Internal audit is an ongoing review of risks and controls, carried out for management or the board. External audit is an independent examination of the financial statements, carried out by a licensed audit firm, that ends in an opinion. A UAE business may need an external audit by law or licence, while internal audit is chosen by the business unless a regulator requires it.
Different purposes
An internal audit asks whether the business's processes and controls work. It might test procurement, payroll, stock, cash handling or IT access. The report goes to management and the audit committee or owners, and recommends improvements. An external audit asks whether the financial statements give a true and fair view, or a fair presentation, under the framework used. The report goes to the shareholders and is relied on by regulators, banks and the tax authority.
Side by side
| Feature | Internal audit | External audit |
|---|---|---|
| Commissioned by | Management or the board | Shareholders; in a regulated setting, the law or licence |
| Performed by | Employees or an outsourced provider | An independent licensed audit firm |
| Scope | Risks, controls and processes you choose | Financial statements and the evidence behind them |
| Timing | Throughout the year | After the year end, usually annually |
| Output | Findings and recommendations | Audit opinion |
| Required by law | Only for some regulated entities | For many entities, subject to their rules |
Independence
An external auditor must be independent of the client. In the UAE, auditors are licensed by the Ministry of Economy and, for zones, may need approval from the zone authority. An internal auditor works within the organisation or on an outsourced contract and reports to the board or audit committee, not to the people being reviewed. An outsourced internal audit provider can usually not also be the external auditor for the same client, because of independence rules. Confirm the rules that apply to your sector.
When you need each
- External audit: where your licence, free zone rules, a regulator, a contract, a lender or tax law requires audited statements. See is audit mandatory in the UAE and free zone audit requirements.
- Internal audit: where risk is high, the business is complex or growing, or an investor or regulator expects it. It is also useful for a business that has had control failures.
How they work together
A good internal audit function shortens the external audit. External auditors may use internal audit work when it is reliable, subject to their own judgement. They also report control weaknesses they find to management. Share the internal audit plan and reports with the external auditor, and the external auditor's management letter with the internal audit team.
Neither is a tax audit
Both differ from an FTA tax audit, which is an inspection by the authority of your tax returns and records. Strong internal controls make that inspection easier. See how to prepare for an FTA tax audit and the audit services we provide.
Choosing a provider
For external audit, check the firm's licence, the zone's approved-auditor list where it applies, its sector experience and its timetable. For outsourced internal audit, check independence, scope and reporting lines. See how to choose an audit firm.
Examples
A retailer has a bank overdraft, a store loyalty system and a stock-control team. The owner commissions an internal audit of stock handling after discovering recurring differences. The internal auditor tests receiving, storage and write-offs, identifies weak controls and proposes changes. Separately, the retailer's lender requires audited statements. The external auditor tests the stock figure at year end, using the internal audit report to understand the controls. Each audit answers a different question, but the second is easier because the first was done.
Building an internal audit plan
- List the main risks: cash, procurement, payroll, stock, IT access, compliance.
- Rank them by likelihood and impact.
- Pick the highest-risk areas for the year and schedule reviews.
- Agree the reporting line, usually to the board or owner.
- Track the actions agreed from each report.
In-house or outsourced
A small business seldom needs a full-time internal auditor. An outsourced provider can run a few reviews a year at a fixed scope. Check that the provider is independent from the external auditor and from the people reviewed. Keep the scope focused, since an open-ended scope drifts and costs more.
Regulated sectors
Banks, insurers, listed companies and some other regulated entities are required by their regulators to maintain an internal audit function. If you operate in such a sector, read your regulator's rules and keep the function independent and documented. This guide covers the general position, and specific rules should be checked with the regulator.
Where the value comes from
The test of an internal audit is whether management acts on it. Reports that sit in a drawer add cost without benefit. Assign each finding an owner and a date, and follow up. External auditors will read your actions when they assess control risk.
Audit committees and the board
In larger companies, the board or an audit committee oversees both audits. It approves the internal audit plan, receives its reports, recommends the external auditor and reviews the audited statements. In a small owner-managed company the owner plays this role. Even there, it helps to set aside time each year to review the audit findings and agree actions in writing.
Cost and effort
External audit fees are driven by size, complexity and record quality. Internal audit cost depends on the scope and frequency. A sensible approach for a mid-sized company is a modest external audit every year and a small number of targeted internal reviews, directed at the areas that worry the owners most. See audit cost in Dubai.
Free zone and licence-driven audits
Many free zones require an annual audited set from an approved auditor. The audit is an external audit in the sense used here. Internal audit is not a substitute. Check the zone's approved auditor list before you appoint, and note filing deadlines. See DIFC approved auditors and DMCC approved auditors.
Frequently asked questions
Internal audit reviews risks and controls for management. External audit gives an independent opinion on the financial statements.
Only for certain regulated entities. For most private companies it is a management choice.
For many entities, depending on licence, free zone rules, regulator or contract. Check the rule for your case.
Usually not, because of independence rules. Confirm with the rules that apply to your sector.
Internal audit reports go to management and the board. The external audit report goes to the shareholders and is used by lenders and authorities.
No. A tax audit is an FTA inspection of tax returns and records, not an opinion on the financial statements.