Statutory Audit Requirements UAE: Who Must Audit and When

The phrase “statutory audit requirements UAE” gets typed into search bars by two very different people: a founder who has just received a licence-renewal notice asking for audited financial statements, and a finance manager whose company has crossed a Corporate Tax threshold and now needs an auditor for the first time. Both are asking the same underlying question — do we actually have to do this, and if so, who, what and when? The honest answer is that UAE audit obligations are scattered across three separate rulebooks — the Commercial Companies Law, individual free zone regulations, and the Corporate Tax regime — and a company can be caught by any one of them. This guide pulls those threads together, explains who must audit and when, and draws the line between a statutory audit and the internal audit it is so often confused with.

What a statutory audit actually is

A statutory audit is an independent examination of a company’s financial statements, carried out by an external auditor, that ends in a signed opinion on whether those statements give a true and fair view. The word “statutory” is doing real work: it means a law or regulation compels the audit, as opposed to a voluntary review a company commissions for its own comfort.

The defining feature is the audience. A statutory audit exists to give third parties — shareholders who are not involved in day-to-day management, banks deciding whether to lend, regulators checking compliance, and increasingly the Federal Tax Authority — a reason to trust the numbers. The auditor is not there to help the company run better; they are there to test the accounts against evidence and stand behind a conclusion that outsiders can rely on. That independence is the entire point, which is why the UAE restricts who may sign one.

Contrast that with an internal audit, and the difference becomes clear. Internal audit is a management function — it examines controls, processes and risk from the inside, and its findings stay with leadership. A statutory audit is external, independent, and its output is a formal opinion addressed beyond the boardroom. Confusing the two leads companies to assume an internal review satisfies a licence-renewal or tax requirement. It does not.

The mainland rulebook: the Commercial Companies Law

The foundation of UAE audit obligations for mainland companies is Federal Decree-Law No. 32 of 2021 on Commercial Companies. It sets out two obligations that matter here, and they work together.

First, every company must maintain accounting records that accurately capture its transactions and reflect its financial position at any given moment. These records must generally be kept for five years. This is not a filing formality — it is the raw material an auditor works from. A company that keeps clean, organised records for five years has already done most of the heavy lifting for its audit; a company that lets records drift will pay for the reconstruction later.

Second, and specifically for limited liability companies, the law requires the appointment of an approved auditor to examine the accounts. The LLC is the workhorse structure for UAE SMEs, which means a large share of mainland businesses fall squarely inside the statutory-audit requirement by virtue of their legal form alone — before free zone rules or Corporate Tax even enter the picture.

The practical takeaway for a mainland LLC is simple: keeping proper accounting and bookkeeping records is not optional housekeeping, it is the first half of a legal obligation whose second half is the audit itself. Neglect the records and the audit becomes painful; keep them well and the audit becomes routine.

The free zone layer: audit as a renewal condition

The UAE’s free zones each operate under their own authority with their own regulations, and a great many of them make audited financial statements a condition of annual licence renewal. This is where a lot of SME founders get surprised. A company can be small, profitable and perfectly well run, and still be obliged to produce a full audited set every year simply because its free zone authority demands one before it will stamp the renewal.

Because the requirement flows from the free zone authority rather than a single national rule, the details vary. Some zones ask for audited statements every year without exception; some set thresholds; some ask for them on request or at specific milestones. The only reliable move is to read your own free zone’s current regulations rather than assume the requirement matches a neighbouring zone.

The upshot is that “we’re a free zone company, so we don’t have to worry about mainland rules” is a dangerous half-truth. The free zone frees you from certain mainland requirements, but it can impose an audit requirement of its own that is every bit as binding.

The Corporate Tax layer: the newest trigger

Corporate Tax is the most recent addition to the audit map, and for many companies it is the trigger they least expect. The regime brings an audited financial statements requirement into play for two important groups.

The first is larger businesses — those whose revenue crosses AED 50 million. Above that revenue level, the expectation to maintain audited financial statements for Corporate Tax purposes applies, which can pull a company into mandatory audit even if its legal form or free zone had not already required one.

The second is qualifying free zone persons — free zone entities that want to benefit from the 0% Corporate Tax rate on qualifying income. Maintaining audited financial statements is part of what a qualifying free zone person is expected to keep in order, so the audit becomes bound up with preserving a valuable tax position rather than being a standalone compliance chore.

This is why audit and tax can no longer be treated as separate silos. A company’s corporate tax position and its audit obligation now feed each other: the audited accounts support the tax return, and the tax status can be what makes the audit mandatory in the first place. Planning them together — same financial data, same close discipline, same records — is far more efficient than running two disconnected annual exercises.

“

A statutory audit is never a maths problem discovered in the fieldwork window — it is the sum of twelve monthly closes done properly. Fix the close, and the audit fixes itself.

Who can actually sign the opinion

One point is absolute: a UAE statutory audit can only be conducted and signed by an auditor registered with the Ministry of Economy. An accomplished accountant, a competent bookkeeper, an in-house finance director — none of them can issue a statutory audit opinion, however strong their technical skills. The law reserves that signature for approved, registered audit practices.

This matters for how an SME should structure its finance support. There is a clean and deliberate division of labour. A firm can prepare the financial statements, assemble the schedules, reconcile the balances and manage the whole relationship with the auditor — but the independent opinion has to come from a separately registered auditor, which is why knowing how to choose an approved auditor in the UAE matters as much as getting the books clean. That separation is not bureaucracy; it is the mechanism that keeps the opinion independent and therefore worth something to a bank or the FTA.

At Velmont Crest we sit firmly on the preparation-and-support side of that line. We provide audit assistance — getting the books audit-ready, building the working papers the auditor will ask for, and acting as the bridge between the business and its approved auditor — while the audit opinion itself is signed by the registered audit firm. Understanding this split saves founders from two common mistakes: expecting their bookkeeper to sign an audit, or expecting their auditor to also keep their books.

Statutory audit versus internal audit, settled

Because the two terms get used interchangeably in conversation, it is worth setting the distinction out plainly. They are not two flavours of the same thing; they answer different questions for different audiences.

A statutory audit is external, independent, mandated by law or regulation, and produces a formal opinion for third parties on whether the financial statements are true and fair. Its audience is outside the company — shareholders, lenders, regulators, the tax authority. Its trigger is a legal or regulatory requirement. Its output is a signed opinion.

An internal audit is internal, run by or for management, discretionary rather than mandated, and produces findings and recommendations for leadership. Its audience is inside the company. Its trigger is management’s own desire to test controls, reduce risk and improve how the business runs. Its output is a report that stays in-house.

A company can need both at once — a statutory audit to satisfy the law and reassure outsiders, and an internal audit to tighten its own controls — but satisfying one does not satisfy the other. An internal review, however thorough, will never discharge a statutory audit obligation, and a statutory audit is not designed to give management the operational deep-dive that internal audit provides.

Getting audit-ready before the auditor arrives

The single biggest lever an SME has over its audit is preparation, and preparation is a monthly habit rather than a year-end sprint. The companies that finish audits quickly and cheaply share a set of practices that make the auditor’s job a confirmation exercise instead of an investigation.

Keep the trial balance tied to the bank every month, so cash is never a question mark. Maintain a fixed-asset register that agrees to the ledger, with additions and disposals recorded as they happen rather than reconstructed at year end. Document related-party transactions and intercompany balances when they occur, because these are exactly what an auditor probes hardest. Cut revenue off cleanly at each period end so income lands in the right year. And retain the source documents — invoices, contracts, bank statements, prior audited accounts — in an organised set the auditor can trace balances back to without a paper chase.

Do these things through the year and the audit becomes short, calm and predictable. Skip them and the auditor spends fieldwork rebuilding what should already exist, which shows up as higher fees and a longer list of management-letter findings — see how preparation moves the cost of an audit in the UAE for the fee bands and what drives them. The difference between a smooth audit and a painful one is almost never the auditor — it is the twelve months of bookkeeping that came before them.

Where this leaves your business

If there is one thing to take from all of this, it is that UAE statutory audit requirements do not come from a single source, so you cannot rule the audit out by checking only one. Ask three questions. Does the Commercial Companies Law catch you — are you a mainland LLC that must appoint an approved auditor? Does your free zone authority require audited financial statements to renew your licence? And does Corporate Tax pull you in — through the AED 50 million revenue level or a qualifying free zone person position? A yes to any one of them means you need a statutory audit, signed by a Ministry of Economy–registered auditor.

The good news is that the work that makes an audit painless is the same work that keeps you compliant everywhere else: disciplined monthly accounting and bookkeeping, a clean close, and records kept in order for the five-year period the law expects. Get that foundation right and the audit stops being a threat on the calendar and becomes the routine confirmation it is meant to be.

Velmont Crest is a DED-licensed UAE accounting firm providing advisory, preparation and audit assistance — getting your books audit-ready, building the working papers your approved auditor needs, and keeping your corporate tax position aligned with your audited accounts — for mainland and free zone SMEs. Read more on our insights hub or get in touch via our contact page.

Disclaimer: Velmont Crest is a DED-licensed accounting firm providing advisory, preparation and compliance support services. We are not an approved or registered statutory auditor, a law firm, or the Federal Tax Authority, and we do not sign audit opinions. Audit requirements under the Commercial Companies Law, individual free zone regulations and the Corporate Tax regime change and vary by entity — verify your specific obligations with your free zone authority, your registered auditor and current UAE law, and consult a licensed professional for advice specific to your circumstances.

References

• UAE Ministry of Economy
• Federal Decree-Law No. 32 of 2021 on Commercial Companies
• UAE Federal Tax Authority — Corporate Tax
• UAE Ministry of Finance — Corporate Tax in the UAE