federal Tax Authority decides whether the figures behind your corporate tax return were required to be audited in the first place.

A company can be excused by one and caught by another in the same financial year. That combination is where the unbudgeted costs appear, and it is the reason a firm can tell you truthfully that your zone does not require an audit while you are, in fact, required to have one.

Read across a row and you have the answer to one question. Read down a column and you have everything a single authority can ask you for — which is not the same list twice.

the gates these three bodies hold between them

Company law

• Whether you must appoint an auditor at allJoint stock and limited liability companies must, whatever their size
• How long the accounting records must be keptAt least five years from the end of the financial year, under Article 27

Your free zone

• Whether audited statements reach the authority before renewalDMCC at 180 days, RAKEZ reported at six months, Jafza and IFZA at the annual filing
• Which firm is allowed to sign the reportA report from a firm not on the zone's approved list is rejected on receipt
• Whether a shareholder can require an audit anywayIn DIFC, holders of at least 10% of the share capital, by written notice

Federal Tax Authority

• Whether the figures behind your tax return had to be auditedAbove AED 50 million of revenue, any Qualifying Free Zone Person, every tax group
• Which accounting standard the accounts are prepared underIFRS or IFRS for SMEs, under Ministerial Decision No. 114 of 2023
• How long the records behind the return must be keptSeven years from the end of the tax period, under Article 56
• Whether the filings can be re-examined years laterFive years ordinarily, fifteen where there has been evasion

This page sets out which of the three applies to you, what must be kept and for how long, how the audit meets your tax return and your bank, and where buying an audit you were never required to have is simply a cost.

Bookkeeping is the obligation that exists whether or not anyone audits you

An audit is an opinion on records. Where the records are thin, there is nothing to give an opinion on and no relief to claim.

Article 27 of Federal Decree-Law No. 32 of 2021, the Commercial Companies Law, requires every company to keep accounting records showing its transactions at its head office for at least five years from the end of the financial year. That is a company law duty and it binds a dormant company with no revenue and no bank movement.

The tax duties run longer, and they count from a different date.

Where a voluntary disclosure is submitted in the fifth year following a tax period, the retention period extends by a further year running from the date of that disclosure.

One correction worth making, because it is repeated constantly in UAE advisory content: the frequently quoted ten years for capital assets and fifteen years for real estate come from the older VAT Executive Regulation. Retention now sits in the Tax Procedures Executive Regulation, where the real estate period is seven years. If a checklist you were given still says fifteen, it has not been updated since 2023.

Two things follow. The seven-year corporate tax period is the binding one for almost any operating company, so a retention policy built around the five-year company law rule is not sufficient. And retention is enforced in its own right: Cabinet Decision No. 75 of 2023 sets an administrative penalty of AED 10,000 for failing to keep the required records, rising to AED 20,000 for a repeat violation within 24 months. That is charged for the absence of records, independently of whether any tax was underpaid.

One annual filing has gone. Cabinet Decision No. 98 of 2024 restricted the Economic Substance Regulations to financial years ending on or before 31 December 2022 and cancelled penalties issued for later periods. If a provider is still invoicing you for ESR notifications, they are selling a filing that no longer exists.

Which accounting standard you are entitled to use

Ministerial Decision No. 114 of 2023 settles this for corporate tax purposes, and the answer is narrower than most founders expect. Two standards are accepted: IFRS and IFRS for SMEs. There is no UAE GAAP, and a bookkeeper's own spreadsheet format is not a standard.

Cash basis above AED 3 million exists only on application to the FTA in exceptional circumstances. Do not plan around it.

IFRS for SMEs is a permission, not an instruction. It strips out a large volume of disclosure and some fair-value measurement, which is why smaller companies take it and why preparation is cheaper. But your free zone, your bank or a future investor may want full IFRS regardless of what the tax law permits, and moving standard later means restating comparatives. Decide once, at the first year end, against the audience for the accounts rather than the cost of preparing them.

Who is actually required to be audited

The federal tax trigger

Ministerial Decision No. 84 of 2025, published 25 March 2025 and applying to tax periods beginning on or after 1 January 2025, requires audited financial statements from:

• any taxable person with revenue above AED 50 million in the relevant tax period;
• any Qualifying Free Zone Person, at any level of revenue;
• every tax group, which must now prepare audited special-purpose aggregated financial statements. This is the substantive change from the decision it replaced: the old AED 50 million test for tax groups is gone.

Tax periods that began before 1 January 2025 remain governed by Ministerial Decision No. 82 of 2023.

The QFZP limb is the one that catches people. A four-person free zone company with AED 900,000 of revenue that claims 0% on qualifying income must be audited. The same company, not claiming the status, need not be.

The company law trigger

Under the Commercial Companies Law, joint stock companies and limited liability companies must appoint one or more auditors and have the annual accounts audited. For a mainland LLC that duty exists even though the licensing department does not routinely collect the resulting statements at renewal. Nobody chases it — until a bank, a buyer, a partner or the FTA does.

The free zone trigger

This is the layer that varies most, and where general advice is worthless. Each authority sets its own rule, its own deadline, and in most cases its own list of auditors it will accept.

Two qualifications on that table. Deadlines and thresholds move, and they move without much ceremony, so confirm the current figure on the authority's own portal before planning around it. And where a zone excuses small companies from audit, that almost always still requires unaudited accounts to be prepared and filed. It removes the auditor, not the accounting.

In DIFC there is a further catch that founders forget when they take in investors: shareholders holding at least 10% of the share capital can require an audit by written notice, whether or not the exemption applies.

Put the three triggers on one drawing and they sort by the authority holding them rather than by the size of the company, which is why a small company can be caught and a larger one left alone.

Read it by destination: the tax limb catches revenue above AED 50 million, any Qualifying Free Zone Person at any revenue and every tax group; company law catches joint stock and limited liability companies whatever their size; and the zone layer — DMCC at 180 days, RAKEZ reported at six months, Jafza and IFZA at the annual filing, DIFC and ADGM only once you outgrow their small-company tests — is the one that varies.

Excused by your free zone, still audited by the FTA

This is the single most common error we see, and it costs a company a full audit it did not budget for.

An ADGM company with USD 4 million of turnover and twelve staff qualifies as small under ADGM's own rules and may file simplified, unaudited accounts. If that same company claims Qualifying Free Zone Person status for corporate tax, Ministerial Decision No. 84 of 2025 requires audited financial statements regardless of size. ADGM has published guidance specifically on this point, which tells you how many entities got it wrong. The same logic runs in DIFC.

The free zone exemption and the tax requirement are set by different authorities, under different laws, for different purposes. One does not release you from the other. If you intend to claim 0% on qualifying income, budget for an audit from year one — and read our UAE corporate tax page before deciding the status is worth having at all.

Management accounts and statutory accounts are different products

Firms sell both under the word "accounting", and clients frequently pay for one while needing the other.

In one line: management accounts are monthly or quarterly, prepared for you, your board and your bank's relationship manager on whatever basis gives you the truth fastest, unaudited, and signed off by your finance function or an outsourced accountant; statutory financial statements are annual, prepared for shareholders, the authority and the FTA under IFRS or IFRS for SMEs, audited where the law requires it, and signed by the directors with an auditor's opinion attached.

both products, judged on the same questions

Judged on	Management accounts	Statutory financial statements
How often	Monthly or quarterly	Annual
Prepared for	You, your board and your bank's relationship manager	Shareholders, the authority and the FTA
On what basis	Whatever gives you the truth fastest	IFRS or IFRS for SMEs
Audited	No	Audited where the law requires it
Who signs	Your finance function or an outsourced accountant	The directors, with an auditor's opinion attached
When it arrives	In time to decide whether you can afford a hire in March	Months after the period it describes
Taken as evidence	No bank, auditor or tax authority will take it	Built to satisfy a regulator

Statutory accounts arrive months after the period they describe and are built to satisfy a regulator. They are close to useless for running a business. Management accounts tell you whether you can afford a hire in March, but no bank, no auditor and no tax authority will take them as evidence of anything.

Companies that keep only statutory accounts find out about problems eleven months late. Companies that keep only management accounts arrive at the audit with figures that will not tie to anything, and end up paying their auditor to do bookkeeping at audit rates.

How the audit meets your corporate tax return

Corporate tax returns are filed through EmaraTax within nine months of the end of the tax period, and financial statements form part of the submission. Where Ministerial Decision No. 84 of 2025 applies, those statements must have been audited by a UAE-licensed auditor. Which calendar date that nine months runs from is set by the first financial year end the company adopts, and every audit and filing deadline after it inherits that choice — your first financial year end works through how to make it.

The sequencing catches people out, because the deadlines are not aligned:

1. The financial year ends. Books close. Bank confirmations, stock counts and related-party schedules are gathered.
2. The free zone deadline lands first. DMCC and RAKEZ want the audit inside six months; Jafza and IFZA tie it to the annual filing and renewal. In practice it is the zone deadline, not the FTA deadline, that sets your timetable.
3. The corporate tax return follows at nine months, using the audited figures. A 31 December year end means a 30 September filing.
4. Where you rely on the free zone distribution activity — the qualifying activity of distributing goods in or from a Designated Zone, under Cabinet Decision No. 100 of 2023 — FTA Decision No. 6 of 2026 adds an Agreed-Upon Procedures report from an independent UAE-licensed auditor, testing a prescribed sample of transactions and due within 30 days after the corporate tax return deadline. It is a separate engagement, separately priced, and your statutory audit does not cover it.

Two consequences. An audit that finishes at month eight leaves you no time to think about the tax position, only to file it. And related-party and connected-person transactions — director's remuneration above all — are disclosed in the return and are the most common area where a clean audit opinion still leaves a tax exposure. The auditor is giving an opinion on the accounts, not on your transfer pricing.

Running behind all of this, the UAE eInvoicing system under Ministerial Decisions No. 243 and No. 244 of 2025 opens for pilot and voluntary use on 1 July 2026, becomes mandatory for businesses with revenue of AED 50 million or more from 1 January 2027, and for everyone below that threshold from 1 July 2027, with accredited service providers to be appointed ahead of each wave. That is a bookkeeping systems decision before it is a tax one. If you are choosing accounting software this year, choose one whose provider is committed to accreditation.

None of those dates sits alone. Set beside the other instruments this page turns on, the pattern is a quiet stretch and then four years in which almost everything an accountant works to was replaced, re-dated or given a start line.

In order: Economic Substance filings end with financial years ending on or before 31 December 2022; Federal Decree-Law No. 41 of 2023 takes over the profession on 28 March 2024; Ministerial Decision No. 84 of 2025, published on 25 March 2025, applies to tax periods beginning on or after 1 January 2025; the five-year audit reach and the five-year credit balance claim run from 1 January 2026; a new penalty schedule lands in April 2026; and eInvoicing opens on 1 July 2026, becomes mandatory at AED 50 million of revenue or more from 1 January 2027, and for everyone below that threshold from 1 July 2027.

A tax audit is the FTA testing your filings, and it is not the audit you paid for

Two different things share the word. The statutory audit is an engagement you commission: a licensed firm examines your financial statements and gives an opinion on them. A tax audit is the Federal Tax Authority examining your records and returns to test whether the income, deductions and tax you declared are right. You do not choose the auditor, the scope or the timing, and a clean audit opinion does not bind the Authority to anything. The two meanings, and what a company can actually commission around its own return, are pulled apart in nobody commissions a corporate tax audit.

The power sits in Federal Decree-Law No. 28 of 2022 on Tax Procedures. Under Article 16 the FTA may audit any person to check compliance, and must give at least ten business days' notice before it does. The audit can take place at the Authority's premises, at your place of business, or anywhere you trade, store goods or keep records. Where the Authority has serious grounds to suspect evasion, a tax auditor may enter without notice and close the premises temporarily, with the Director General's written consent. During the audit the tax auditor may take original records or copies, and you, your Tax Agent or your legal representative are obliged to cooperate. In return you are entitled to see the auditor's identification, to a copy of the notification, to attend an audit held away from the Authority's offices, and to copies of any documents taken.

What the Authority tests, in practice, is whether your figures agree with each other and with the evidence behind them:

• revenue in the corporate tax return against the four quarters of VAT returns and the bank statements;
• expenses claimed as deductible against invoices, contracts and a business purpose someone can explain;
• related-party and connected-person transactions, director's remuneration above all, against arm's length pricing;
• for a Qualifying Free Zone Person, which income was treated as qualifying and whether non-qualifying income stayed inside the permitted limit;
• tax actually paid against tax declared, and the dates on which it was paid.

The window is long. Under Article 46 of the same law, as amended with effect from 1 January 2026, the Authority's ordinary reach is five years from the end of the tax period. An audit notified inside that window can be completed after it closes, within a further period the law sets. Where there has been tax evasion, or a business should have enrolled for tax and did not, the reach extends to fifteen years. This is why the seven-year corporate tax retention period in the table above is not excessive: the records have to outlast the questions.

On one scale: five years of ordinary reach, seven years of corporate tax records, and fifteen years where there has been evasion or a business that should have enrolled for tax never did.

What the clock runs onHow longFrom when it runs

1. Accounting records under Article 275 yearsFrom the end of the financial year, and it binds a dormant company
2. Corporate tax records under Article 567 yearsFrom the end of the tax period, with the workings to taxable income
3. A voluntary disclosure, at the latest5 yearsFrom the end of the tax period
4. A credit balance held with the Authority5 yearsSince 1 January 2026, or the relief is lost for good
5. The Authority's ordinary reach under Article 465 yearsAn audit notified inside it can be completed after it closes
6. Its reach where there has been evasion15 yearsOr where a business that should have enrolled for tax never did

07.515

Errors and late payments get more expensive every month they sit

Corporate tax penalties under Cabinet Decision No. 75 of 2023, as amended, are built to grow with time rather than to be charged once:

Disclosing an error after the FTA has notified you of an audit costs materially more than disclosing it before. That difference, and the penalty schedule that replaced the old VAT and tax procedures penalties in April 2026, are set out on our VAT and corporate tax compliance page. The practical rule is simpler than the tables: an error you find yourself is always cheaper than the same error found by the Authority, and it gets more expensive every month it stays in a filed return.

A review before the Authority arrives works in both directions

A pre-filing or pre-audit review is usually sold as defence. It is also the only systematic way to find reliefs you were entitled to and did not take: an expense treated as non-deductible that the law allows, a tax loss not carried forward, input VAT left unclaimed after its recovery window closed. Each is recoverable only where the documents support it. A deduction with no invoice behind it is a finding, not a saving, and a review that "finds" reliefs without evidence is manufacturing an audit adjustment for later.

Where the relief belongs to a return already filed, the Tax Procedures Law lets you claim it by voluntary disclosure, which is permitted where a return overstated the tax payable as well as required where it understated it. A voluntary disclosure cannot be made after five years from the end of the tax period, and since 1 January 2026 a credit balance held with the Authority must also be claimed within five years of the end of the tax period it relates to. A relief nobody looks for inside that window is lost for good.

The same review exposes the weaknesses that produced the errors — an expense process nobody approves, revenue recorded on a different basis in the VAT return from the one used in the accounts. Fixing the process is what stops the next year's review finding the same thing.

Who stands between you and the Authority during a tax audit

Article 14 lets a person appoint a Tax Agent to act in its name and on its behalf in its tax affairs, without removing the person's own responsibility for the tax. Formal representation before the FTA during a tax audit is therefore the work of an accredited Tax Agent listed by the Authority, not of a consultant and not of your statutory auditor. Ask for the agent's number and check it against the FTA's own list.

What we do is the work that representation rests on: reconcile the returns to the ledger before the audit opens, assemble the evidence file the tax auditor will ask for, prepare written explanations for the positions taken in the return, and work alongside the Tax Agent you appoint. If the result of the audit is wrong, there is a reconsideration route with a short first deadline, set out on our VAT and corporate tax compliance page. A notice of audit results is not a letter to leave unopened for a month.

Why your bank asks for the same numbers

Banks review corporate relationships annually, and they ask for financial statements at that review and at any credit or trade facility application. They distinguish sharply between audited and unaudited ones.

A company that cannot produce audited statements on request is not usually refused outright. It is quietly moved down a tier: lower facility limits, more documentation per transfer, slower approvals, and periodic questions about whether the activity matches the licence. Where the account was opened on a projected business plan, the first set of audited accounts is the document that either confirms that plan or contradicts it. Our banking advisory page covers what sits in that file.

Choosing an approved auditor where the zone keeps a list

Since 28 March 2024 the profession has been governed by Federal Decree-Law No. 41 of 2023, which repealed the 2014 law entirely. Only practitioners licensed by the Ministry of Economy and Tourism may hold themselves out as chartered accountants, and a Professional Compliance Committee investigates violations with powers running from written warnings and fines of AED 10,000 to AED 1,000,000, through suspension of the licence for one month to three years, to cancellation.

On top of that federal layer, most free zones maintain their own approved list, and a report signed by a firm not on the relevant list is rejected on receipt. The work is done, paid for, and worthless. So:

• Check the list before you engage, not after. Lists change; an approval from three years ago is not evidence of a current listing.
• Check the list for your zone specifically. DMCC approval does not make a firm acceptable to RAKEZ, Jafza or ADGM.
• Establish who signs. The partner named on the opinion matters more than the firm's brochure.
• Confirm independence. A firm that keeps your books should generally not audit them. If one provider offers both, ask precisely how the engagements are separated and get the answer in writing.
• Ask what is excluded. Group consolidation, stock counts at multiple sites, prior-year restatements and the Agreed-Upon Procedures report for free zone distributors are frequently priced outside the base fee.

Audit fees vary widely by zone, by size and by the state of your records. Any figure quoted before the auditor has seen a trial balance is a guess, and a quote given without asking about your zone is a guess about the wrong company.

Five other engagements are sold as audit work, and each answers a different question

The statutory audit answers one question: are these financial statements fairly presented? Firms sell five other engagements under the same word or next to it, and a founder who buys the wrong one gets a competent answer to a question nobody asked.

None of the last five produces an audit opinion, and none substitutes for one. A zone that requires audited statements will not accept a stock audit or a due diligence report in their place, and a clean statutory audit does not answer any of the other five questions.

The engagement	The question it answers	An audit opinion?
Statutory audit	Are these financial statements fairly presented?	Yes
Internal audit	Do the controls you depend on operate as designed across the year?	No
Stock audit	Is every item there, in what condition, and still sellable at its carrying value?	No
Financial due diligence	What do the seller's accounts leave out, and what travels with the shares?	No
Third-party vetting	Does this supplier or agent exist, hold a licence, and stay off a sanctions list?	No
Forensic engagement	What happened, where there is a specific suspicion, dispute or transaction?	No

Internal audit starts with the letter your statutory auditor already writes

Before paying for an internal audit, read what the statutory audit produced beyond the opinion. Under the International Standards on Auditing, ISA 265, an auditor who identifies significant deficiencies in internal control during the audit must report them in writing to those charged with governance, and raise lesser ones with management. Most firms deliver this as a management letter.

It is a by-product, not a controls review. The auditor looks at controls only as far as needed to plan the audit and gives no opinion on whether they work. But the findings are specific — expenses paid without an approval trail, revenue recognised on different bases in different months, bank reconciliations nobody reviewed, a supplier list anyone in the office can edit — and they are cheap, because the audit fee has already paid for them. The value is in the follow-through. Each finding is a change to how the books are kept, and it is the bookkeeping side, not the auditor, that has to make it. A management letter that repeats last year's points is telling you nobody did.

Internal audit proper is the next step, and it is worth buying at a later point than most firms pitch it. It tests whether the controls you depend on operate as designed across the year, rather than at the year end. It earns its cost once the founder no longer sees every payment: several sites or entities, a finance team of more than a couple of people, a tax group whose members' figures have to be aggregated and audited, an investor or lender with information rights, or a sale or funding round in view where the other side will test the same controls. For some businesses it is not a choice at all. A firm authorised by the Dubai Financial Services Authority must maintain an internal audit function, independent of its operational and business functions, with a narrow exception for venture capital fund managers.

It comes in two shapes. Co-sourced: your own internal audit or finance team keeps ownership of the work, and an outside firm supplies specialist skills, extra hands for a particular review, or a reviewer independent of the people being reviewed. Outsourced: an outside firm runs the whole function to a plan your board approves, and reports to the board rather than to the people whose work it tests. Either way, the firm doing it should generally not be your statutory auditor, which would otherwise end up relying on its own work.

A stock audit counts every item; the year-end count only tests it

The inventory records on the fieldwork checklist below serve the statutory audit. The auditor attends or tests the year-end count to the extent needed for an opinion on the statements as a whole, which means test counts and sampling, not verifying every line. A stock audit is a separate engagement with a different aim: item-by-item verification of what is physically there against what the system says, its condition, where it is, and whether it can still be sold at the value it carries — ending in a report that lists every difference and what caused it.

It is worth buying where stock is a large part of the balance sheet, where it sits at several sites or in a warehouse run by someone else, where a storekeeper or warehouse manager is changing, where losses are suspected, before the business is sold, or where a lender or insurer holding the stock as security asks for one. Counts at multiple sites are already among the items priced outside a statutory audit fee, so if you need both engagements, agree the timing with your auditor before either count is planned rather than paying twice for the same visit.

Financial due diligence is the accounting half of buying a company

When you buy shares you buy the company with its history, so the question is not what the seller's accounts say but what they leave out. Financial due diligence answers it: whether profit is recurring or flattered by one-off items and related-party pricing; what debt and debt-like items sit outside the headline figures, accrued end-of-service entitlements above all; how much working capital the business really needs to run; and what tax exposure travels with the shares for periods already filed — corporate tax, VAT and, for a free zone target, whether its 0% position was ever sound. A merger is the same exercise run in both directions, since each side is buying into the other's history.

It is not an audit, and the report carries no opinion. It works from what the seller produces, to a scope the buyer sets, which is why the scope letter matters as much as the firm. And it is only half the diligence. Title to the shares, the licence and its activities, contracts, guarantees and litigation are legal questions for lawyers, which is why our page on business setup consultants says plainly that buying an existing company is not formation work. How little a UAE company files publicly, and what to ask for instead, is set out in what you can verify about a UAE company before you buy into it.

Fraud risk is managed before the money leaves, not investigated after

The forensic paragraph below deals with what happens once there is a suspicion. Most losses in owner-managed companies are prevented more cheaply, by a handful of controls that cost nothing but discipline:

• Separate who creates a supplier from who pays one. A fictitious supplier needs both.
• Confirm changed bank details by calling a number you already hold, never the one on the email announcing the change.
• Require a second signatory on the bank mandate above a set amount, and make the second signature a genuine review rather than a formality.
• Reconcile every bank account monthly, with someone other than the preparer reviewing it.
• Match what was ordered, what was received and what was invoiced before any purchase invoice is paid.

The same controls protect the figures themselves. A ledger that one person posts to and nobody reviews is where financial statements get distorted, deliberately or not, long before an auditor sees them.

Third-party vetting is the other half: checking that a new supplier, customer or agent exists, holds a licence for what it claims to do, and is not on a sanctions list, before money moves. For most businesses that is prudence. For dealers in precious metals and stones, real estate brokers and agents, accountants and auditors, and corporate service providers — the designated non-financial businesses and professions of the anti-money laundering framework — customer due diligence is a legal obligation supervised by the Ministry of Economy and Tourism, with a risk assessment and suspicious transaction reporting alongside it. If your activity puts you in that group, vetting is a compliance programme you run continuously, not a review you buy once.

Where this is the wrong purchase

If nothing above requires an audit of you, do not buy one. A mainland LLC below AED 50 million in revenue, not in a tax group, not claiming QFZP status, with no bank facility and no outside shareholder, has a company law duty to appoint an auditor and no external party asking for the output. That duty is real and should be met, but it is a modest engagement, and it is not the one most firms will quote you.

An audit will not fix bad bookkeeping. It will price it. If your records are eleven months of bank statements and a folder of invoices, the audit is the most expensive available route to getting them in order. Fix the accounting first, at accounting rates. Companies routinely pay two or three times what they should because they bought the audit and assumed the catch-up was included.

The cheapest quote is often the most expensive outcome. A report from a firm not on your zone's list is rejected and re-performed. A report signed without proper testing is a liability in a tax audit that can reach back seven years.

QFZP status may not survive the arithmetic. Audited financial statements at any revenue level, transfer pricing documentation and genuine substance in the zone are all conditions of the 0%. On a company with AED 800,000 of turnover selling mainly to mainland or overseas customers — where most income is not qualifying anyway — those costs frequently exceed the tax saved. Model it before committing to the status, not after.

Internal audit is not for a company of eight people. Internal audit tests whether existing controls are working. In a company where the founder signs every payment, the founder is the control. Buying an internal audit function at that size buys documentation of something you already know.

A forensic engagement is not a management tool. Forensic work is proportionate where there is a specific suspicion, a dispute or a transaction under investigation. Commissioning one to settle a disagreement between shareholders usually produces an expensive report that neither side accepts.

A clean audit opinion is not a tax clearance and not a fraud guarantee. It says the statements are fairly presented under the applicable standard. It does not confirm that your QFZP position holds, that your related-party pricing is at arm's length, or that nothing was missed.

And the opinion is not ours to sign. The audit report comes from a licensed audit firm, and independence rules mean the practice that maintains your ledgers should not be the one auditing them. What we do is keep the books to a standard that survives an audit, prepare the file, coordinate with an auditor your zone will accept, and make sure the audited figures and the tax return tell the same story. Anyone offering to do all of it under one signature is describing an arrangement you should question.

What to have ready before fieldwork starts

• Trial balance and general ledger for the full financial year, in the standard you have committed to.
• Bank statements for every account, and confirmations the auditor can request directly from the bank.
• Sales and purchase invoices, matched to the ledger.
• Signed contracts, lease agreements and loan documents.
• Fixed asset record with additions, disposals and the depreciation policy.
• Inventory count records, dated and signed, where you hold stock.
• A schedule of every related-party and connected-person transaction, including director's remuneration.
• Prior year audited statements where they exist, plus the trade licence, memorandum and shareholder record.
• VAT returns for the year, reconciled to revenue in the ledger.

Nothing here substitutes for advice on your own facts, and no threshold or deadline above should be relied on without checking it against the source cited. Free zone submission rules in particular change quietly, and the retention rules changed once already since 2023.

Tell us your jurisdiction, your financial year end, your revenue and whether you intend to claim free zone status, and our tax and financial advisory team will tell you which of the three obligations actually applies to you — including when the honest answer is that you do not need the audit you were about to buy.

Frequently asked questions