On 1 January 2027, internal control over financial reporting in the UAE stops being a private exercise. From that point, listed companies must publish an internal control report carrying the external auditor’s opinion on whether their controls over financial reporting actually work, inside the integrated annual report, before the general assembly meets.
The board issues that report. Not the finance function, not internal audit, not the external auditor. The Securities and Commodities Authority has been direct about this: ultimate responsibility for an effective internal control system sits with the board of directors, and the board issues the internal control report itself.
Which leaves one reporting cycle. The financial year ending 31 December 2026 is the last private run before the market reads the result, and the preparation sits with the board and its audit committee rather than with the auditor who signs the opinion.
What exactly changes on 1 January 2027?
The regime began with the SCA’s January 2024 amendments to Articles 14 and 73 of the Corporate Governance Guide for public joint stock companies. Article 14 made the board responsible for establishing and approving an internal control and risk management framework aligned with COSO. Article 73 gave the external auditor the mandate to express a separate opinion on the effectiveness of those controls. A circular issued on 14 January 2025 set out the phased implementation, and a further circular in November 2025 extended the first phase to 31 December 2026, moving public disclosure of the auditor’s ICFR opinion into the 2027 cycle.
The phasing matters because each year carries a different obligation and a different level of exposure.
Financial year | What the company does | External auditor’s role | Public disclosure |
|---|---|---|---|
2024 | Self-assessment of internal control and risk management related to financial reporting; address gaps | Opinion on ICFR effectiveness, separate report | No |
2025 | Preparation for full implementation; early adopters may publish voluntarily | Opinion on ICFR effectiveness | Voluntary for companies with an already effective system |
2026 (trial phase ends 31 December) | Internal evaluation of the control system; ICFR included in the audit engagement | Opinion on ICFR effectiveness, not disclosed | No |
2027 | Full internal assessment; board issues the internal control report | Opinion on ICFR effectiveness included in the report | Yes, in the integrated report before the general assembly |
2028 onwards | Full assessment including the risk management component | Opinion covering ICFR and risk management | Yes |
On paper the change from 2026 to 2027 is small. The same assessment, the same auditor opinion, one difference in where it lands. In practice that difference is the whole point of the reform, because the report reaches shareholders before the general assembly, in the same window where boards already field the questions they were not ready for.
Why does the extra year make 2026 harder rather than easier?
Because the extension moved the bar up while moving the date back. The SCA has specified COSO as the framework for designing and assessing control effectiveness, and ISAE 3000 as the assurance framework for the review, aimed at reasonable assurance rather than limited assurance. Reasonable assurance is the higher of the two thresholds, and it cannot be reached by documenting controls in the final quarter of the year.
The second problem is behavioural. A year in which the auditor’s opinion stays private is a year in which a poor opinion carries no market consequence, which removes precisely the pressure that funds remediation. Practitioners working on UAE implementations describe the same recurring gaps: spreadsheet-dependent processes with no audit trail, key controls with no named owner, incomplete reconciliations, weak access rights and segregation of duties, IT general controls that were never assessed, and processes that depend on one or two individuals. None of those are solved by additional time. They are solved by a remediation plan with an owner and a date attached to every line.
This is the point at which ICFR readiness becomes a board agenda item rather than a finance project. Control testing belongs in the same rhythm as the board’s own performance and effectiveness review, assessed through the year rather than confirmed at the year end, because the committee cannot assure what it has not seen tested.
Who sits inside the ICFR perimeter, and who does not?
Mandatory application runs to public joint stock companies listed on the Abu Dhabi Securities Exchange and the Dubai Financial Market, across all sectors. Three categories sit outside the mandatory requirement, and four categories carry a one-year exclusion that must itself be disclosed.
Category | ICFR position | Condition |
|---|---|---|
Listed public joint stock companies (ADX, DFM) | In scope, mandatory | All sectors, regardless of size |
Foreign listed companies | Exempt from mandatory application | Exemption applies to the SCA requirement only |
Private joint stock companies | Exempt from mandatory application | General UAE company law duties still apply |
Free zone companies listed on UAE markets | Exempt from mandatory application | Free zone regulators may impose their own controls requirements |
Recently acquired entities | One-year exclusion permitted | Exclusion must be disclosed in the report |
Newly established entities | One-year exclusion permitted | Exclusion must be disclosed in the report |
Newly listed companies | One-year exclusion permitted | Grace period runs from listing |
Foreign subsidiaries established outside the UAE | One-year exclusion permitted | Exclusion must be disclosed in the report |
One point is regularly missed in group structures, and it is a question of who at the parent has the standing to ask about a subsidiary’s controls at all, which is where genuine board independence earns its keep.
The SCA requirement is also not the only internal controls regime a UAE entity can fall under. Abu Dhabi Accountability Authority Resolution No. 88 of 2021 reaches Abu Dhabi government-owned entities where the government holds more than 25 percent of capital. Central Bank of the UAE Circular No. 21 of 2019 reaches insurance and takaful companies and their foreign branches. Resolution No. 157 of 2024 reaches federal ministries, authorities and corporations with federal shareholding of at least 25 percent. A diversified group can be inside two of these at once, with different scopes and different reporting lines, and no single owner reconciling them.
What does the board need to do before the 2026 close?
Seven actions decide whether the first public report is a routine disclosure or a governance event.
1. Confirm ICFR is written into the external auditor’s 2026 engagement scope. The regulator expects the ICFR assessment to form an explicit part of the engagement contract from the 2026 audit cycle, and a verbal understanding with the audit partner does not meet that test.
2. Approve the scope in writing. Which entities, processes, accounts and assertions are covered, which are excluded, and on what basis. Incomplete scoping across subsidiaries, overseas operations and free zone entities is the most common finding in UAE implementations.
3. Name a control owner for every key control. A control without an accountable individual fails the design test before anyone tests whether it operates.
4. Commission an IT general controls assessment. Access rights, change management and segregation of duties inside the ERP and consolidation systems sit underneath every financial reporting control above them.
5. Require a deficiency register with severity ratings, remediation owners and target dates, and review it at every board or audit committee meeting between now and the year end.
6. Decide who drafts the board’s internal control report and when directors see the first version. This is work the corporate secretary should be scoping now, not in the week before the general assembly.
7. Run a dry run. Draft the 2026 report as though it were public, then read it as an investor would. Every weakness the board would rather not explain in 2027 is visible in that draft.
What should the audit committee be asking management?
Six questions separate a committee that is overseeing ICFR from one that is receiving a status update.
8. What percentage of key controls has been tested for operating effectiveness, not only design, and what was the failure rate?
9. Which deficiencies would be classified as material weaknesses if the report were published for 2026?
10. Where are we still dependent on manual spreadsheet controls in the consolidation process?
11. What has the external auditor flagged informally that has not yet reached this committee in writing?
12. Which entities are excluded from scope, and what is the plan and date for bringing them in?
13. If the auditor issued an adverse opinion for 2026, what would the remediation timeline look like, and does it fit inside one year?
A committee that cannot get clear answers to those six is looking at one of the early warning signs that tend to surface long before a control failure becomes a reporting failure.
What does a first public ICFR report signal to investors?
It creates comparability where none existed. For the first time, investors will be able to read control effectiveness statements across ADX and DFM issuers and place them side by side. A clean opinion becomes the baseline rather than a differentiator, and anything short of clean becomes a governance signal that analysts, lenders and index providers can act on.
That shifts the calculation for boards that have treated internal controls as a compliance cost. Control effectiveness becomes a disclosed characteristic that affects how the market prices governance quality, which is the same mechanism through which governance protects investor portfolios across the region. The companies that publish a clean first report will say very little about it. The ones that cannot will spend 2027 explaining it.
Where does this land on the board calendar?
Late 2026 is the planning window, not early 2027. Testing and remediation need to complete before the 2026 year end so the auditor’s private opinion reflects a system the board is willing to disclose. The board’s own report needs drafting time in Q1 2027, ahead of the integrated report and the general assembly. Building that sequence into the annual governance calendar now is the difference between a controlled first disclosure and a rushed one.
The regulator has given the market an extra year. The boards that use it will spend 2027 reporting. The rest will spend it explaining.
Frequently asked questions
When does ICFR public disclosure become mandatory in the UAE?
From the beginning of 2027. The trial phase runs to 31 December 2026, during which the external auditor’s opinion on ICFR effectiveness is obtained without public disclosure. From 2027, companies conduct a full internal assessment and disclose the internal control report, including the auditor’s opinion, within the integrated report before the general assembly meeting.
Who issues the internal control report, the board or management?
The board of directors. The SCA has confirmed that ultimate responsibility for an effective internal control system rests with the board and that the board issues the internal control report. Management performs the assessment and the external auditor issues a separate opinion on it.
Which frameworks must UAE companies use for ICFR?
COSO is the framework for designing and assessing the effectiveness of internal control systems. ISAE 3000 is the standard for the review and audit of ICFR reports, aimed at providing reasonable assurance on control effectiveness.
Do private joint stock and free zone companies have to comply?
They are exempt from mandatory application of the SCA requirement, along with foreign listed companies. General board duties under UAE company law still require adequate controls, and free zone and sector regulators including the Central Bank of the UAE impose their own internal control obligations on regulated entities.
What changes in 2028?
The risk management component enters the scope of both the assessment and the report. From 2028 the external auditor’s opinion covers internal control over financial reporting and risk management together, which widens the board’s assurance obligation beyond the financial reporting perimeter.
