What ICFR means and who it applies to
Internal control over financial reporting is the set of controls that gives reasonable assurance the financial statements are reliable. In the UAE it is now a reporting obligation, not only good practice. The Capital Market Authority, which replaced the Securities and Commodities Authority on 1 January 2026, administers a circular requiring listed entities to assess ICFR and obtain an external auditor's opinion. Foreign listed companies, private joint stock companies and free zone issuers are exempt.
The compliance dates that matter
The trial phase runs to 31 December 2026: an internal evaluation, a non-public report for FY2026 and an auditor's opinion that is obtained but not disclosed. From 1 January 2027 the requirement is mandatory and the internal control report, including the auditor's opinion, is published in the integrated annual report ahead of the General Assembly. The opinion must be an explicit part of the auditor's engagement contract from the FY2026 audit cycle, which is being scoped now. Risk management enters scope from 2028.
How CLA Emirates supports ICFR readiness
The regime places the assessment on management. An auditor's opinion is on management's evaluation and does not replace it, which is the point most often missed. We scope by materiality to the financial statements, document the significant processes and the controls inside them, test design and operating effectiveness, and track deficiencies by severity through to closure. Where the close process is undocumented, and it usually is, that is where we start.
The frameworks this work applies
- COSO 2013 Internal Control Integrated Framework
- Abu Dhabi Accountability Authority (ADAA) Chairman's Resolution No. 88 of 2021 for Abu Dhabi Subject Entities
