A useful internal audit checklist does two things: it tells you what to check, and it tells you when in the process to check it. Most checklists only do the first. Below is a working checklist organized around the four phases of an actual internal audit – Planning, Fieldwork, Reporting, and Follow-up – so you can use it either to prepare your own team or to brief an external audit partner.
Why This Matters More in 2026
Three regulatory shifts have changed what a UAE internal audit needs to cover this year:
- Corporate Tax’s second filing cycle. Businesses that filed their first Corporate Tax return are now in their second cycle, and the FTA has been more active on verification and documentation requests. An internal audit is the cleanest way to catch gaps before the FTA does.
- E-invoicing rollout. Under the phased timeline confirmed by the Ministry of Finance, larger businesses (annual revenue of AED 50 million or more) must appoint an Accredited Service Provider by 30 October 2026 and go live on the Peppol-based e-invoicing system by 1 January 2027, with smaller businesses following in a later phase. Internal controls around invoicing and accounting systems need to be audit-ready well before those dates.
- Data protection obligations. Under Federal Decree-Law No. 45 of 2021 (the PDPL), companies handling personal data are expected to have documented data protection practices – an area that internal audits have historically skipped.
None of this replaces a full internal audit engagement, but it does mean last year’s checklist is already out of date.
Phase 1: Planning
This is where most audits succeed or fail, because it decides what actually gets reviewed.
- Define the objective and scope: Is this a full operational audit, a compliance-focused review, or a targeted look at one department or process?
- Pull and review prior audit reports (internal or external) and note which recommendations were never implemented.
- Identify the laws, regulations, and internal policies relevant to the scope – Corporate Tax Law, VAT Law, the Commercial Companies Law, sector-specific rules, and the company’s own SOPs.
- Set a realistic timeline and budget, and confirm what access, systems, and personnel the audit will require.
- Agree on the reporting format and who receives the final report.
Phase 2: Fieldwork
This is the evidence-gathering phase, and the checklist here should be organized by control area rather than by department.
Financial controls
- Are accounting and financial reporting processes accurate and consistently applied?
- Is there proper segregation of duties between initiating, approving, and recording transactions?
- Are bank reconciliations, supplier invoices, and payroll records complete and matched to source documents?
Regulatory and tax compliance
- Is the Corporate Tax position (registration, exemptions, related-party transactions) properly documented?
- Are VAT returns filed on time, with input and output tax reconciled to the general ledger?
- Are trade licenses, permits, and industry-specific approvals current?
Governance and policy
- Are company policies – HR, procurement, anti-money laundering, conflict of interest – documented and actually followed, not just written down?
- Is there a documented internal control framework, and does anyone own it?
IT and data
- Are data backup and recovery procedures tested, not just documented?
- Is there a written data protection policy consistent with PDPL requirements?
- Are access controls and cybersecurity protocols reviewed on a set schedule?
- Is the accounting or ERP system capable of supporting e-invoicing requirements ahead of the applicable deadline?
Risk management
- Are key business risks identified, ranked, and reviewed periodically, rather than assessed once and forgotten?
- Is there a distinction between inherent risk (before controls) and residual risk (after controls), and is residual risk within an acceptable range?
Each item should be tested against actual evidence – interviews, documents, system logs – not answered from memory.
Phase 3: Reporting
- Draft findings in plain language: what was tested, what was found, why it matters.
- Rank findings by severity and business impact, not just by how easy they are to fix.
- Attach practical, specific recommendations to every finding – “improve controls” is not actionable; “require dual sign-off on payments above AED X” is.
- Circulate a draft to management before finalizing, so the report reflects a real conversation rather than a one-way memo.
Phase 4: Follow-up
This is the phase most checklists skip, and it’s the one that determines whether the audit changed anything.
- Set a follow-up date, typically 3–6 months after the report, to check implementation status.
- Track each recommendation individually: implemented, in progress, or not started, with a reason if it’s the latter.
- Re-test any control that was flagged as weak, rather than accepting management’s word that it’s fixed.
In-House or Outsourced?
Running this checklist internally works well for smaller, lower-risk businesses with the staff to do it objectively. It becomes harder to justify once the company hits a size where the same people who run a process are also the ones auditing it – that’s a conflict of interest that an outsourced or co-sourced internal audit avoids by design. It’s also worth outsourcing, or at least co-sourcing, in any year with a major regulatory change (like the current e-invoicing rollout), since an external internal audit team will already be current on the requirements.
Frequently Asked Questions
How often should a UAE company run an internal audit?
Annually at minimum, with higher-risk areas (finance, tax compliance, IT security) reviewed more frequently. Companies going through fast growth, a new regulatory obligation, or a past control failure should audit more often.
Is an internal audit legally required in the UAE?
Internal audit itself isn’t universally mandated for all UAE companies, though certain regulated sectors and listed entities do have specific governance requirements. Even where it isn’t required, it’s increasingly treated as standard practice given the pace of regulatory change.
What's the difference between this checklist and an external audit?
This checklist supports an internal audit, which is about improving operations and controls for management’s benefit. An external audit is independent and produces an opinion on the financial statements for third parties – regulators, banks, and investors.
Can this checklist replace hiring an internal audit firm?
It’s a starting point, not a substitute. A checklist tells you what to look at; it doesn’t tell you what “good” looks like for your specific risk profile, industry, or size – that judgment is what an experienced internal auditor brings.
Getting Started
Use this checklist to run a first pass internally, and treat any section where you can’t confidently answer the questions as a priority area for a proper internal audit engagement. If the gaps turn out to be bigger than expected – or the last review was more than a year ago – that’s usually the signal to bring in an internal audit specialist rather than trying to close them all in-house.
Author:
Written by the Audit & Assurance team at NR Doshi & Partners, a UAE-based chartered accountancy and business advisory firm providing internal audit, external audit, and compliance services across Dubai, Abu Dhabi, and the wider UAE.
UAE Pillar Two Registration Deadline: 30 November 2026
October 12, 2026
Do You Need a CFO? 7 Signs Before You Hire One
October 9, 2026
