Supreme Audit Institution Explained, and Who Fills That Role in the UAE

A supreme audit institution is the national body that audits how a government raises and spends public money. It reports to a parliament or head of state rather than to the entities it audits, works to INTOSAI standards, and has no role in auditing private companies — those are audited by registered private firms. That distinction is the whole answer to most searches for this term.

The phrase turns up in three very different places: in governance literature, in tender documents, and in the search history of a business owner who typed “audit authority UAE” and ended up somewhere unexpected. This guide, current as at 3 August 2026, covers what a supreme audit institution actually is under the international standards that define it, which bodies hold that role in the UAE, and then the question most readers arrived with — who audits a private company here, and what changes when a government entity is your customer.

What a supreme audit institution actually is

The defining feature is not size or seniority. It is direction of reporting. A supreme audit institution examines an administration and reports outward — to a legislature, a ruler, or the public — rather than back to the department whose accounts it just opened. Remove that and you have an internal audit function, which is a useful thing but a different thing.

The global umbrella body is INTOSAI, the International Organization of Supreme Audit Institutions. Its own site describes it as “an autonomous, independent and non-political organization” and records that it holds “special consultative status with the Economic and Social Council (ECOSOC) of the United Nations”. That combination is deliberate: close enough to the UN system to carry weight, far enough from any single government to be credible when it criticises one.

The founding text is the Lima Declaration, now published as INTOSAI-P 1. It was signed in 1977 at the IX INCOSAI congress in Lima, Peru, republished in 1998, and relabelled INTOSAI-P 1 in 2019 when INTOSAI reorganised its pronouncements into a single framework. The declaration is blunt about what it is for. Its stated aim is “to call for independent government auditing”, and it adds that “a Supreme Audit Institution which cannot live up to this demand does not come up to standard”.

The eight independence tests that define a real SAI

Independence is easy to claim and hard to demonstrate, so INTOSAI wrote it down. INTOSAI-P 10, the Mexico Declaration on SAI Independence, was endorsed in 2007, had its preamble amended in 2018, and was relabelled in 2019. It sets out eight principles, quoted here as published:

1. “The existence of an appropriate and effective constitutional/statutory/legal framework”
2. “The independence of SAI heads and members of collegial institutions, including security of tenure and legal immunity”
3. “A sufficiently broad mandate and full discretion, in the discharge of SAI functions”
4. “Unrestricted access to information”
5. “The rights and obligation to report on their work”
6. “The freedom to decide the content and timing of audit reports and to publish and disseminate them”
7. “The existence of effective follow-up mechanisms on SAI recommendations”
8. “Financial and managerial/administrative autonomy and the availability of appropriate human, material and monetary resources”

Read those against a commercial audit engagement and the contrast is sharp. Your external auditor has none of them in that form. It is appointed by the people it audits, paid by them, and can be replaced by them. The profession manages that tension through licensing, rotation and ethical rules rather than through constitutional protection — a structural point worth understanding before you buy an audit, and one we unpack further in how to choose an approved auditor in the UAE.

“

Public audit and private audit share a verb and almost nothing else. One is a constitutional check on power; the other is a service you procure. Confusing the two is how businesses end up looking for a government authority to audit them.

The three kinds of audit an SAI performs

INTOSAI’s standards are numbered by subject, and the numbering maps neatly onto what a supreme audit institution does. The framework published at issai.org sets out ISSAI 100–129 as the “Fundamental Principles of Public Sector Auditing” and ISSAI 130–199 as “SAI Organisational Requirements”, then splits the work three ways.

Financial audit — the 200–299 principles and the 2000–2899 standards — asks the familiar question: are the accounts fairly stated? This is the closest thing to a company audit, and the underlying testing looks similar.

Compliance audit — the 400–499 principles and the 4000–4899 standards — asks whether the money was raised and spent in accordance with the laws, budgets and authorisations that permitted it. A payment can be correctly recorded and still be unlawful. Private-sector audit rarely reaches this question except where a specific regulation bites.

Performance audit — the 300–399 principles and the 3000–3899 standards — asks whether public money achieved anything. Was the road worth building, did the programme work, was the procurement economical? No shareholder audit asks this, because the market answers it instead.

That third category is the reason SAIs matter politically. A performance audit can conclude that everything was legal, everything was recorded, and the spending was still poor value.

The dated facts, and where each one comes from

Who covers public funds in the UAE

The UAE runs public audit on two levels, which is what you would expect from a federation.

At federal level, the national audit body is the institution ARABOSAI lists as the State Audit Institution of the United Arab Emirates. It publishes today on the government domain uaeaa.gov.ae and is commonly referred to as the UAE Accountability Authority. Treat the current name as indicative until you confirm it at source — see the note above.

At emirate level, Dubai’s public-sector auditor is the Financial Audit Authority. Its own site describes it as an independent body overseeing public funds and promoting accountability, transparency and integrity in government entities, covering “government departments, public bodies, public institutions, and government-owned companies”, with financial and compliance auditing, performance audit and assessment, and digital and technology auditing among its functions. We cover its jurisdiction and its reach into supplier paperwork in detail in our Financial Audit Authority Dubai guide. Abu Dhabi maintains its own accountability authority for its public sector on the same model.

None of these bodies audits a private company’s statutory accounts. That is not a gap in their powers; it was never their job.

What we could and could not verify about the UAE federal audit body

This deserves its own section rather than a footnote, because the naming here has genuinely moved and a lot of what is written about it online is out of date.

What we verified on 4 August 2026. A federal body publishes on the UAE government domain uaeaa.gov.ae under the name UAE Accountability Authority, and that site carries a news item titled “UAE President issues Federal Decree-Law establishing UAE Accountability Authority”, dated 19 December 2023. The UAE Legislation portal, uaelegislation.gov.ae, carries an entry headed “Federal Law by Decree of 2023 Concerning the Emirates Accountability Authority”. ARABOSAI separately lists the UAE member institution as the State Audit Institution of the United Arab Emirates.

What we could not verify at source. The uaeaa.gov.ae pages returned no readable body text to us, and the UAE Legislation portal returned an access error on both the listing and the download link. Federal Decree-Law No. 56 of 2023 is the number reported for the establishing instrument by UAE news outlets carrying the state announcement and by several UAE law firms, and those reports also state that the new Authority replaces the Supreme Audit Institution and reports directly to the President. We have not read that number in a government-published text ourselves, so it is unstamped here.

If you need the citation for a tender response, a governance policy or a compliance file, ask the Authority directly or pull it from the Official Gazette. An unstamped row here is deliberate. The alternative — printing a decree number beside verified ones as though it carried the same weight — is exactly the failure this table exists to avoid.

The standards diverge, and so do the people allowed to sign

A supreme audit institution and your own auditor are not just different bodies. They work to different rulebooks and answer to different registers, and the gap explains why a public audit report reads nothing like the one that goes to your shareholders.

Public-sector audit in the UAE and across the region runs on the INTOSAI Framework of Professional Pronouncements — the ISSAI series, with ISSAI 100 to 129 setting the Fundamental Principles of Public Sector Auditing and the 200, 300 and 400 series covering financial, performance and compliance audit. Performance audit has no private-sector equivalent. No statutory audit of a Dubai LLC asks whether the money achieved value.

Private-sector audit in the UAE runs on a different footing entirely. Article 27(3) of Federal Decree-Law No. 32 of 2021 requires every company to apply the International Accounting Standards and Practices when preparing its periodical and annual accounts, so as to give a clear and accurate idea of its profits and losses. The audit opinion is then given by a firm registered under Federal Law No. 12 of 2014 on the reorganisation of the accounts auditors profession, which the Ministry of Economy describes as making it impermissible for any natural or legal person to practise the auditing profession in the UAE without being registered in the auditors register at the Ministry.

That last row is the practical one. Nothing about your revenue, your emirate or your free zone brings you inside a supreme audit institution’s mandate. Only a public dirham does. And nothing about a public auditor’s powers gets you an audit opinion for a licence renewal or a corporate tax filing — for that you need a firm on the Ministry of Economy register, or one approved by your free zone or financial centre.

Where public audit stops and your company’s audit starts

The private-sector system in the UAE runs on entirely separate legislation. Three layers decide whether your business needs an audit, and they stack rather than replace each other.

Company law comes first. Federal Decree-Law No. 32 of 2021 on Commercial Companies is direct at Article 27(1): “Every Joint Stock Company or Limited Liability Company shall have one or more auditors to audit the accounts of the Company on a yearly basis. The remaining forms of companies may appoint an auditor in accordance with the provisions of this Decree-Law.” Article 26 adds the record-keeping duty behind it — accounting registers that reveal the financial position at any time, kept at the head office for at least five years from the end of the fiscal year. The full mainland picture is set out in statutory audit requirements in the UAE.

Free zone rules come second. Zones set their own conditions, and many require audited financial statements at licence renewal. Which zone you are in genuinely changes the answer, which is why we mapped it separately in do free zone companies need an audit and in the zone-by-zone breakdown of audit requirements at DMCC, JAFZA and DIFC.

Corporate tax comes third. Ministerial Decision No. 84 of 2025 requires audited financial statements from a Taxable Person that is not a Tax Group and derives revenue exceeding AED 50,000,000 during the relevant Tax Period, and from every Qualifying Free Zone Person. It applies to Tax Periods commencing on or after 1 January 2025 and repeals Ministerial Decision No. 82 of 2023, which continues to apply to earlier periods. If you are testing free zone status against this, our Qualifying Free Zone Person checklist walks through the conditions.

A worked example — the AED 50 million line

Consider three UAE businesses with a calendar-year tax period ending 31 December 2025.

Company A is a Dubai mainland LLC with revenue of AED 53,800,000 for the year. Two separate rules apply. Article 27(1) of the Commercial Companies Law already required it to appoint an auditor annually, independent of revenue. Ministerial Decision No. 84 of 2025 then adds a tax-side obligation, because revenue exceeded AED 50,000,000 in the Tax Period. Same audit, two legal reasons, and the tax rule is the one that makes the audited statements a filing-quality document rather than a formality.

Company B is a free zone company claiming Qualifying Free Zone Person status, with revenue of AED 3,100,000. The AED 50 million threshold is irrelevant to it. Article 2(1)(b) of Ministerial Decision No. 84 of 2025 requires audited financial statements from every Qualifying Free Zone Person, with no de minimis at all. A small QFZP and a large mainland trader land in the same place by different routes.

Company C is a non-resident with a permanent establishment in the UAE. Its worldwide group revenue is AED 400,000,000, but only AED 12,000,000 flows through the UAE permanent establishment. Article 2(4) of the same decision states that for a Non-Resident Person, only revenue derived through permanent establishments and nexuses in the State counts towards the threshold. On those figures the AED 50 million test is not met — though the record-keeping and return obligations continue regardless.

Now compare that with a supreme audit institution’s logic. There is no threshold on the public side. A government entity does not escape audit because it is small, and a dirham of public money does not become unauditable below a revenue line. That is the cleanest way to see the difference between the two systems: private-sector audit is triggered by size and legal form, public-sector audit is triggered by the source of the money.

When a government entity is your customer

This is where the two systems finally touch, and it is the part worth acting on.

Public entities in the UAE procure at scale. When a public auditor examines that spending, the evidence it pulls is not limited to the entity’s own ledger. It includes the tender submission, the signed contract, the variations, the purchase orders, the invoices and the delivery or acceptance records — many of which originated with the supplier. Your documents, held on their side.

Three practical consequences follow.

The first is paperwork symmetry. If the entity’s file and your file disagree, the query lands on the entity and the entity’s next call is to you, sometimes two years after the work was done. An invoice that matches its purchase order and a delivery note that someone actually signed are your side of an audit trail you will not be present for.

The second is that payment discipline runs on the same documents. Government payment cycles certify against paperwork, so the suppliers who get paid on schedule are usually the ones whose documents certify cleanly the first time. Clean records are a cash-flow instrument before they are a compliance one.

The third concerns public money you hold directly. If your contract involves advances, collections on behalf of an entity, or concession revenue, keep those balances segregated and reconciled monthly. That is the narrow scenario in which a private company’s records can be examined in direct connection with public funds. The general discipline behind all three is covered in financial record keeping in the UAE, and the month-end habits that make it survivable are in our internal audit checklist for UAE SMEs.

What to do with all of this

If you came here trying to identify a government body that audits your company, stop looking — it does not exist, and the search that will actually help you is for a registered private audit firm. Start with the mechanics of appointing one in how to choose an approved auditor, then look at what the engagement will involve in the company audit process in the UAE and what the different opinions mean in audit report types.

If you already have an auditor and are trying to work out whether you also need something else, the distinction between the statutory opinion and a controls review is explained in external vs internal audit in the UAE, and the current-year obligations are consolidated in UAE audit requirements for 2026. And if your concern is the Federal Tax Authority rather than an auditor, that is a different process again — see FTA tax audits in the UAE.

Where Velmont Crest fits in

We work on the private-sector side of this map. For companies facing their own statutory audit, our audit assistance service prepares the ground before the auditor arrives: closing the books to an auditable standard, building the reconciliations and schedules that will be requested anyway, drafting IFRS-compliant statements, and handling the query traffic with your registered audit firm so your team is not answering the same question three times.

For businesses supplying government entities, the same work doubles as procurement-grade record keeping. Monthly closes through our accounting and bookkeeping service, invoices matched to purchase orders, and an archive that answers a downstream query on the day it arrives rather than the week after. If a tender, a licence renewal or the AED 50 million threshold has put audit readiness on your desk, get a quote — we reply within one UAE business day.