Board Audit Committee Checklist Dubai: A Practical Guide for Directors (2027)

Who Needs One, Charter & Composition, a 10-Area Checklist, Annual Calendar, Meeting Agenda & Red Flags

🚀 Introduction: Why Dubai Boards Are Revisiting Their Audit Committees

An audit committee is the board's own check on the numbers, the controls and the people who audit them. In Dubai that job has become heavier in the last two years. Corporate Tax now makes audited financial statements compulsory for many companies, the UAE's new AML/CFT law (No. 10 of 2025) took effect on 14 October 2025 and, according to White & Case, allows managers of legal entities to face personal criminal liability, and the Securities and Commodities Authority has been reconstituted as the Capital Market Authority from 1 January 2026.

Not every company must have an audit committee. The requirement is set sector by sector, so a listed public joint stock company, a bank, a VARA-licensed exchange and a family-owned LLC sit in very different positions. What they share is the same underlying questions: are the accounts reliable, is the auditor independent, are controls working, and would the board hear about a problem early enough?

This guide turns those questions into a practical checklist for Dubai directors: who needs a committee, how to constitute it, what to review across ten areas, and how to run a year of meetings. It also links to our guides on Corporate Tax registration and tax registration requirements, and our audit & assurance services team can support your committee in practice.

📌 Who Needs an Audit Committee in Dubai?

There is no single rule for every Dubai company. The requirement follows your regulator, so start by identifying which regime applies to you.

Where your company is licensed also matters for everything else you do. If you are still choosing a jurisdiction, our guide to Dubai vs Abu Dhabi vs Sharjah business setup compares the regimes, and our guide to trade licence types and terminology explains mainland, free zone and professional licences.

🎯 What an Audit Committee Does — and Does Not Do

The committee supervises the people and processes that produce and test the numbers. It does not prepare the accounts (that is management) and it does not perform the audit (that is the external auditor). It reports to the board, and the board remains responsible for what it delegates: under VARA's rulebook, for example, the board may delegate authority to its committees but not its responsibilities.

🏛️ Area 1: Charter & Composition Checklist

A committee is only as strong as its mandate and its members. The CBUAE requires every bank board committee to have a charter covering membership, mandate, scope, working procedures and accountability to the board, with access to external expert advice where needed (Regulation Art. 4(4)). It is a sound template for any Dubai company.

Charter checklist

• Written charter approved by the board and reviewed at least annually.
• Clear mandate: financial reporting, external audit, internal audit, controls, compliance, whistleblowing.
• Named chair, members, secretary and term of office.
• Authority to request information, interview staff and engage advisers.
• Independence criteria written down and confirmed each year by every member.
• Reporting line to the board after every meeting, with minutes circulated promptly.

🗂️ The 10-Area Checklist at a Glance

Use this table as the one-page version. Each area is expanded in the sections that follow.

📊 Area 2: Financial Reporting Checklist

The committee's first duty is to be satisfied that the financial statements give a true picture. That means challenging judgments, not just reading the draft. Under the SCA framework summarised by Mondaq, this includes monitoring the integrity of annual, semi-annual and quarterly statements, with particular attention to changes in accounting policies and practices. Banks must prepare annual financial statements under IFRS with the opinion of a CBUAE-approved external auditor (Regulation Art. 10).

• Statements prepared under IFRS (or IFRS for SMEs where your regime allows it) and consistent with prior-year policies.
• Significant judgments reviewed: revenue recognition, expected credit losses, impairment, provisions, fair values.
• Going concern assessment challenged, with the supporting forecast and funding evidence.
• Changes in accounting policy or estimate understood and properly disclosed.
• Corrected and uncorrected misstatements reviewed, with reasons for any left unadjusted.
• Current and deferred Corporate Tax (9% above AED 375,000) reflected correctly under IAS 12.
• Year-end close checked: reconciliations, cut-off, intercompany balances and period-end journals.
• Management representation letter and board approval timetable agreed before sign-off.
• Recommendation to the board documented in the minutes.

🔍 Areas 3–4: External Auditor & Independence Checklist

Under the Commercial Companies Law (Federal Decree-Law No. 32 of 2021), as summarised by Mondaq, the board nominates the auditor and the general assembly appoints it for one renewable year. While auditing, the auditor must not provide additional technical, administrative or consultancy services that could affect its independence. Public joint stock companies must appoint an auditor registered with the securities regulator, and in the DIFC, public listed companies, domestic authorised firms, authorised market institutions and domestic funds must appoint a DFSA-registered auditor.

The committee's job is to make that appointment a decision rather than a rubber stamp. Our guides to audit services in Dubai and who can perform a statutory audit in the UAE explain what to check, and how to prepare for your first audit is useful for newly formed companies.

Appointment and plan

• Auditor holds the registration your regime requires (securities regulator, DFSA, CBUAE approval for banks).
• Reappointment or tender recommendation supported by a written audit-quality assessment.
• Audit plan reviewed: scope, materiality, significant risks, timetable and team.
• Fees approved and compared with prior years and the scope of work.
• Rotation or tenure rules for your sector checked. For example, a CBUAE transitional rule required banks whose audit firm had served six years or more cumulatively at the end of 2018 to rotate; no single rotation rule applies to every company.

Independence

• Annual written confirmation of independence from the auditor.
• Pre-approval process for any non-audit services, with a log of fees by type.
• No close personal or financial ties between the audit team and management or committee members.
• Private session with the auditor, without management, at least once a year.

Questions to ask the auditor at the end of the audit

🛡️ Area 5: Internal Audit Checklist

Internal audit is the committee's own eyes inside the business. The CBUAE regulation requires the internal audit function to report to the board or its audit committee (Art. 9) and requires senior management to respect internal audit's independence (Standards 5.2). KPMG's summary of the SCA amendments adds that the compliance officer and internal audit functions cannot be combined into one role.

• Internal audit charter approved by the committee, with an independent reporting line to the chair.
• Risk-based annual plan approved, covering finance, operations, IT, compliance and fraud risk.
• Head of internal audit appointed, evaluated and, if necessary, removed with the committee's involvement.
• Reports received directly, with ratings, root causes and management responses.
• Overdue actions tracked and escalated, with a deadline for each.
• Resources and skills reviewed; outsourced or co-sourced models assessed for independence.
• Quality of the function periodically reviewed.

⚙️ Area 6: Internal Control & Risk Checklist

The committee needs reasonable assurance that controls over financial reporting and key risks work in practice. KPMG notes that the SCA requires boards to ensure internal control and risk management frameworks align with global practice, preferably COSO. Where a separate risk committee exists, the CBUAE expects the audit and risk committees to communicate and coordinate effectively across all risks, including emerging ones (Standards 4.4).

• Internal control framework documented and mapped to a recognised model such as COSO.
• Key financial controls tested: reconciliations, approvals, segregation of duties, journals.
• Risk register reviewed at least twice a year, with owners, ratings and mitigation.
• IT general controls, access management, data backup and cyber incidents reported to the committee.
• Business continuity and disaster recovery plans tested.
• Control deficiencies from audit and internal audit tracked to closure.
• Coordination agreed between the audit and risk committees to avoid gaps or duplication.

🧾 Area 7: Tax & Regulatory Compliance Checklist

Corporate Tax has turned tax compliance into a board-level topic. The committee should confirm that registrations, returns and audited financial statements are on the calendar, and that a named person owns each deadline.

• A single compliance calendar covering tax, licence, visa and regulator filings, reviewed each meeting.
• Tax positions and provisions reviewed, with any uncertain positions escalated.
• Audit engagement for tax-driven audited statements agreed early enough to meet the filing date.
• Regulator correspondence and inspection findings reported to the committee.

🚨 Areas 8–9: AML, Fraud, Whistleblowing & Related Parties

AML and sanctions

The UAE's new AML/CFT law (No. 10 of 2025) replaced the 2018 law and took effect on 14 October 2025. White & Case reports that corporate fines are set at AED 5 million to AED 100 million (or the value of the criminal property, if greater), that managers can face personal criminal liability where they knew or should reasonably have known funds were illicit, and that courts may order dissolution or closure. New executive regulations were still awaited, with Cabinet Decision No. 10 of 2019 remaining in force until then. The committee should therefore confirm that AML and sanctions controls are resourced and tested.

Fraud and whistleblowing

The CBUAE expects the board to oversee the whistleblowing mechanism, approve how concerns are investigated and ensure staff are protected from reprisal (Standards 2.8–2.9). Cleary Gottlieb also notes whistle-blower protections in the new capital markets law, including confidentiality and protection from adverse employment action.

Related parties and conflicts

For PJSCs, Al Tamimi reports that related-party transactions up to 5% of share capital need board approval and those above that threshold need general assembly approval. Whatever your regime, the committee should see them first.

• AML and sanctions programme reviewed annually: risk assessment, policies, training, suspicious-activity process.
• Fraud risk assessment refreshed each year, including management override scenarios.
• Whistleblowing channel independent of management, with a case log reported to the chair.
• Each case tracked from receipt to outcome, with protection for the reporter confirmed.
• Related-party register maintained, with terms tested against arm's length.
• Directors' conflicts declared at every meeting and recorded.
• Code of conduct acknowledged annually by staff and directors.

📝 Area 10: Evaluation, Reporting & Disclosure

A committee that never assesses itself rarely improves. The CBUAE requires the board and its committees to be assessed annually, with an independent external assessment at least every five years (Regulation Art. 4(8), Standards 4.8). For listed companies, KPMG's summary of SCA Decision 2/RM of 2024 says the audit committee must prepare an annual report, endorsed by its chair, as a separate document within the corporate governance report, and its chair must attend the annual general assembly to answer questions.

• Annual self-assessment completed, with actions for the following year.
• Skills gaps identified and training scheduled, for example on IFRS, Corporate Tax and AML.
• Annual committee report drafted and approved by the chair.
• Chair prepared to answer shareholder questions at the general assembly (listed companies).
• Minutes accurate, timely and showing challenge, not only conclusions.
• Charter and calendar refreshed, and an external review planned every few years.

📅 A Sample Annual Calendar

A predictable calendar keeps the committee ahead of the audit and the tax deadline. The example below is illustrative, for a company with a 31 December year-end that meets four times a year; adjust it to your regulator and reporting cycle.

🗒️ A Sample Meeting Agenda

A standing agenda stops the committee drifting into management's agenda. This illustrative 160-minute format suits a quarterly meeting; trim items that do not apply to your business.

🪜 How to Set Up an Audit Committee in 6 Steps

1. Confirm whether it is mandatory or voluntary

   Check your regulator (CMA, CBUAE, VARA, DFSA or none) and your articles of association, and record the basis for your decision.

2. Draft and approve a charter

   Cover mandate, membership, independence, authority, meeting frequency, reporting and annual review, and have the board approve it.

3. Select members and a chair

   Aim for at least three members, an independent chair and at least one member with financial expertise, and collect independence declarations.

4. Agree the annual calendar and information flow

   Fix meeting dates around the audit and Corporate Tax deadlines, and set the reports each function must deliver and when.

5. Hold a baseline first meeting

   Review the control environment, outstanding audit findings, open compliance items and the auditor's independence, and set a priority action list.

6. Evaluate and report every year

   Run a self-assessment, refresh the charter, and report to the board (and shareholders where required) on what the committee did and found.

🏢 Private Companies & SMEs: A Voluntary Committee

Most Dubai companies are private LLCs or free zone entities, where no general statutory audit committee requirement applies. That does not mean the oversight is optional: lenders, investors, group parents and family stakeholders often expect it, and the audited-financials threshold under Corporate Tax (AED 50 million of revenue, or QFZP status) puts more mid-sized companies under a formal audit each year.

A lean model that works

• Members: three people, for example two non-executive directors and an independent adviser with accounting experience, with an independent chair.
• Rhythm: two to four meetings a year, timed around year-end, the tax return and audit planning.
• Assurance: a co-sourced or outsourced internal audit plan sized to the business.
• Evidence: a one-page dashboard covering audit findings, overdue actions, compliance dates and incidents.

🚩 Red Flags the Committee Should Chase

⚠️ Common Mistakes to Avoid

• Treating the committee as a formality that signs off whatever management presents.
• Appointing members with no independence or financial experience, or an executive as chair.
• Letting the auditor also supply consultancy or advisory work that compromises independence.
• Meeting only once, after the audit is finished, with no time to challenge anything.
• Never holding a private session with the auditor or head of internal audit.
• Ignoring Corporate Tax: missing registration, the nine-month return deadline or the audited-financials trigger.
• Leaving the whistleblowing channel under management's control.
• Copying a listed-company charter without adapting it to the company's size and risks.
• Never assessing the committee's own effectiveness.

💼 How One Desk Solution Can Help

Our audit & assurance services team provides external audit, co-sourced internal audit and controls reviews that give your committee independent evidence. Our advisory & consultancy services team drafts charters, risk registers and governance frameworks, and our tax services team keeps Corporate Tax and VAT compliance on the calendar. Our accounting & bookkeeping services team strengthens the close process the committee reviews, and our business setup team can structure new companies with governance in mind. Explore everything on our services page.

❓ Frequently Asked Questions

🔗 Related Resources