Circular on the Internal Control and Risk Management Framework
Key Changes
Extension of 1st Phase: The Securities and Commodities Authority (SCA) has extended the first phase for implementing the requirements of Internal Control over Financial Reporting (ICOFR) until the end of 2026.
2026 ICOFR Review: Companies to conduct evaluation, issue internal report and obtain external audit’s opinion for the financial year ending 31 Dec 2026, without public disclosure.
2027 ICOFR Review: From the beginning of 2027, Companies shall conduct a full internal assessment and issue an internal control report, including the external auditor’s opinion on the effectiveness of ICFR.
Disclosure of Opinion: Disclose the report, including the external auditor’s opinion, within the integrated report for 2027, before the General Assembly meeting.
Opinion on Risk Management: Starting in 2028, the report shall include the Risk Management component within the scope of assessment and reporting.
Note – In line with SCA’s regulatory framework, all entities listed are required to implement robust Internal Controls over Financial Reporting from the year 2024. The circular focuses on the extension of timelines for the external auditor’s opinion requirements.
Company & External Auditor Responsibilities
Additional Considerations
Design and Review Framework
- The COSO Framework shall be adopted for designing and assessing the effectiveness of internal control systems
- The International Standard (ISAE 3000) shall be adopted as the framework for review and audit of ICFR reports, aiming to provide reasonable assurance on the effectiveness of internal control systems
Timing of ICOFR Report Disclosure
- The ICOFR report shall be disclosed in conjunction with the Financial Report
- Companies that already have an effective internal control system may issue and disclose their ICFR report for 2025 together with their Financial Report
Exceptions and Flexibility
One-year flexibility to exclude from report:
- Recently Acquired Entities
- Newly Established Entities
- Newly Listed Companies
- Foreign Subsidiaries established outside UAE (Exclusion must be disclosed in the report)
Exempt from mandatory application of the said requirements:
- Foreign listed companies
- Private joint stock companies
- Free zone companies listed on the UAE markets disclosed in the report)
