Audit · Dubai
Internal Audit, External Audit and the FTA Audit: What Each One Is
Last reviewed by the Exiloz tax team against the UAE legislation in force on that date. Tax law moves — confirm any figure against tax.gov.ae before you act on it.
Three different things share one word
Dubai business owners use the word audit for three separate things. An external audit is an independent opinion on the financial statements by a licensed auditor, and many companies must have one. An internal audit is a review of controls that the company chooses to run. Audit support and preparation starts by working out which one the company actually needs.
The third meaning, an FTA tax audit, is the Federal Tax Authority examining tax records, and the company never chooses it. Mixing the three up is expensive in both directions. Some companies pay for an internal review thinking it satisfies a bank, and it does not. Others skip an external audit they were obliged to have, until a renewal fails.
What is the difference between an internal and an external audit?
External audits give an independent opinion on the financial statements, signed by a licensed, independent audit firm. Internal audits test the company's controls, processes and risks and report to company management. Only the external audit produces the independent opinion that banks and licensing authorities rely on.
An FTA tax audit is different again, because the authority starts it by notice and examines the tax records itself. Our guide to the FTA tax audit explains what happens then. Treat each of the three as a separate process with its own purpose.
Quick Answer
In the UAE, an external audit gives a licensed firm's independent opinion on financial statements. An internal audit reviews controls for management, and an FTA tax audit examines tax records.
When does a Dubai company need an external audit?
For Corporate Tax, when revenue exceeds AED 50 million in the tax period, under Ministerial Decision No. 84 of 2025. Every Qualifying Free Zone Person also needs audited statements, whatever its revenue. Tax Groups need audited special-purpose financial statements for the group.
Company law is the wider trigger, because Article 27 of the Commercial Companies Law requires every mainland LLC to have its accounts audited yearly. Some free-zone authorities and lenders require audited accounts as well. Our guide to audited financial statements covers the Corporate Tax threshold in more detail.
Quick Answer
Every Dubai mainland LLC needs a yearly external audit under the Commercial Companies Law. Corporate Tax requires one above AED 50 million revenue and for every Qualifying Free Zone Person.
What does an internal audit check?
Whether the business is run the way the owners think it is. A practical internal review tests a sample of real transactions in the processes where money leaks most easily. It then reports the findings to management so they can be fixed.
Typical areas are payments, sales discounts, bank access and reconciliations, stock records and payroll changes. A good report is short: what was tested, what was found, what it cost and who fixes it by when. It carries no opinion that a bank or the FTA can rely on.
Quick Answer
An internal audit in the UAE tests purchasing, sales, bank access, stock and payroll controls for management. It produces practical findings, not an opinion banks or outside regulators rely on.
How much can an internal review save?
Often more than it costs, because leakage repeats every year until someone fixes it. Take an illustrative Dubai distributor with AED 3,500,000 of annual supplier payments. A review of its payables finds AED 42,000 paid twice, or 1.2% of payables.
The duplicates happened because invoices were entered once from email and once from paper copies. Most suppliers refund the money once asked, and a duplicate-invoice check in the accounting system stops it recurring. A statutory audit, which tests the financial statements as a whole, might never have found that pattern.
Quick Answer
An internal review can recover real money, such as duplicate supplier payments, and fix the control behind them. In one illustration, duplicates reached 1.2% of a Dubai distributor's annual payables.
Can one firm handle both audits?
Not the statutory audit and the internal work on the same records, because the external auditor must stay independent. The statutory audit must be performed by a licensed, independent audit firm. The company's own accountants cannot sign the audit opinion.
Preparation for the external audit and internal control reviews can be done by the company's team or outside advisers. Exiloz prepares records and runs internal reviews, but does not perform statutory audits. Whether strong internal controls lower FTA risk ratings is unpublished, so treat internal audit as a business decision.
Quick Answer
UAE statutory audits must come from a licensed, independent audit firm that did not prepare the records. Outside advisers can prepare the accounting records and run internal control reviews instead.
Know Which Audit Applies
Exiloz tells you which audit applies, prepares your records and works alongside the licensed auditor. We prepare; a licensed firm signs. Ask about audit support and preparation.
Frequently Asked Questions
Does an internal audit satisfy a free zone's audit requirement?
No, where an authority, company law or the tax rules require audited financial statements, only a licensed auditor's signed report satisfies it. Internal reviews and accountant-reviewed accounts do not count.
Are internal audits required for private companies in Dubai?
Generally not for private, unregulated companies, although regulated sectors can have their own requirements. For most small and mid-sized businesses, an internal review is a management choice, not a duty.
Is an FTA tax audit the same as an external audit?
No, an FTA tax audit is the Federal Tax Authority examining records under the Tax Procedures Law. An external audit is commissioned by the company to test its financial statements.
When should an internal review happen?
Mid-year is often most useful, because problems can still be fixed before the external audit. The owners then hear about weaknesses from their own reviewer rather than the external auditor.
When should a December year-end company appoint its external auditor?
Appoint before 31 December, so the auditor can attend the year-end stock count and plan the work. Our December year-end audit preparation guide explains the full timetable in more detail.
Does a good internal control environment reduce audit fees?
It can, because the external auditor may rely on tested controls rather than checking every single transaction. Monthly bank reconciliations and clearly documented approvals usually shorten the fieldwork as well.
Can management accounts replace audited financial statements?
No, management accounts reviewed by an accountant are not audited statements. Where an audit is required, only a licensed auditor's signed report meets that requirement for licensing authorities and lenders.
Which companies must have audited statements for Corporate Tax?
Companies with revenue above AED 50 million in the tax period, every Qualifying Free Zone Person and Tax Groups. Licence, loan or constitutional requirements can add further cases beyond these.
What should an internal audit report contain?
What was tested, what was found, the financial effect and who will fix each issue by when. A long report that nobody acts on achieves less than having no report.
Can Exiloz help prepare for an external audit?
Yes, Exiloz builds the audit schedules, reconciles the balances and runs internal control reviews before the auditor arrives. A separate licensed, independent audit firm then performs the statutory audit itself.
Main Takeaways
An external audit gives a licensed auditor's independent opinion on the financial statements, while an internal audit reviews controls for management. UAE Corporate Tax requires external audits above AED 50 million of revenue and for every Qualifying Free Zone Person. Company law requires one every year for mainland LLCs too. Internal reviews often pay for themselves by stopping repeated losses.
Know Which Audit You Actually Need
The word audit covers three different processes in the UAE, and confusing them costs real money. An external audit is often a legal or commercial requirement, while an internal audit is usually a management choice. An FTA tax audit is started by the authority, never by the company itself. Each needs different preparation, different timing and a different provider.
A mainland LLC always needs one under company law; other companies should check the Corporate Tax trigger, licence and loan terms. If any applies, appoint a licensed auditor well before the financial year-end. Consider an internal review wherever losses or weak controls are a real concern for the owners. Exiloz can confirm what applies and prepare the records for either audit.
Sources & References
Accounting, Tax & Compliance Services
Accounting & Bookkeeping
Daily bookkeeping, ledger cleanup and UAE-ready financial records.
See how it works
Corporate Tax Services
Registration, return preparation and filing support for taxable persons.
See how it works
Audit Preparation Support
The schedules, reconciliations and files your auditor actually asks for.
See how it works
Payroll & WPS Support
Salary processing, WPS coordination, leave records and reporting.
See how it works
CFO & Compliance Advisory
Finance oversight and compliance planning as the business grows.
See how it works
Business Setup & Incorporation
Mainland and free zone licensing, from structure choice to trade licence.
See how it works
PRO & Document Clearing
Visas, Emirates ID, licence renewals and attestation, handled for you.
See how it works
