How to Select Audit Scope for Your Business

The Engagement Letter, Materiality & FTA Reach — UAE 2026 Guide

🎯 Introduction to Selecting Audit Scope

Audit scope isn't something your auditor hands you — it's something you're supposed to define together, before a single test is run. That agreement gets formalized in the engagement letter, and under ISA 210, an auditor cannot ethically or legally start work without one signed. The letter states exactly what's being examined (which entity, which financial statements, which period), under which standards (IFRS, ISA), and — just as importantly — what's deliberately excluded. Get this wrong at the outset and you either pay for testing you didn't need, or discover mid-engagement that something genuinely important was never in scope.

In the UAE specifically, scope gets shaped by a handful of concrete triggers: revenue exceeding AED 50 million or Qualifying Free Zone Person status both mandate audited financial statements, regardless of how the business itself feels about it. Small Business Relief, despite reducing your Corporate Tax bill, does nothing to exempt you from the statutory audit requirement under the Commercial Companies Law — a distinction that catches founders out constantly. And where Corporate Tax advisory work is involved, many firms now deliberately carve tax services out of the audit engagement letter entirely, requiring a separate one, specifically to protect auditor independence.

This guide breaks down exactly how to select the right audit scope for your business in 2026 — what the engagement letter actually controls, how materiality and risk-based testing shape what gets examined, the UAE-specific triggers that determine whether you need an audit at all, and what happens when scope needs to expand or gets improperly limited. For the terminology behind these concepts, our audit terms guide is a useful companion. If you'd rather have specialists scope this properly for your business, our audit & assurance team works with businesses across the UAE.

📖 What "Audit Scope" Actually Means

• Audit scope defines the boundaries of an audit — which entity or entities, which reporting period, which financial statement areas, and the depth of testing applied.
• It also defines the level of assurance being provided — a full audit gives reasonable assurance; a review or agreed-upon-procedures engagement gives a lower, more limited level of assurance.
• Scope isn't just "everything vs nothing" — it's a deliberate set of decisions about where audit effort is concentrated and where it isn't.

📜 The Engagement Letter: Where Scope Gets Defined

• Under ISA 210, agreeing engagement terms in writing is mandatory — an auditor cannot ethically or legally begin an audit without a signed engagement letter.
• The letter explicitly states what is being audited (e.g., statutory financial statements for a specific entity and period) and which standards apply (IFRS for the financial statements, ISA for the audit itself).
• This is specifically designed to prevent scope creep — vague or informal understandings about what's covered are where disputes and gaps originate.
• ISA 210 permits a recurring engagement to continue without a new letter each year if terms haven't changed, but renewing it annually is generally advisable to reflect fee changes, updated dates, and regulatory developments like a new tax law.

⚖️ Materiality: The Concept That Drives Everything

• Materiality is the threshold below which a misstatement is considered too small to matter to someone relying on the financial statements.
• It's typically set as a percentage of a chosen benchmark — revenue, total assets, or profit before tax — with the specific percentage and benchmark depending on the nature of the business and its users' needs.
• Performance materiality (a lower threshold than overall materiality) is used during testing to reduce the risk that several smaller misstatements add up to something material overall.
• Materiality directly drives scope: accounts and transactions well below the threshold generally receive lighter testing than those with balances or activity approaching it.

🔍 Risk-Based Scoping

• Modern audits under ISA don't test every account with equal intensity — audit effort is concentrated on areas assessed as higher risk.
• Higher-risk areas typically include significant accounting estimates, related-party transactions, complex or judgment-heavy revenue recognition, and any area with a history of prior misstatement.
• ISA 240 specifically requires auditors to consider fraud risk as part of this risk assessment in every audit.
• Sample sizes for testing are directly tied to the assessed risk level and the materiality threshold set for that area — higher risk or lower materiality generally means larger samples and more substantive testing.

🇦🇪 What Determines Your Audit Scope in the UAE

🗂️ Full-Scope vs Limited-Scope vs Specific-Purpose

🏢 Group Structures: Scoping Multiple Entities

• For businesses with multiple entities — UAE subsidiaries, international branches, or a group structure spanning mainland and free zone entities — scope needs to be defined at the group level, not just per entity.
• Component materiality is typically set for each significant subsidiary, often lower than the overall group materiality, to ensure smaller entities don't collectively hide a material group-level issue.
• Not every entity in a group needs the same depth of audit procedure — some may need a full audit, others specified procedures, and immaterial components may need none at all, based on their individual significance to the group.

🧾 Tax Advisory vs Audit: Why Scope Gets Separated

• With Corporate Tax now in effect, many UAE audit engagement letters explicitly exclude tax advisory services — such as transfer pricing studies or Corporate Tax planning — from the audit's scope.
• This is specifically about protecting auditor independence: an auditor advising on a tax position and then auditing the outcome of that same position creates a genuine conflict.
• Practically, this means a business may need two separate engagement letters — one for the statutory audit, another for tax advisory work — even when using the same firm for both.

⏳ Time Period Scope: How Far Back Can an Audit Reach?

• For a statutory audit, the time period scope is simply the financial year being reported on.
• For an FTA tax audit, the time period reach is different and broader: the FTA's power to audit or assess a tax period is generally capped at 5 years under the Tax Procedures Law.
• This extends to 15 years in cases involving suspected tax evasion or a failure to register — a genuinely significant difference in exposure depending on the circumstances.
• This matters for scoping your own record-keeping and internal review procedures — a 5-year default reach means your compliance documentation needs a longer shelf life than a single financial year's audit might suggest.

📈 Scope Creep: What Happens When Scope Expands

• Scope creep happens when the audit expands beyond what was originally agreed — typically because the auditor uncovers something during testing (an unexpected related-party transaction, a control weakness, a suspected error) that needs further investigation.
• A well-drafted engagement letter anticipates this by describing how scope changes will be communicated and, where relevant, how additional fees will be handled.
• Scope creep isn't inherently a problem — it's often exactly the auditor doing their job properly — but it should never come as a surprise if the engagement letter set expectations clearly at the outset.

🚫 Scope Limitations: When Management Restricts Scope

• This can result in a qualified opinion (if the limitation is material but not pervasive) or, in serious cases, a disclaimer of opinion (if the auditor cannot form a view at all).
• Scope limitations imposed by management are generally viewed unfavorably by anyone relying on the audit report — banks, investors, regulators — since they suggest something is being deliberately kept out of view.

🧭 Step-by-Step: How to Define Your Audit Scope

1. Identify Why You Need the Audit

   Statutory requirement, lender covenant, investor due diligence, or internal assurance.

2. Confirm Your UAE-Specific Triggers

   Revenue threshold, QFZP status, free zone renewal requirements.

3. Define the Reporting Entity & Period

   Single entity or group, and the exact financial year or period.

4. Discuss Materiality With Your Auditor

   Understand the benchmark and threshold being applied.

5. Identify Known Risk Areas Upfront

   Related-party transactions, complex estimates, recent system changes.

6. Decide Whether Tax Advisory Needs a Separate Engagement

   To preserve independence.

7. Review & Sign the Engagement Letter

   Confirming scope, standards, and responsibilities in writing.

8. Revisit Scope Annually

   As the business, regulations, and risk profile evolve.

⚠️ Common Mistakes in Audit Scoping

• Treating the engagement letter as a formality to sign quickly, rather than the document that actually defines what you're paying for.
• Assuming Small Business Relief exempts a company from statutory audit requirements — it doesn't.
• Not accounting for the FTA's extended 15-year audit reach when evasion or non-registration is suspected, when assessing how long records genuinely need to be retained.
• Combining tax advisory and audit services under one engagement letter without considering the independence implications.
• Underestimating component materiality needs in a group structure, leaving smaller entities under-scrutinized.
• Treating any scope expansion during the audit as an unwelcome surprise, rather than planning for how it will be communicated from the outset.

💼 How One Desk Solution Can Help

Getting audit scope right the first time means understanding materiality, risk, and your specific UAE compliance triggers — not just signing whatever engagement letter arrives. Our audit and assurance services team works with you to define the right scope and materiality for your business, supported by our tax services team for properly separated tax advisory engagements, our accounting & bookkeeping services for audit-ready records, and our advisory & consultancy services for group structuring. Explore our full range on the services page.

❓ Frequently Asked Questions

🔗 Related Resources