UAE Audit Requirements: Mandatory Thresholds & FTA Process

An audit is not just a formality attached to Corporate Tax filing in the UAE. For many businesses it is a legal obligation with its own thresholds, deadlines, and consequences for getting it wrong. Some companies must have their financial statements audited every year regardless of size. Others never need a statutory audit at all but can still be called in for a Federal Tax Authority (FTA) tax audit at any point within the legal window. Knowing which category a business falls into, and what happens if the FTA comes calling, is the difference between a routine compliance task and a costly scramble.

This guide sets out the current UAE audit requirements for mainland and free zone companies, the mandatory audit thresholds under Corporate Tax law, the full FTA audit and objection process with its actual timelines, and the record-keeping obligations businesses need to plan around.

Who Must Prepare Audited Financial Statements Under UAE Audit Requirements

Not every business needs an annual statutory audit. Under Ministerial Decision No. 84 of 2025, audited financial statements are mandatory, for tax periods starting from 1 January 2025, for:

• Any taxable person with revenue exceeding AED 50,000,000 in the relevant tax period
• Every Qualifying Free Zone Person (QFZP), regardless of revenue
• All Tax Groups, regardless of the combined revenue of group members

The QFZP requirement is worth pausing on because it catches businesses that might otherwise assume they are exempt. A Qualifying Free Zone Person is a free zone company that meets specific conditions to benefit from the 0% Corporate Tax rate on qualifying income, including maintaining adequate substance in the UAE, earning qualifying income, staying under the de minimis threshold for non-qualifying revenue, and complying with transfer pricing rules. Audited financial statements are one of those conditions. A free zone company that skips its audit does not just risk a penalty, it risks losing QFZP status for the current period and the four following periods, with all income taxed at the standard rate during that disqualification window.

Also check: Corporate Tax Audit in UAE

Mainland Audit Requirements Versus Free Zone Audit Requirements

Where a company is registered changes what triggers an audit obligation. Mainland companies fall under different rules than free zone entities, and the two are often confused.

A free zone company that is not a QFZP and stays under the AED 50,000,000 revenue threshold is not required to prepare an annual statutory audit. That does not mean it is safe to skip internal financial record-keeping. If the FTA opens a tax audit, the business is expected to produce complete and accurate records regardless of whether a statutory audit was ever required.

Must check: Tax Dispute Resolution Services in UAE

Statutory Audit Requirements and What the Audit Actually Covers

A statutory audit is an independent examination of a company’s financial statements, carried out by an external auditor to confirm the figures are accurate, consistent, and prepared in line with applicable accounting standards, typically IFRS. It is different from an FTA tax audit, which is a review carried out by the tax authority itself to check compliance with tax law rather than accounting standards.

A statutory audit is usually conducted annually. The external auditor is appointed by the shareholders or, in some free zones, must be pre-approved by the relevant free zone authority. The auditor’s role is to form an independent opinion, not to prepare the accounts, so the underlying bookkeeping and financial statements remain the company’s responsibility.

To complete a statutory audit, auditors typically request:

• Company incorporation documents, trade license, and ownership structure
• Fixed asset registers and depreciation schedules
• Bank statements for the full financial year
• Cash transaction records
• Lease agreements and other material business contracts
• Evidence of statutory dues paid, including VAT and Corporate Tax filings
• Inventory records and valuation methodology
• Loan agreements, advances, and related-party balances
• Accounts payable and receivable ledgers
• Purchase records, both local and imported
• Payroll and overhead expense records

How the FTA Tax Audit Process Works Step by Step

An FTA tax audit is a separate process from the annual statutory audit and can be triggered at any point, whether or not the business has ever had a statutory audit. Under Federal Decree-Law No. 28 of 2021 on Tax Procedures, as amended by Federal Decree-Law No. 17 of 2025, the FTA generally has a 5-year window from the end of the relevant tax period to open an audit. Where there is suspected tax evasion or the taxpayer failed to register when required, this window can extend to 10 years.

The process typically runs in this order:

1. Notice. The FTA gives at least five business days’ notice before the audit start date, unless it believes advance notice would allow the entity to interfere with evidence, in which case it can proceed without notice.
2. Location. The audit can take place at the FTA’s premises, the taxable person’s place of business, or any other location where the business operates.
3. Document request. The taxable person must provide all requested records, data, and supporting documents within the timeframe set by the FTA and cooperate with auditors during the review.
4. Findings and audit report. The FTA issues a report setting out its findings, any additional tax due, or any refund owed, along with the reasoning behind the assessment.
5. Objection. If the taxpayer disagrees, they can submit a reconsideration request within 30 days of the assessment, with supporting documents.
6. FTA decision on objection. The FTA has 30 days to accept, reject, or amend the assessment following a reconsideration request.
7. Court appeal. If the taxpayer still disagrees, they can escalate the matter to the relevant court within 30 days of the FTA’s decision on the objection.

Separately, if the FTA imposes a penalty, the taxable person has 20 days to appeal it by submitting a form with supporting evidence, and the FTA has 20 days to respond to that appeal. This penalty appeal timeline runs independently of the reconsideration process described above, and businesses sometimes need to run both in parallel if a single audit results in both a tax assessment and a penalty.

Record Retention Requirements Businesses Often Get Wrong

Record retention periods are one of the most common points of confusion in UAE audit requirements, largely because the period differs by tax type. Corporate Tax records must be kept for 7 years from the end of the relevant tax period. VAT records must be kept for 5 years, or 10 years for real estate-related transactions. Companies Law generally requires a minimum of 5 years for statutory accounting records.

There is also a newer exception businesses should plan for. Under Cabinet Decision No. 17 of 2026, effective 1 April 2026, where a tax refund request is pending, the retention period is extended by an additional 2 years beyond the standard period. In practice, a business with an open VAT or Corporate Tax refund claim needs to hold onto the related records for longer than it might expect, even after the standard retention window would otherwise have closed.

Related: External Audit Services

A Worked Example: When Does a Free Zone Company Need an Audit

Consider a DMCC-registered trading company with AED 20,000,000 in annual revenue that qualifies and elects for QFZP status to access the 0% Corporate Tax rate on qualifying income. Even though its revenue is well below the AED 50,000,000 threshold, the QFZP election makes an annual audit mandatory under Ministerial Decision No. 84 of 2025. If the company decided instead not to elect QFZP status and stayed under the revenue threshold, it would not be legally required to prepare audited financial statements, though it would still need to maintain accurate records in case of an FTA review. This is the kind of decision that should be weighed before electing QFZP status, since the audit obligation, and the cost of preparing for it every year, is a direct consequence of that choice.

Common Mistakes That Trigger Audit and Compliance Problems

• Assuming free zone status means no audit is ever required. QFZP election and the AED 50,000,000 revenue threshold both override the general free zone exemption.
• Treating the VAT and Corporate Tax retention periods as the same. Filing systems built around a single retention rule often fall short for one tax type or the other.
• Missing the reconsideration deadline. The 30-day window to object to an FTA assessment is calculated from the date of the decision, not from when the business gets around to reviewing it.
• Not separating the penalty appeal from the tax reconsideration. These follow different timelines and require separate submissions.
• Underestimating what the FTA can request. Businesses that keep only summary-level bookkeeping often struggle to produce the transaction-level detail an FTA audit requires within the response window.

Frequently Asked Questions (FAQs)

How Farahat & Co. Can Help

Farahat & Co. supports businesses with statutory audits, Corporate Tax audit preparation, and FTA audit response, from organizing the documentation auditors request to preparing reconsideration submissions when an assessment is disputed.

Contact Farahat & Co. today to discuss your audit requirements.