Internal Control Over Financial Reporting (ICFR) Review

It is an independent assessment of the controls a business relies on to produce accurate, complete financial statements — examining both whether each control is properly designed to address a specific risk and whether it actually operated as designed over the review period. It is commonly commissioned by boards, group finance functions, or ahead of a listing, investment, or major banking facility.

No single UAE statute mandates a stand-alone ICFR review for mainland or free zone companies. It becomes necessary contractually or operationally — most commonly because a parent group's consolidation framework requires it, a board or audit committee wants pre-listing assurance, or a bank or investor specifically asks for evidence of control maturity.

The statutory audit gives an opinion on the financial statements as a whole, and evaluates internal control only to the extent needed to plan and perform that audit efficiently under ISA 315 and ISA 330. An ICFR review is a dedicated, deeper examination of the control environment itself — walkthroughs, risk and control matrices, design assessment, and operating effectiveness testing across each significant financial reporting process.

Most commonly the COSO Internal Control – Integrated Framework (control environment, risk assessment, control activities, information and communication, and monitoring activities), which is the internationally recognised reference point most auditors and audit committees use. Where a parent group has its own control framework, or a bank has specific expectations, we benchmark against that instead, agreed explicitly at scoping.

Design effectiveness asks whether a control, as designed, would actually prevent or detect the risk it is meant to address if it operated as intended. Operating effectiveness asks whether the control actually did operate that way, consistently, over the period under review — tested through a sample of transactions or instances, not just a single walkthrough observation.

An RCM maps each significant financial reporting risk in a process (for example, revenue being recorded in the wrong period) to the specific control that mitigates it, who performs the control, how often, and what evidence demonstrates it happened. It is the structural backbone of the entire review — every finding traces back to a specific cell in the RCM.

For a single-entity, moderate-complexity business covering the core financial statement cycles, a typical engagement runs four to six weeks from scoping to final report. Multi-entity group reviews, or reviews requiring a full financial year of operating effectiveness testing rather than a point-in-time design assessment, take longer.

SOX Section 404 is a US securities law requirement applying to the listed parent, not a UAE obligation in its own right. Where the UAE entity is material to the group's consolidated financial statements, its ICFR fieldwork typically forms a local building block feeding the group's overall SOX attestation, but the UAE-scoped review itself remains a standard ICFR engagement rather than a SOX filing.

A control deficiency is a gap in design or operation that could allow a misstatement, however small the likely impact. A significant deficiency is a deficiency (or combination) important enough to merit attention from those charged with governance. A material weakness is a deficiency (or combination) creating a reasonable possibility that a material misstatement of the financial statements would not be prevented or detected in a timely manner. Findings are classified using this hierarchy so the board understands relative severity.

To the extent financially relevant — access management, change management, and backup/recovery for systems that feed the financial statements are reviewed as IT general controls (ITGC) within the overall ICFR scope, since a strong process-level control loses its value if the underlying system environment is not itself controlled. A dedicated, deeper IT or cybersecurity audit is a separate, broader engagement if that is the primary need.

Yes. A targeted review of the highest-risk cycles — commonly revenue recognition, procurement-to-pay, payroll, or financial close — is a legitimate and common scope, particularly for a first review or where budget and timeline are constrained. We agree the in-scope processes explicitly at the scoping call so there is no ambiguity later about what was and was not covered.

A sample of actual transactions or control instances over the review period — approved purchase orders, reviewed bank reconciliations, signed-off journal entries — evidenced with dates, approver identities, and supporting documentation, not a verbal confirmation that the control 'is usually followed'.

We seek management's response on every finding before finalising the report and document their explanation alongside our own conclusion. Where management provides credible supporting evidence, findings are revised; where they do not, the finding stands with both perspectives recorded in the final report.

Where the client authorises it, PNPC can brief the incoming or existing statutory auditor on the ICFR review's findings, which typically reduces the extent of the auditor's own control testing during year-end fieldwork, since much of the risk assessment groundwork has already been independently performed.

We communicate material findings to the board or audit committee immediately, rather than holding them for the final polished report, since a material weakness close to a listing, investment, or facility deadline needs to be addressed — or at minimum disclosed and understood by the relevant stakeholders — before that deadline, not discovered afterward.

An ICFR review is not itself a Corporate Tax filing requirement, but the control environment around revenue recognition, expense recording, and journal entries directly affects the reliability of the taxable income figure reported to the Federal Tax Authority under Federal Decree-Law No. 47 of 2022 (9% on taxable income above AED 375,000, effective for financial years starting on or after 1 June 2023), and record-keeping quality supports the record-retention obligations that regime imposes.

Where VAT-relevant processes (sales invoicing, input VAT recovery, and the accuracy of VAT return preparation under Federal Decree-Law No. 8 of 2017) sit within the financial reporting cycles being reviewed, the controls around them are assessed as part of the relevant process — for example, revenue or procurement-to-pay — though a dedicated VAT process review is a narrower, VAT-specific engagement if that is the primary concern.

This is common in smaller UAE entities, and the review does not simply mark it as a failure — instead we assess what compensating controls exist (independent management review, dual sign-off on high-risk transactions, periodic reconciliation by someone outside the process) and whether they realistically offset the segregation gap given the entity's size and risk profile.

Yes, and where both are needed we coordinate timing and, with the client's consent, share relevant control-testing workpapers between the two engagements to avoid duplicating walkthrough and evidence-gathering effort, while keeping the two reports' conclusions consistent.

Findings are ranked by the materiality of the financial reporting risk left exposed — a material weakness in revenue recognition controls is prioritised well ahead of a minor documentation gap in a low-value process — and each ranked finding is paired with a named owner and a realistic target remediation date in the roadmap.

We schedule a follow-up verification cycle for the highest-risk findings, independently confirming the remediating action was actually implemented — not simply accepting management's assertion that an item is closed — and report residual weaknesses if remediation fell short.

A final ICFR review report covering the entity-level control assessment, process-level risk and control matrices, design and operating effectiveness testing results, a ranked deficiency register, and a remediation roadmap with named owners and target dates — formatted to the board's, group finance function's, or statutory auditor's requirements where specified.

PNPC Global has run internal control, risk advisory, and audit-adjacent engagements since 1986 across India and the UAE, combining rigorous evidence-based testing methodology with practical, hands-on process experience across the trading, distribution, manufacturing, and services sectors common in the UAE market — at a cost and turnaround suited to UAE SME and mid-market businesses rather than large-firm minimum fee structures.

Cost depends primarily on the number of entities and processes in scope, whether operating effectiveness testing covers a full financial year or a shorter period, and the condition of existing process documentation. Single-entity, core-cycle reviews are priced modestly; multi-entity group reviews or full-year operating effectiveness testing are priced as a more substantial, structured engagement.

Yes. Where an ICFR review is commissioned as part of buy-side or sell-side due diligence, we scope the walkthroughs and testing to align with the transaction's specific due diligence timetable and the investor's or acquirer's particular control-quality questions.

PNPC retains walkthrough notes, RCMs, testing evidence, and correspondence underlying the report so that, if a question arises later — from group internal audit, the statutory auditor, or a subsequent transaction — the basis for every finding can be traced and re-verified. Because control evidence often underpins figures that feed the Corporate Tax return, the underlying records also fall within the UAE Corporate Tax record-retention regime, which requires Taxable Persons to keep relevant records for at least seven years after the end of the relevant tax period.

DIFC and ADGM entities operate under their own regulator (the DFSA and FSRA respectively) with sector-specific governance and reporting expectations layered on top of standard financial reporting controls, so the entity-level assessment explicitly maps to the applicable regulator's governance requirements in addition to the underlying risk and control matrix work, rather than treating a DIFC/ADGM entity identically to a standard free zone company.

Related-party transactions are assessed as a distinct risk within the relevant process walkthroughs, most commonly revenue, procurement, and treasury — testing whether related-party transactions are identified, approved at the appropriate authority level, and disclosed consistently, since inadequate related-party controls are a recurring source of audit and Corporate Tax scrutiny in UAE group structures.

A hybrid approach is standard — entity-level interviews, document review, and evidence gathering can run remotely, but walkthroughs of physical processes (inventory counts feeding into fixed assets, cash handling, physical approval trails) and sensitive interviews are generally more reliable conducted on-site, so we agree the mix at scoping based on the processes in scope and the client's own preference.

The methodology does not require an ERP — controls over spreadsheet-based processes (version control, formula integrity, access restriction, and independent review before figures are used) are assessed using the same design-and-operating-effectiveness lens, though spreadsheet environments typically surface more findings around version control and unauthorised changes than a properly configured ERP with role-based access.

Treasury walkthroughs cover bank reconciliation controls, payment authorisation limits, and — where the entity holds multi-currency balances or intercompany funding arrangements — the process for recording and reconciling foreign-currency transactions and revaluation, tested with the same design and operating effectiveness approach applied to other financial statement cycles.

Both, ideally: a pre-implementation review of the current control environment establishes what needs to be re-designed into the new system's workflow configuration, and a post-go-live review confirms the new system's control configuration — approval workflows, segregation of roles, audit trails — actually operates as designed once live, rather than assuming the vendor's default configuration meets the entity's control requirements.

Yes — where bookkeeping, payroll processing, or parts of the finance function are outsourced or offshored, the review assesses the controls governing that arrangement specifically: the service-level agreement, the client's own oversight and review controls over the outsourced provider's output, and evidence that the outsourced function's work is independently reviewed before being relied upon in the financial statements.

We pause and escalate immediately to the board or audit committee, bypassing the standard reporting cycle, rather than continuing routine fieldwork and folding it into the scheduled draft report, since a live fraud indicator needs a decision from those charged with governance on next steps — including whether to commission a dedicated forensic investigation — before further testing proceeds in that area.

The report belongs to the commissioning entity, and PNPC shares it with third parties — a bank, an investor, a prospective acquirer — only on the client's written authorisation. The engagement letter specifies who the report is addressed to, and any wider circulation is a decision for the client, not something PNPC does unilaterally.

Where revenue recognition is in scope, the walkthrough and testing examine the controls around identifying performance obligations, timing of recognition, and variable consideration estimates consistent with IFRS 15 (Revenue from Contracts with Customers) principles, since revenue is typically the single highest-risk financial statement line and misapplied recognition timing is a recurring source of restatement.

There is limited value in operating effectiveness testing where no meaningful transaction volume exists, but a lighter entity-level and design assessment can still be useful — confirming governance structure, bank account controls, and the framework that will apply once the entity becomes active — so the control environment is ready rather than retrofitted once transactions begin.

Yes, and there is a natural overlap — the same journal entry, revenue recognition, and expense-recording controls examined in the ICFR review directly support the reliability of the taxable income figure a Corporate Tax health check assesses, so running both on a coordinated timeline avoids duplicating document requests and walkthrough time with the client's finance team.

Process owners need to be available for walkthrough interviews, finance needs to compile the evidence requested against the document checklist, and a single internal coordinator — typically the CFO, Financial Controller, or Head of Internal Audit — is needed to manage document flow and scheduling. The time commitment scales with the number of processes and entities in scope, and we agree a realistic client-side resourcing expectation at the scoping call.

Scope, sample sizes, and testing depth are calibrated to the entity's actual size, transaction volume, and risk profile agreed at scoping — a mid-market trading or services business does not need the same testing intensity as a listed group's consolidated ICFR programme, and we are explicit about where we have deliberately scoped down testing depth versus where materiality genuinely requires full testing.

Where the UAE entity is a subsidiary of an Indian-listed or large unlisted parent, the parent's own statutory auditor typically has to report on the adequacy and operating effectiveness of internal financial controls over financial reporting for the group under Section 143(3)(i) of India's Companies Act, 2013 — and that reporting obligation extends, in substance, to material subsidiaries even though the UAE entity itself has no equivalent standalone Indian filing obligation. A UAE-scoped ICFR review conducted to a comparable methodology gives the Indian parent's auditor independent local evidence to rely on for the subsidiary's contribution to that group-level conclusion.

Yes — an unqualified audit opinion confirms the financial statements as a whole were not materially misstated, but the statutory auditor's control evaluation under ISA 315/330 is scoped only to what is necessary for audit risk assessment, not to giving the board an independent, process-by-process view of control maturity. A clean opinion is compatible with real control weaknesses that happened not to produce a misstatement in that particular period, or that the audit's substantive testing approach was not designed to surface.

Beyond the number of entities and processes in scope, the principal cost drivers are: whether testing covers design only or a full financial year of operating effectiveness; the condition of existing process documentation (a business with current SOPs and RCMs from a prior review costs meaningfully less to re-test than one starting from a blank page); headcount and location count, since segregation-of-duties and access-rights testing scale with organisational complexity; and whether ITGC and DIFC/ADGM-specific governance layers are in scope alongside the core financial process review.

A first-time baseline review builds the entity's RCMs and process documentation essentially from scratch through full walkthroughs with every process owner. A repeat review starts from the prior cycle's RCMs, updates them for any process or personnel changes since the last review, and can generally run a leaner, faster fieldwork phase focused on confirming what changed and re-testing operating effectiveness for the new period, provided documentation from the prior cycle was properly maintained.

No — it is not a legal prerequisite under UAE law, but its presence and actual use (or absence) is assessed as part of the entity-level control environment, since a functioning whistleblower channel is one of the recognised ways a business detects a control failure or fraud indicator before it compounds into a larger problem. Its absence is noted as an entity-level gap, not treated as disqualifying the review from proceeding.

Each entity's testing period is aligned to its own financial year-end for operating effectiveness sampling, while entity-level and cross-entity findings (such as group-wide segregation-of-duties policy or a shared ERP configuration) are assessed and reported on a consistent basis across the group regardless of individual fiscal calendars, so the consolidated group report remains internally comparable even where the underlying testing windows differ by entity.

Its relevance narrows considerably. Operating-effectiveness testing over an extended future period has limited value for an entity winding down, but a targeted review of controls over the final financial statements, asset realisation, and liability settlement process can still matter — particularly where the liquidator, remaining shareholders, or a parent group need independent comfort that the final reported position is reliable before deregistration.

The underlying methodology — walkthroughs, RCMs, design and operating effectiveness testing, deficiency classification — is the same, but the report for a small single-entity business covers fewer processes, a shorter RCM set, and a shorter deficiency register, and is typically delivered as a single consolidated document rather than the entity-by-entity structure a multi-entity group report requires, with a cross-entity executive summary layered on top for group-level readers.

Ministerial Decision No. 114 of 2023 sets the accounting standards and methods a Taxable Person must apply for UAE Corporate Tax purposes under Federal Decree-Law No. 47 of 2022. Where a target's chart of accounts, management accounts, depreciation policy, or closing procedures need to produce financial statements defensible for Corporate Tax purposes and not just for internal management reporting, the ICFR review's process-level controls over the close and journal entry cycle are assessed with that accounting-standard framing specifically in view, rather than assuming any internally consistent set of numbers is automatically adequate.

The engagement letter is typically signed by whoever has authority to commission the review on the entity's behalf — commonly the CFO or Financial Controller acting under board or audit committee authorisation, or directly by a board member or audit committee chair where the review was commissioned at that level. PNPC confirms the signing authority explicitly at scoping so the engagement letter, and any subsequent findings, are addressed to the party with genuine decision-making responsibility.

Yes. A common phasing approach runs the entity-level control assessment and design effectiveness review as Phase 1, giving the board or management an initial view of control maturity and priority risk areas at a lower cost, with Phase 2 — full sample-based operating effectiveness testing across the agreed processes — commissioned separately once Phase 1 findings confirm where deeper testing is genuinely warranted.

The full report is delivered in English as standard, since this is the working language of virtually all UAE corporate finance, audit, and group-reporting functions we engage with. Where a board, government-linked stakeholder, or specific reader requires it, PNPC can prepare an Arabic executive summary alongside the full English report.

No, provided it was properly maintained between cycles — the RCM is updated for any process, personnel, or system changes since the last review rather than rebuilt from a blank template, which is precisely why keeping RCMs and evidence trails current between engagements (rather than only during an active review) meaningfully reduces the cost and duration of every subsequent cycle.

The core methodology is the same, but the weighting of process risk differs — a trading company's highest-risk cycles are typically inventory, procurement-to-pay, and revenue/receivables, with physical stock-count controls a material addition to the walkthrough scope, while a services business carries relatively less inventory risk but proportionately more risk around time/project-based revenue recognition, work-in-progress valuation, and utilisation-linked billing accuracy.

It can — a recent auditor change is not automatically a red flag, but where it followed a disagreement over accounting treatment, a qualified opinion, or an unresolved management letter point, we specifically request the prior auditor's final management letter and any resignation or non-reappointment correspondence, since those documents often identify exactly the control area most worth prioritising in the ICFR review's scope.

Yes, where cash handling is material to the business — retail, hospitality, and similar cash-intensive sectors in particular — the review tests physical cash-handling controls (till reconciliation, cash-in-transit procedures, dual custody for cash counts) as a distinct control area from the broader bank reconciliation and payment-authorisation controls covered under treasury, since cash-handling risk and bank-account risk require different evidence and testing approaches.

Yes — the review examines whether the entity has a control process for identifying, tracking, and disclosing contingent liabilities such as guarantees given on behalf of related entities, pending litigation with an uncertain outcome, and other off-balance-sheet commitments, since these items are easy to omit from financial statements if there is no defined process requiring finance to capture them, distinct from the more visible recorded transaction cycles.

There is no fixed threshold, but a very small entity with minimal transaction volume, a single-person finance function, and no near-term listing, group-consolidation, or facility-renewal driver typically gets more value from a lighter compensating-controls or governance-readiness assessment than a full multi-process ICFR review, since the cost of full-scope testing can outweigh the risk being managed at that scale.

Each entity type is assessed against its own regulatory and operating context — a mainland entity's controls are tested against its actual trading operations, a free zone entity's controls include the Qualifying Free Zone Person substance and income-segregation dimension where relevant to Corporate Tax, and an offshore holding entity is typically assessed at a lighter, governance-and-custody level appropriate to a non-trading vehicle — while all three feed into a single consolidated group RCM structure and deficiency register so the board sees one coherent group-wide picture rather than three disconnected reports.

Only tangentially — the review is not an insurance adequacy assessment, but where a control gap (for example, weak physical asset custody or unreconciled inventory) is identified, we note where the entity's exposure appears under-insured relative to that specific risk as a supplementary observation, since a board evaluating overall risk exposure benefits from seeing the control finding and the related insurance gap together rather than as two disconnected data points from separate advisors.