The controls that moved into the software
A generation ago, financial controls were physical: a signature, a locked drawer, a second pair of eyes. Today they live in software, who can approve a payment is a user permission, whether a record can be altered is a system setting, whether last month’s data survives is a backup configuration.
Which means the integrity of the accounts now depends on the configuration of the systems, and most owner-managed businesses have never examined that configuration. The accounting software was set up by whoever installed it, permissions were granted broadly because narrowing them was inconvenient, and nobody has checked since whether a departed employee still has access or whether the data is actually being backed up.
This matters more every year. Cloud accounting put the ledger somewhere you do not physically control. E-invoicing is about to make structured system output a legal requirement. The systems are no longer just where the accounting happens. They are part of whether it can be trusted.
Who needs IT systems audit services in Dubai
Businesses that have moved to cloud accounting without reviewing how it is configured. Businesses where system access has accumulated over the years and nobody knows who can do what. Businesses preparing for e-invoicing, where system capability and data integrity become a compliance question.
Also businesses that have experienced a data loss or a security scare, businesses being audited where the auditor relies on system-generated data, and businesses whose finance operation would stop entirely if one system or one person were unavailable.
Our IT systems audit process, step by step
What this looks like in practice:
- Review access and permissions. Who can do what in the accounting and related systems, and whether it matches what their role requires, particularly payment, supplier setup and the ability to alter records.
- Check for orphaned access: former employees, shared logins, and administrator rights nobody remembers granting.
- Test data integrity. Can records be altered without trace, is there an audit trail, and does the system enforce the controls it is supposed to.
- Verify backups actually work, which means testing a restore rather than trusting that a backup runs.
- Assess change control: how changes to the system are made, by whom, and whether they are recorded.
- Identify single points of failure: one system, one integration, one person whose absence would stop the operation.
- Check e-invoicing readiness where relevant, since structured output and data quality are now a system question.
- Report with practical, prioritised fixes, most of which are configuration rather than expenditure.
The findings that recur
In owner-managed businesses the same weaknesses appear repeatedly, and nearly all are configuration rather than cost:
- Everyone an administrator, because narrowing permissions at setup was inconvenient and never revisited
- Former employees with live access, since offboarding rarely includes the accounting system
- Shared logins, which make it impossible to know who did what
- Records alterable without an audit trail, so a changed figure leaves no evidence
- Backups that run but were never tested by actually restoring them
- One person who understands the system, whose departure would leave nobody able to operate it
- Integrations nobody documented, so a failure in one silently breaks another
The backup point is the one that costs businesses most, and it is entirely avoidable. A backup that has never been restored is a backup you do not know works, and the moment you discover it does not is the worst possible one.
Why this is now a compliance question, not just good practice
Two changes have moved IT controls from optional hygiene to something with a compliance edge.
Corporate tax and audit. Taxable income starts from accounting income, and auditors increasingly rely on system-generated data. If the system allows records to be altered without trace, the data behind both the audit and the computation is weaker, and a business that cannot demonstrate the integrity of its records is in a poorer position if either is questioned.
E-invoicing. The mandate requires structured invoice data of a defined quality, produced by your system and transmitted through an accredited provider. That makes system capability and data integrity a legal requirement rather than a preference, and a business whose system cannot produce clean structured output has a problem that is now dated and enforced.
So an IT audit that once would have been prudent is now, for many businesses, part of being ready for obligations that are already arriving. The record-retention rules add to this: records kept for 5 years generally; 15 years for real estate records have to remain readable and verifiable, which is a systems question as much as a filing one.
Common mistakes
The expensive mistakes in this area are consistent:
- Everyone holding administrator rights, because narrowing them was inconvenient at setup.
- Former employees left with live access to the accounting system.
- Shared logins, which destroy any ability to attribute actions.
- Trusting backups that have never been restored.
- Records alterable with no audit trail, weakening the data behind the accounts.
- One person who understands the system, with no documentation and no backup.
- Assuming cloud accounting is inherently secure regardless of how it is configured.
When this needs to happen
After moving to cloud accounting, since the configuration was rarely reviewed. When system access has accumulated and nobody is sure who can do what. Before e-invoicing go-live, since system capability and data integrity become a compliance question. And after any data loss, security scare or departure of the person who ran the system.
Otherwise, periodically, access and configuration drift, and a review that was accurate two years ago describes a system that has since changed.
What our IT audit services deliver
- An access and permissions review, with findings
- Orphaned and excessive access identified
- Data integrity and audit trail assessment
- A tested backup, or the finding that it does not restore
- Single points of failure identified
- E-invoicing system readiness where relevant
- A prioritised remediation plan, mostly configuration rather than spend
What to have ready
To start, we need:
- Access to the accounting and related systems, with administrator visibility
- A list of users and their roles
- Details of integrations between systems
- The current backup arrangement
- Details of who set up and who maintains the systems
- Any history of data loss or security incidents
- For e-invoicing, details of the system’s output capability
How we price IT systems audit services
Fixed fee, scoped on the number of systems and users. For most owner-managed businesses this is a contained exercise, because the systems are few even where the findings are significant.
Most remediation is configuration rather than expenditure (tightening permissions, removing orphaned access, testing a restore) so the value is usually well above the fee. Where a system genuinely cannot do what is needed, particularly for e-invoicing, that is a separate migration question.
Related
FAQs about IT systems audit services in Dubai
What is an IT and systems audit?
A review of whether the technology your finance function relies on is secure, controlled and trustworthy, access rights, data integrity, backups, change control, and the risk of depending on one system or one person. As controls have moved into software, this has become part of whether the numbers can be trusted.
Why does it matter for our accounts?
Financial controls now live in software, who can approve a payment is a permission, whether a record can be altered is a setting. If the configuration is weak, the integrity of the accounts is weak, and auditors increasingly rely on system-generated data.
What do you find most often?
Everyone holding administrator rights, former employees with live access, shared logins, records alterable without an audit trail, and backups that run but were never tested by actually restoring them. Nearly all are configuration rather than cost.
Our backups run automatically. Is that enough?
Not until one has been restored. A backup that has never been restored is a backup you do not know works, and the moment you discover it does not is the worst possible one. Testing a restore is part of the audit.
Is this relevant to e-invoicing?
Yes, increasingly. The mandate requires structured invoice data of a defined quality, produced by your system. That makes system capability and data integrity a compliance question rather than a preference, so an IT audit is part of readiness.
We use cloud accounting. Is it not secure by default?
The platform’s security is not the same as your configuration of it. Cloud accounting put the ledger somewhere you do not physically control, which makes access rights and permissions more important, not less. Most weaknesses we find are in how the software was set up.
Is the remediation expensive?
Usually not. Most fixes are configuration (tightening permissions, removing orphaned access, testing a restore, adding an audit trail) rather than expenditure. Where a system genuinely cannot do what is needed, that is a separate migration question, most often raised by e-invoicing.
If not, you do not know it works. That, and who still has access to your accounting system, are the two questions this audit answers first.
Check my compliance status 058 101 9570
Last reviewed 27 July 2026. Rates, thresholds and deadlines change, the e-invoicing provider deadline has already moved once. Confirm current requirements with the Federal Tax Authority before acting, or ask us to check your position.