A different question from the statutory audit
A statutory audit asks whether the financial statements give a true and fair view. It is designed to detect material misstatement in the accounts, and it is very good at that.
It is not designed to tell you whether a dormant subsidiary was registered for corporate tax, whether your ESR determination was ever documented, whether the AML risk assessment exists, or whether your UBO register reflects a share transfer from three years ago.
Those are compliance questions, and a business can receive a clean audit opinion while failing several of them. In the UAE that gap has widened considerably since 2023, because the number of obligations has grown faster than most businesses’ processes for tracking them.
Who needs compliance audit services in Dubai
Businesses with several entities, where obligations multiply and nobody owns the aggregate. Groups that have acquired or incorporated entities over time without a central compliance register.
Businesses preparing for a transaction, where a buyer will run this exercise less sympathetically. Businesses that have received one penalty and want to know whether there are others. And businesses whose compliance has been handled by different people over the years, with no single record of what was done.
How our compliance audit services work
Every engagement is different in detail, but the shape is consistent:
- Build the entity register first. Every licence held, including dormant and holding companies. This step alone frequently finds entities nobody had in mind.
- Map obligations per entity: corporate tax, VAT, excise, ESR, UBO, AML, WPS, audit, licence renewal.
- Test registration status for each applicable obligation rather than accepting an assurance that it was handled.
- Test filing history: what was filed, when, and whether anything is outstanding.
- Sample the substance, not just the existence. An AML programme with a policy and no applied customer due diligence fails on inspection.
- Check the free zone conditions where relevant: audit submission, approved auditor, QFZP evidence.
- Quantify each gap with its exposure and the cost of closing it.
- Produce a ranked action list, ordered by cost of inaction rather than ease.
What we find most often
The findings are consistent enough to predict before opening the file:
- An unregistered dormant or holding company: the single most common finding, and the penalty is per entity
- ESR filed defensively where no relevant activity is carried on, creating an obligation out of nothing
- A UBO register that has not been updated since a share transfer
- goAML registration with no risk assessment, no applied CDD and no training records behind it
- Free zone audit submitted late, or by an auditor not on the zone’s list
- Reverse charge entries absent across every VAT return filed
- Small Business Relief qualified for and never elected
Note how many of these are omissions rather than errors. Nothing was done wrongly, something was not done at all, which is exactly what a financial statement audit is not looking for.
How it differs from a health check
We offer both and they answer different questions, so it is worth being clear.
A corporate tax health check or VAT health check goes deep on one regime: the computation, the classification, the supporting records, the technical positions taken.
A compliance audit goes wide across every obligation and shallow on each. It asks whether the thing was done, filed and evidenced, not whether the technical position inside it was optimal.
A business that has never had either should generally start wide. Finding an unregistered entity matters more than optimising a computation for an entity that was registered correctly, and the wide pass tells you which deep dives are worth commissioning.
Why multi-entity groups fail this most often
A single company with one licence has a manageable set of obligations and usually one person who knows them. A group with five entities has five times the obligations and, very often, no one person who holds the whole picture.
The failure is structural rather than careless. Each entity was created for a reason, at a different time, sometimes by a different adviser. The trading company gets attention because it generates revenue. The property-holding company, the dormant entity kept for a future purpose and the free zone company set up for a project that ended all get less, and obligations accrue against them at exactly the same rate.
- Corporate tax registration and an annual return, per entity, regardless of activity
- VAT registration where thresholds are met, tested per taxable person rather than per group
- ESR determination per entity, since relevant activity is entity-specific
- UBO register per entity, updated on any ownership change
- Audited financial statements per free zone entity, on each zone’s own deadline
- Licence renewal per entity, each with its own date
Multiply six obligations by five entities and you have thirty things to track, most of which nobody owns. That is the arithmetic behind why the most common finding in this exercise is an entity that was never registered at all.
Where this goes wrong
The same problems recur, and every one of them was cheaper to prevent:
- Assuming a clean audit opinion means compliant. They answer different questions entirely.
- Checking only the trading entity when the exposure is usually in the one nobody looks at.
- Testing existence rather than operation: a policy nobody applies fails on inspection.
- Accepting an assurance that something was handled without testing it.
- Reviewing after a penalty arrives rather than before.
- Treating ESR and UBO as one-off when both need maintaining.
The timing
Before a transaction, before a licence renewal cycle, on any change of adviser, and after any penalty, because a business that received one has usually not found out whether there are others.
Otherwise, every couple of years for a group with multiple entities. The review itself is days rather than weeks once documents are assembled.
What our compliance audit services deliver
- An entity register with obligations mapped per entity
- Registration and filing status tested rather than asserted
- Findings with exposure quantified for each
- A ranked action list ordered by cost of inaction
- Confirmation of what is correct, so you know what not to worry about
- A compliance calendar covering every entity going forward
What we need from you
Nothing exotic, and most of it you already have:
- Trade licences for every entity, including dormant ones
- All tax registration details and filing history
- ESR notifications and reports filed
- UBO register and any share transfer documentation
- AML programme documents, where you are a DNFBP
- Free zone submission evidence and audit reports
- Any penalty notices or authority correspondence received
How we price our compliance audit services
Fixed fee, scoped on the number of entities and the number of obligations in play. A single-entity business is a contained exercise; a group with several licences across zones is larger.
Remedial work is quoted separately once findings are known, and you are under no obligation to have us do it.
Related
FAQs about compliance audit services in Dubai
What is a compliance audit?
A review testing whether you are actually meeting your obligations, tax registrations and filings, ESR, UBO, AML, WPS, licence and free zone conditions. It produces findings and a ranked action list rather than an opinion on your accounts.
How is it different from a statutory audit?
A statutory audit asks whether the financial statements give a true and fair view. It is not designed to detect an unregistered subsidiary or a UBO register that was never updated. A business can hold a clean opinion and fail several compliance obligations.
What do you find most often?
An unregistered dormant or holding company, by a wide margin. Then UBO registers not updated after a share transfer, goAML registration with no substantive programme behind it, and reverse charge entries missing from every VAT return.
How is it different from a health check?
A health check goes deep on one regime, the computation, the classification, the technical positions. A compliance audit goes wide across every obligation and shallow on each. A business that has had neither should start wide.
How long does it take?
Days rather than weeks once documents are assembled. The variable is how quickly the entity register and filing history can be produced, which is itself informative.
Will you tell us if we are fine?
Yes, and plainly. Knowing which obligations are properly handled is as useful as knowing which are not, it tells you where not to spend attention.
Should we do this before selling the business?
Yes. A buyer will run this exercise less sympathetically, and historic compliance exposure follows the entity. Findings identified and fixed before a process cost a fraction of the same findings surfaced during one.
If the answer takes a moment, that is the finding. Unregistered dormant and holding companies are the most common exposure we identify, and the penalty applies to each one.
Check my compliance status 058 101 9570
Last reviewed 27 July 2026. Rates, thresholds and deadlines change, the e-invoicing provider deadline has already moved once. Confirm current requirements with the Federal Tax Authority before acting, or ask us to check your position.