Compliance Audit

There is no single federal law mandating a standalone 'compliance audit' for every UAE company. What is mandatory are the underlying obligations a compliance audit tests — VAT and Corporate Tax filing where registered, WPS payroll compliance, and AML/CFT programme requirements for Designated Non-Financial Businesses and Professions. DIFC and ADGM regulated entities may face additional DFSA or FSRA reporting expectations. The compliance audit itself is typically a voluntary, proactive exercise commissioned by the board or driven by a lender, investor, or licence-renewal requirement.

Statutory audit expresses an opinion on whether the financial statements present a true and fair view, for shareholders and the licensing authority. A compliance audit is narrower and obligation-specific — it tests whether named regulatory requirements (VAT accuracy, WPS timeliness, AML/CFT programme adequacy) are being met in practice, independent of whether the financial statements as a whole are fairly presented. A company can pass its statutory audit and still have live compliance gaps a compliance audit would surface.

Internal audit is broader — it covers financial, operational, IT, and compliance risk across a risk-ranked universe of processes, reporting to the audit committee or board on the overall control environment. A compliance audit is anchored specifically to named legal, regulatory, or contractual obligations and tests whether each is being met, obligation by obligation. In practice the two often overlap, and many PNPC engagements combine elements of both depending on what the client actually needs.

A VAT compliance audit reconciles filed EmaraTax VAT returns against the general ledger, tests a sample of input VAT recovery decisions for correct classification, checks that output VAT has been correctly charged and reported on relevant supplies, and reviews the documentation supporting any zero-rated, exempt, or reverse-charge positions taken. It is testing under Federal Decree-Law No. 8 of 2017 and current FTA guidance, applied to the entity's actual transaction records rather than a general commentary on VAT awareness.

Yes, where the entity is registered for Corporate Tax. We test whether the Tax Registration Number is current, whether related-party transactions are properly documented and priced on an arm's-length basis where the related-party rules apply, and — for free zone entities claiming the 0% rate on qualifying income — whether the conditions for Qualifying Free Zone Person status are being tracked and evidenced on an ongoing basis rather than assumed. Corporate Tax applies at 0% on taxable income up to AED 375,000 and 9% above that threshold for standard taxpayers, effective for financial years starting on or after 1 June 2023.

The Wage Protection System (WPS) is the electronic salary transfer system mandated by the Ministry of Human Resources and Emiratisation (MOHRE) to track timely, accurate payment of wages through registered UAE banks or exchange houses. A compliance audit reconciles the payroll register against actual WPS submission records and salary transfer timing, since non-compliance can trigger MOHRE penalties and, in serious or repeated cases, restrictions on a company's ability to process new work permits.

Certain UAE businesses — including real estate brokers and agents, dealers in precious metals and stones, and independent legal or accounting professionals providing specified services, among others — fall within the DNFBP category under Cabinet Decision No. 10 of 2019 and must maintain AML/CFT policies, perform customer due diligence, and register on the goAML platform maintained by the UAE Financial Intelligence Unit. A compliance audit tests whether these controls are genuinely operating — sampling actual customer files for evidenced due diligence, not just confirming the policy document exists.

Yes. Lenders increasingly build compliance representations into facility agreements, and free zone authorities require current licence and filing status for renewal. A compliance audit run ahead of the renewal date identifies and helps remediate gaps — a lapsed filing, an outdated registration detail, an unresolved MOHRE query — before the renewal process itself surfaces them and creates delay or additional scrutiny.

Yes, for entities regulated by the DFSA (DIFC) or FSRA (ADGM), a compliance audit can be scoped to test the specific rulebook provisions applicable to that firm's licence category — prudential reporting, conduct requirements, and any client-money or capital-adequacy conditions relevant to the category held. This is scoped in close coordination with the client's existing regulatory advisor where one exists, to avoid duplicating specialist regulatory compliance work already underway.

We flag this immediately rather than waiting for the final report, and recommend the client's tax advisor assess whether a voluntary disclosure via the EmaraTax portal is the appropriate corrective step, given that timely voluntary disclosure is generally treated more favourably than an error later identified through an FTA audit or enforcement action.

A focused single-obligation review — for example, WPS compliance alone, or a VAT filing accuracy review — can often be completed within a few weeks once records are made available. A multi-obligation review spanning tax, payroll, and AML/CFT for a DNFBP, or a review across several legal entities in a group, takes longer given the volume of filings and customer files that need to be sampled. PNPC confirms a specific timeline in the engagement letter once scope is agreed rather than quoting a generic figure.

PNPC agrees a fixed fee for each defined compliance audit engagement, confirmed in writing before fieldwork begins. Fee depends on the number of obligations in scope, the number of legal entities under review, and the volume of records and customer files that need to be sampled — a single-obligation review costs meaningfully less than a multi-obligation review across a group structure.

Yes. A compliance audit occasionally surfaces a finding that points to a broader control weakness beyond the specific obligation tested — for example, a pattern of vendor master changes surfacing during a VAT input-recovery sample that suggests a wider procurement control gap, or a customer due diligence gap that raises a fraud-risk concern. Where that happens, we recommend escalating to a broader internal audit or, where a specific irregularity is suspected, a dedicated forensic investigation with a different evidentiary standard.

Yes, with management's consent. Where a client already has a tax advisor handling VAT and Corporate Tax filings, or an external statutory auditor, we coordinate to avoid duplicated testing and to make sure any compliance audit finding relevant to an upcoming filing or audit is flagged to the right advisor promptly.

Yes. PNPC operates from offices in the UAE (Dubai) and India (Chennai, Bangalore, Hyderabad), and for groups with cross-border structures we run compliance audits that specifically test related-party transaction documentation and transfer pricing consistency across both jurisdictions under one coordinated engagement, rather than splitting the review between two disconnected advisors.

PNPC scopes every compliance audit from an obligation map specific to the entity's actual licence type, registrations, and sector — not a templated checklist applied regardless of what genuinely applies. Our findings are backed by sample testing against actual filings, payroll records, and customer files, not assertions that a policy exists. We escalate serious gaps immediately rather than holding them for a final report, and we track remediation to completion rather than treating the report as the end of the engagement.

Yes. A compliance audit does not have to cover every obligation category at once — a single-obligation review focused only on WPS payroll compliance, or only on VAT filing accuracy, is a common and proportionate scope where management has a specific concern rather than a full-spectrum review need. The obligation-mapping step at the start of any engagement is what determines whether a narrow or broad scope is the right fit.

Where a free zone entity claims the 0% Corporate Tax rate on qualifying income as a Qualifying Free Zone Person under Federal Decree-Law No. 47 of 2022, a compliance audit tests whether qualifying activities and any applicable de minimis thresholds are being tracked on an ongoing transactional basis and evidenced, rather than assumed to hold simply because the entity's original free zone licence category once qualified.

The obligations tested differ in emphasis, not just detail. A mainland business trading directly with UAE-based customers or importing goods carries VAT and customs-linked reporting nuances a free zone entity dealing only with parties outside the UAE may not carry in the same way, while a free zone entity claiming Qualifying Free Zone Person status carries an ongoing qualifying-income tracking obligation a mainland company does not have. A compliance audit scoped for a mainland-plus-free-zone group tests both profiles separately rather than applying one generic obligation set across every entity.

ESR notification and report filing obligations were discontinued for financial years starting on or after 1 January 2023, under Cabinet Decision No. 98 of 2024. For current and future financial years, ESR is not a live, ongoing obligation for a compliance audit to test. Where an engagement covers a historical period before that date, ESR compliance for those earlier financial years — including any outstanding notices or penalties — may still be relevant and is scoped in explicitly where that history matters.

Where scoped to include workforce compliance beyond WPS payroll timing, yes — a compliance audit can test whether employee visa status and quota utilisation are being tracked and evidenced against GDRFA and ICP requirements, and whether renewals and cancellations are processed on schedule rather than left to lapse.

Where relevant to the entity's size and sector, a compliance audit can test whether Emiratisation quota tracking and reporting through MOHRE's Nafis programme is being monitored and evidenced on schedule, in the same way WPS payroll timing is tested, rather than assuming compliance because a notification was filed once.

For entities regulated by the UAE Central Bank — exchange houses, finance companies, payment service providers — a compliance audit is scoped to test the Central Bank's own prudential and conduct rulebook obligations alongside the standard FTA, MOHRE, and AML/CFT obligations most UAE businesses carry. This is coordinated closely with the client's existing regulatory or compliance function to avoid duplicating specialist supervisory work already underway.

Yes, where the entity is registered for Corporate Tax. We test whether related-party transactions are properly documented and priced on an arm's-length basis where the related-party rules under Federal Decree-Law No. 47 of 2022 apply, since inadequate related-party documentation is one of the more common gaps a Corporate Tax compliance audit line uncovers.

We escalate this to management immediately rather than waiting for the final report, and recommend the client's designated Money Laundering Reporting Officer or AML/CFT advisor assess whether a suspicious transaction report through the goAML platform is required, given the reporting obligations DNFBPs carry under Cabinet Decision No. 10 of 2019.

A due diligence audit is transaction-specific — commissioned by a buyer, investor, or lender to assess a target company's financial, tax, and compliance position ahead of a specific deal, typically with a compressed timeline tied to the transaction schedule. A compliance audit is not transaction-driven; it is an independent, standing check of whether an entity's ongoing regulatory obligations are being met, whether or not a deal is in progress. In practice, compliance audit findings often feed directly into a due diligence exercise when a transaction does arise.

For mainland and free zone entities that import goods, a compliance audit can test whether import VAT positions, customs declarations, and any related reverse-charge treatment are being correctly applied and reconciled against the general ledger, since these are common areas where the documentation supporting a VAT position is weaker than the return itself suggests.

There is no fixed statutory frequency. PNPC generally recommends a periodic cycle proportionate to the entity's risk profile — more frequent for DNFBPs and DIFC/ADGM regulated entities carrying ongoing AML/CFT or rulebook obligations, and less frequent for lower-risk mainland or free zone entities without a specific trigger. Many clients align the cycle with a licence renewal date or an annual governance calendar rather than running it purely reactively.

We need read access to a sample of actual customer onboarding files — identification and verification records, risk rating documentation, and any periodic review evidence — rather than just the policy document describing what onboarding should involve. Without access to the underlying files, an AML/CFT compliance audit line becomes an unsupported opinion rather than tested assurance.

Much of a compliance audit — document and filing review, sample testing against records, and draft findings discussion — can be conducted remotely where the client can provide read-only system access or clean record extracts. Certain elements, such as observing physical document custody or the final report presentation to the board, are often more effective delivered in person, and the split is agreed explicitly at scoping stage.

PNPC issues a findings report — an obligation-by-obligation assessment with evidence summary, risk ratings, and remediation recommendations — rather than a standalone compliance certificate. We will not issue a certificate of compliance that is not backed by the underlying evidence testing the findings report documents, since a certificate without testing would not represent genuine assurance.

We flag this as an urgent finding, since an expired or non-compliant licence condition can carry immediate operational consequences — restrictions on visa processing, banking relationships, or contract eligibility — beyond the financial exposure a tax or payroll gap typically carries. This is escalated to management the moment it is identified, not held for the final report.

We map obligations entity-by-entity across the group rather than applying a single obligation set uniformly, since each licensed entity's Corporate Tax treatment, VAT position, and licence-specific conditions can differ even within the same group. Intercompany transactions and related-party documentation consistency across the entities are tested as a distinct line item given their direct relevance to each entity's Corporate Tax position.

Yes — arguably more useful early than after several filing cycles have already embedded a wrong approach. A compliance audit run after the first one or two filing cycles confirms the new registration's obligations are being correctly discharged from the outset, rather than only discovering an error once it has been repeated across several returns.

Where a bank facility includes compliance representations or covenant conditions, PNPC can scope a compliance audit specifically to test those named conditions, and — with management's consent — share relevant findings with the client's relationship bank ahead of a facility review or renewal, reducing the risk of a covenant breach surfacing unexpectedly.

Yes, where useful. A compliance audit's obligation testing and an ICFR review's control-design and operating-effectiveness testing are complementary — many PNPC engagements scope both together for a client preparing for a listing, a significant financing round, or a first-time consolidated audit, since the underlying evidence (filed returns, reconciliations, approval records) overlaps substantially.

We discuss draft findings with process owners before finalising the report, specifically to correct any factual errors and to reach an agreed, realistic remediation timeline. Where a genuine disagreement over the risk rating or interpretation remains, it is documented transparently in the final report rather than quietly softened or removed.

Yes, where the entity has franchise, agency, distribution, or facility agreements containing specific compliance reporting duties to a principal, licensor, or lender, a compliance audit can test whether those contractual obligations are being met and evidenced, in addition to the statutory and regulatory obligations that form the core of most engagements.