Compliance Audit

There is no single federal law mandating a standalone 'compliance audit' for every UAE company. What is mandatory are the underlying obligations a compliance audit tests — VAT and Corporate Tax filing where registered, WPS payroll compliance, and AML/CFT programme requirements for Designated Non-Financial Businesses and Professions. DIFC and ADGM regulated entities may face additional DFSA or FSRA reporting expectations. The compliance audit itself is typically a voluntary, proactive exercise commissioned by the board or driven by a lender, investor, or licence-renewal requirement.

Statutory audit expresses an opinion on whether the financial statements present a true and fair view, for shareholders and the licensing authority. A compliance audit is narrower and obligation-specific — it tests whether named regulatory requirements (VAT accuracy, WPS timeliness, AML/CFT programme adequacy) are being met in practice, independent of whether the financial statements as a whole are fairly presented. A company can pass its statutory audit and still have live compliance gaps a compliance audit would surface.

Internal audit is broader — it covers financial, operational, IT, and compliance risk across a risk-ranked universe of processes, reporting to the audit committee or board on the overall control environment. A compliance audit is anchored specifically to named legal, regulatory, or contractual obligations and tests whether each is being met, obligation by obligation. In practice the two often overlap, and many PNPC engagements combine elements of both depending on what the client actually needs.

A VAT compliance audit reconciles filed EmaraTax VAT returns against the general ledger, tests a sample of input VAT recovery decisions for correct classification, checks that output VAT has been correctly charged and reported on relevant supplies, and reviews the documentation supporting any zero-rated, exempt, or reverse-charge positions taken. It is testing under Federal Decree-Law No. 8 of 2017 and current FTA guidance, applied to the entity's actual transaction records rather than a general commentary on VAT awareness.

Yes, where the entity is registered for Corporate Tax. We test whether the Tax Registration Number is current, whether related-party transactions are properly documented and priced on an arm's-length basis where the related-party rules apply, and — for free zone entities claiming the 0% rate on qualifying income — whether the conditions for Qualifying Free Zone Person status are being tracked and evidenced on an ongoing basis rather than assumed. Corporate Tax applies at 0% on taxable income up to AED 375,000 and 9% above that threshold for standard taxpayers, effective for financial years starting on or after 1 June 2023.

The Wage Protection System (WPS) is the electronic salary transfer system mandated by the Ministry of Human Resources and Emiratisation (MOHRE) to track timely, accurate payment of wages through registered UAE banks or exchange houses. A compliance audit reconciles the payroll register against actual WPS submission records and salary transfer timing, since non-compliance can trigger MOHRE penalties and, in serious or repeated cases, restrictions on a company's ability to process new work permits.

Certain UAE businesses — including real estate brokers and agents, dealers in precious metals and stones, and independent legal or accounting professionals providing specified services, among others — fall within the DNFBP category under Cabinet Decision No. 10 of 2019 and must maintain AML/CFT policies, perform customer due diligence, and register on the goAML platform maintained by the UAE Financial Intelligence Unit. A compliance audit tests whether these controls are genuinely operating — sampling actual customer files for evidenced due diligence, not just confirming the policy document exists.

Yes. Lenders increasingly build compliance representations into facility agreements, and free zone authorities require current licence and filing status for renewal. A compliance audit run ahead of the renewal date identifies and helps remediate gaps — a lapsed filing, an outdated registration detail, an unresolved MOHRE query — before the renewal process itself surfaces them and creates delay or additional scrutiny.

Yes, for entities regulated by the DFSA (DIFC) or FSRA (ADGM), a compliance audit can be scoped to test the specific rulebook provisions applicable to that firm's licence category — prudential reporting, conduct requirements, and any client-money or capital-adequacy conditions relevant to the category held. This is scoped in close coordination with the client's existing regulatory advisor where one exists, to avoid duplicating specialist regulatory compliance work already underway.

We flag this immediately rather than waiting for the final report, and recommend the client's tax advisor assess whether a voluntary disclosure via the EmaraTax portal is the appropriate corrective step, given that timely voluntary disclosure is generally treated more favourably than an error later identified through an FTA audit or enforcement action.

A focused single-obligation review — for example, WPS compliance alone, or a VAT filing accuracy review — can often be completed within a few weeks once records are made available. A multi-obligation review spanning tax, payroll, and AML/CFT for a DNFBP, or a review across several legal entities in a group, takes longer given the volume of filings and customer files that need to be sampled. PNPC confirms a specific timeline in the engagement letter once scope is agreed rather than quoting a generic figure.

PNPC agrees a fixed fee for each defined compliance audit engagement, confirmed in writing before fieldwork begins. Fee depends on the number of obligations in scope, the number of legal entities under review, and the volume of records and customer files that need to be sampled — a single-obligation review costs meaningfully less than a multi-obligation review across a group structure.

Yes. A compliance audit occasionally surfaces a finding that points to a broader control weakness beyond the specific obligation tested — for example, a pattern of vendor master changes surfacing during a VAT input-recovery sample that suggests a wider procurement control gap, or a customer due diligence gap that raises a fraud-risk concern. Where that happens, we recommend escalating to a broader internal audit or, where a specific irregularity is suspected, a dedicated forensic investigation with a different evidentiary standard.

Yes, with management's consent. Where a client already has a tax advisor handling VAT and Corporate Tax filings, or an external statutory auditor, we coordinate to avoid duplicated testing and to make sure any compliance audit finding relevant to an upcoming filing or audit is flagged to the right advisor promptly.

Yes. PNPC operates from offices in the UAE (Dubai) and India (Chennai, Bangalore, Hyderabad), and for groups with cross-border structures we run compliance audits that specifically test related-party transaction documentation and transfer pricing consistency across both jurisdictions under one coordinated engagement, rather than splitting the review between two disconnected advisors.

PNPC scopes every compliance audit from an obligation map specific to the entity's actual licence type, registrations, and sector — not a templated checklist applied regardless of what genuinely applies. Our findings are backed by sample testing against actual filings, payroll records, and customer files, not assertions that a policy exists. We escalate serious gaps immediately rather than holding them for a final report, and we track remediation to completion rather than treating the report as the end of the engagement.

Yes. A compliance audit does not have to cover every obligation category at once — a single-obligation review focused only on WPS payroll compliance, or only on VAT filing accuracy, is a common and proportionate scope where management has a specific concern rather than a full-spectrum review need. The obligation-mapping step at the start of any engagement is what determines whether a narrow or broad scope is the right fit.

Where a free zone entity claims the 0% Corporate Tax rate on qualifying income as a Qualifying Free Zone Person under Federal Decree-Law No. 47 of 2022, a compliance audit tests whether qualifying activities and any applicable de minimis thresholds are being tracked on an ongoing transactional basis and evidenced, rather than assumed to hold simply because the entity's original free zone licence category once qualified.

The obligations tested differ in emphasis, not just detail. A mainland business trading directly with UAE-based customers or importing goods carries VAT and customs-linked reporting nuances a free zone entity dealing only with parties outside the UAE may not carry in the same way, while a free zone entity claiming Qualifying Free Zone Person status carries an ongoing qualifying-income tracking obligation a mainland company does not have. A compliance audit scoped for a mainland-plus-free-zone group tests both profiles separately rather than applying one generic obligation set across every entity.

ESR notification and report filing obligations were discontinued for financial years starting on or after 1 January 2023, under Cabinet Decision No. 98 of 2024. For current and future financial years, ESR is not a live, ongoing obligation for a compliance audit to test. Where an engagement covers a historical period before that date, ESR compliance for those earlier financial years — including any outstanding notices or penalties — may still be relevant and is scoped in explicitly where that history matters.

Where scoped to include workforce compliance beyond WPS payroll timing, yes — a compliance audit can test whether employee visa status and quota utilisation are being tracked and evidenced against GDRFA and ICP requirements, and whether renewals and cancellations are processed on schedule rather than left to lapse.

Where relevant to the entity's size and sector, a compliance audit can test whether Emiratisation quota tracking and reporting through MOHRE's Nafis programme is being monitored and evidenced on schedule, in the same way WPS payroll timing is tested, rather than assuming compliance because a notification was filed once.

For entities regulated by the UAE Central Bank — exchange houses, finance companies, payment service providers — a compliance audit is scoped to test the Central Bank's own prudential and conduct rulebook obligations alongside the standard FTA, MOHRE, and AML/CFT obligations most UAE businesses carry. This is coordinated closely with the client's existing regulatory or compliance function to avoid duplicating specialist supervisory work already underway.

Yes, where the entity is registered for Corporate Tax. We test whether related-party transactions are properly documented and priced on an arm's-length basis where the related-party rules under Federal Decree-Law No. 47 of 2022 apply, since inadequate related-party documentation is one of the more common gaps a Corporate Tax compliance audit line uncovers.

We escalate this to management immediately rather than waiting for the final report, and recommend the client's designated Money Laundering Reporting Officer or AML/CFT advisor assess whether a suspicious transaction report through the goAML platform is required, given the reporting obligations DNFBPs carry under Cabinet Decision No. 10 of 2019.

A due diligence audit is transaction-specific — commissioned by a buyer, investor, or lender to assess a target company's financial, tax, and compliance position ahead of a specific deal, typically with a compressed timeline tied to the transaction schedule. A compliance audit is not transaction-driven; it is an independent, standing check of whether an entity's ongoing regulatory obligations are being met, whether or not a deal is in progress. In practice, compliance audit findings often feed directly into a due diligence exercise when a transaction does arise.

For mainland and free zone entities that import goods, a compliance audit can test whether import VAT positions, customs declarations, and any related reverse-charge treatment are being correctly applied and reconciled against the general ledger, since these are common areas where the documentation supporting a VAT position is weaker than the return itself suggests.

There is no fixed statutory frequency. PNPC generally recommends a periodic cycle proportionate to the entity's risk profile — more frequent for DNFBPs and DIFC/ADGM regulated entities carrying ongoing AML/CFT or rulebook obligations, and less frequent for lower-risk mainland or free zone entities without a specific trigger. Many clients align the cycle with a licence renewal date or an annual governance calendar rather than running it purely reactively.

We need read access to a sample of actual customer onboarding files — identification and verification records, risk rating documentation, and any periodic review evidence — rather than just the policy document describing what onboarding should involve. Without access to the underlying files, an AML/CFT compliance audit line becomes an unsupported opinion rather than tested assurance.

Much of a compliance audit — document and filing review, sample testing against records, and draft findings discussion — can be conducted remotely where the client can provide read-only system access or clean record extracts. Certain elements, such as observing physical document custody or the final report presentation to the board, are often more effective delivered in person, and the split is agreed explicitly at scoping stage.

PNPC issues a findings report — an obligation-by-obligation assessment with evidence summary, risk ratings, and remediation recommendations — rather than a standalone compliance certificate. We will not issue a certificate of compliance that is not backed by the underlying evidence testing the findings report documents, since a certificate without testing would not represent genuine assurance.

We flag this as an urgent finding, since an expired or non-compliant licence condition can carry immediate operational consequences — restrictions on visa processing, banking relationships, or contract eligibility — beyond the financial exposure a tax or payroll gap typically carries. This is escalated to management the moment it is identified, not held for the final report.

We map obligations entity-by-entity across the group rather than applying a single obligation set uniformly, since each licensed entity's Corporate Tax treatment, VAT position, and licence-specific conditions can differ even within the same group. Intercompany transactions and related-party documentation consistency across the entities are tested as a distinct line item given their direct relevance to each entity's Corporate Tax position.

Yes — arguably more useful early than after several filing cycles have already embedded a wrong approach. A compliance audit run after the first one or two filing cycles confirms the new registration's obligations are being correctly discharged from the outset, rather than only discovering an error once it has been repeated across several returns.

Where a bank facility includes compliance representations or covenant conditions, PNPC can scope a compliance audit specifically to test those named conditions, and — with management's consent — share relevant findings with the client's relationship bank ahead of a facility review or renewal, reducing the risk of a covenant breach surfacing unexpectedly.

Yes, where useful. A compliance audit's obligation testing and an ICFR review's control-design and operating-effectiveness testing are complementary — many PNPC engagements scope both together for a client preparing for a listing, a significant financing round, or a first-time consolidated audit, since the underlying evidence (filed returns, reconciliations, approval records) overlaps substantially.

We discuss draft findings with process owners before finalising the report, specifically to correct any factual errors and to reach an agreed, realistic remediation timeline. Where a genuine disagreement over the risk rating or interpretation remains, it is documented transparently in the final report rather than quietly softened or removed.

Yes, where the entity has franchise, agency, distribution, or facility agreements containing specific compliance reporting duties to a principal, licensor, or lender, a compliance audit can test whether those contractual obligations are being met and evidenced, in addition to the statutory and regulatory obligations that form the core of most engagements.

Headcount and legal-entity count generally matter more than obligation count alone. A single entity with a small headcount and one or two obligation categories is a comparatively contained review; a multi-entity group with a larger workforce requires proportionally more payroll, visa, and — where DNFBP-relevant — customer due diligence files to be sampled, which drives fieldwork hours regardless of how many obligation categories are formally in scope.

A single free zone entity with organised records and one or two obligation categories can often be reviewed within a few weeks. A mainland-plus-multiple-free-zone group requires a separate obligation map for each licensed entity, cross-entity related-party testing, and typically a larger volume of filings and customer files, which extends the timeline materially — the exact figure is confirmed once the entity count and obligation categories are agreed at scoping.

An offshore company that holds no trading licence and does not conduct business inside the UAE typically carries a much narrower obligation set than a mainland or free zone trading entity — generally centred on registered agent, beneficial ownership, and annual return conditions rather than VAT, WPS, or a trading Corporate Tax profile. Where a compliance audit is commissioned for such a vehicle, PNPC scopes it to the obligations that genuinely attach to an offshore structure rather than padding it with obligations that do not apply.

Beyond the payroll register itself, a compliance audit looks for the Salary Information File (SIF) confirmation from the paying bank or exchange house evidencing that the submitted file was actually accepted and processed, not merely generated internally, alongside the underlying salary transfer timing records. A payroll register alone does not prove WPS compliance — the bank-side confirmation is what closes the evidentiary loop.

We update the obligation map to reflect the change and re-scope the affected testing lines accordingly, since a Corporate Tax registration change mid-review can affect which filing obligations, related-party rules, or Qualifying Free Zone Person conditions are actually in scope for the review period. This is communicated to management as a scope adjustment rather than silently absorbed into the original plan.

Yes. A short, focused follow-up review after a licence renewal — confirming the renewed licence conditions, any updated activity codes, and continued VAT, Corporate Tax, and WPS compliance — is a common and proportionate use of a compliance audit, particularly where the renewal process itself introduced new conditions or activity restrictions.

Yes, where an entity has amended its licensed activity codes, a compliance audit checks that the entity's actual operations remain within the amended scope and that any conditions attached to the new activity — additional approvals, sector-specific licences, or regulator notifications — have been correctly obtained and evidenced.

Where a wind-down or exit is planned, a final-cycle compliance audit run ahead of licence cancellation or a sale helps confirm all obligations are current so closure, deregistration, or completion is not delayed by an unresolved compliance gap. Findings from an earlier compliance audit cycle also inform what needs to be resolved before a clean exit can proceed.

For a very young entity, the obligation universe is often narrower simply because fewer filing cycles have occurred, but the review still tests whether the obligations that do apply — initial VAT or Corporate Tax registration timing, first WPS submissions, and initial licence conditions — were correctly discharged from day one, since early-stage errors are cheaper to correct before they compound across multiple filing cycles.

Where relevant to the entity's activity, a compliance audit can review whether foreign-currency-denominated contracts are being accounted for and reported consistently, and whether any related VAT or Corporate Tax positions arising from foreign-currency transactions are correctly translated and documented — though FX risk management itself is a treasury advisory matter distinct from the compliance testing a compliance audit performs.

Yes — a pure holding company with no direct trading activity typically has a narrower obligation set (corporate and shareholding records, intercompany agreements, and any Corporate Tax related-party position on dividends or intercompany charges) than an operating trading entity, and a compliance audit for a holding company is scoped accordingly rather than testing VAT or WPS obligations that simply do not arise from its activity.

We scope the review around the filing cycle's status — testing the completed portion of the cycle against the evidence available, and flagging any preparation gaps for the remaining filing period before the deadline arrives, rather than waiting until the cycle closes to identify an issue that could still be corrected in time.

We test the specific timing gap, not just whether a transfer eventually happened — MOHRE's WPS framework is concerned with wages being paid in the amount and at the time agreed in the employment contract, so a compliance audit reconciles the contractual due date against the actual WPS transfer date for a sample of pay periods, not merely whether a salary transfer record exists somewhere in the system.

Where an entity has moved its licence from one free zone authority to another, a compliance audit tests whether the new authority's specific licence conditions, Qualifying Free Zone Person analysis (if relevant), and any registration continuity requirements have been correctly re-established under the new authority, rather than assuming the obligations carried over unchanged from the prior free zone.

Yes, where a franchise or licensing agreement requires the UAE licensee to periodically demonstrate compliance with named conditions to the franchisor or licensor, a compliance audit can be scoped specifically around those contractual reporting terms, in addition to or alongside the statutory and regulatory obligations most engagements cover.

PNPC issues a written, obligation-by-obligation findings report as the primary deliverable, and — particularly where the engagement was commissioned by a board or audit committee — this is typically accompanied by a partner-led presentation summarising key findings, risk ratings, and the recommended management action plan.

A compliance audit is scoped to test whether the entity itself is meeting its own named obligations with evidence, rather than to benchmark its findings against peer companies — peer benchmarking is a different, comparative exercise that would require access to other companies' compliance data that is not available or appropriate to include in an individual client's engagement.

Where one legal entity holds multiple trade licences across different emirates or free zones, a compliance audit maps the licence-specific conditions for each licence separately, since renewal dates, activity scope, and any local approvals can differ by emirate even though the underlying legal entity and its tax registrations remain the same.

Where relevant, a compliance audit can review whether dividend or profit distributions to overseas shareholders are documented consistently with the entity's corporate records and Corporate Tax position, though the shareholder's home-country tax treatment of the remittance itself — such as Indian withholding or reporting requirements on the recipient side — falls outside the UAE entity's compliance audit and is addressed separately with the relevant home-country advisor.

PNPC issues compliance audit reports in English as standard, and can arrange an Arabic translation of the final report or specific sections where the client needs it for a regulator, board member, or third-party recipient who requires Arabic-language documentation — this is agreed at scoping stage rather than assumed by default.

Where scoped to include it, a compliance audit for a DIFC-registered entity can test whether the entity's data-handling practices are consistent with its own documented data protection policies and any applicable DIFC data protection framework obligations relevant to its licence category — this is typically coordinated with the client's data protection or legal advisor given the specialist nature of data protection compliance.

This is treated as an urgent finding rather than a routine one, since operating past the mandatory VAT registration threshold under Federal Decree-Law No. 8 of 2017 without registering carries direct exposure once identified. We escalate this to management and the client's tax advisor immediately so a corrective registration and any related voluntary disclosure can be actioned without delay, rather than surfacing it only in the final report.

Yes. A prospective JV partner's due diligence questions on tax, payroll, and AML/CFT compliance are frequently very similar to what a compliance audit already tests, and PNPC can scope a compliance audit specifically to produce a report suitable for sharing with a JV counterparty, subject to the client's own confidentiality terms and the counterparty's agreed reliance scope.

An already-assessed penalty is documented as a known item with its payment or dispute status confirmed, and the review then tests whether the underlying process that caused the penalty has actually been corrected, since a paid penalty with no process fix in place typically means the same gap will recur in the next filing cycle.

India's Companies Act generally mandates a statutory audit for companies regardless of size, whereas the UAE ties the external audit requirement to licence conditions imposed by the DED or the relevant free zone authority rather than a universal company-law mandate applying to every entity type. For a cross-border group, this means the Indian entity's statutory audit obligation is essentially automatic, while the UAE entity's audit and broader compliance obligations depend on its specific licence type and registrations — a distinction a compliance audit scoped across both jurisdictions accounts for explicitly rather than assuming parity.