How Is a Procurement Audit Conducted in the UAE and What Does It Examine?

What a Procurement Audit Is and Why It Matters for UAE Businesses

A procurement audit is a systematic examination of a company’s purchasing activities, vendor relationships, internal controls, and expenditure records to assess whether procurement is being conducted efficiently, accurately, and in compliance with company policy and applicable regulations. For UAE businesses, procurement audits carry regulatory significance beyond operational improvement: input VAT recovery, Corporate Tax deductibility of procurement costs, and compliance with anti-money laundering obligations for certain supplier categories all connect directly to the quality of procurement records and controls.

Procurement typically represents one of the largest expenditure categories in any business. It is also one of the highest-risk areas for control failures and fraud. A procurement audit conducted by an independent audit team provides management with an objective assessment of where the procurement function is working as intended and where gaps in controls, documentation, or vendor management exist.

Stage 1: Review of Purchases and Purchase Documentation

The foundational stage of a procurement audit is a detailed review of the company’s purchase transactions for the audit period. This stage examines whether purchases were properly authorised, accurately recorded, and correctly documented from requisition through to payment.

The auditor reviews a sample of purchase orders, invoices, delivery notes, and payment records to verify:

• Authorisation: each purchase order bears the authorised signatory’s approval at the appropriate level. Purchases above defined value thresholds should have escalated approval from a second or senior authoriser
• Three-way matching: the purchase order, delivery note, and supplier invoice agree on quantity, description, price, and delivery terms. Discrepancies between these documents indicate either a documentation failure or a potential control breach
• VAT invoice compliance: for UAE VAT-registered businesses, input VAT is only recoverable on valid tax invoices meeting all mandatory fields under the UAE VAT legislation. The auditor verifies that every VAT claim in the procurement records is supported by a compliant tax invoice with the supplier’s Tax Registration Number, the correct VAT amount, and all other required details
• Accurate coding: expenditure has been allocated to the correct cost centre, expense category, and accounting period. Miscoding affects both management reporting and the accuracy of Corporate Tax deductibility assessments
• Completeness of records: purchase records are retained for at least 5 years for VAT purposes and 7 years for Corporate Tax purposes. The audit confirms that records for the applicable retention period are complete and accessible

Stage 2: Vendor Evaluation and Supplier Due Diligence

The vendor evaluation stage examines the company’s supplier relationships and the processes used to select, approve, and manage vendors. This stage frequently reveals the most significant findings in a procurement audit because vendor management is where conflicts of interest, undisclosed relationships, and unauthorised arrangements are most likely to exist.

The auditor assesses:

• Vendor approval and onboarding: whether all active vendors are on the company’s approved vendor list and have gone through a documented onboarding process including business licence verification, VAT registration confirmation, and bank account validation
• Pricing competitiveness: whether prices paid to key vendors are consistent with market rates. Persistent pricing above market without documented justification may indicate preferential arrangements or undisclosed relationships between procurement staff and vendors
• Contract terms and compliance: whether active vendor contracts contain clear pricing, scope, delivery, and payment terms, and whether the company is receiving the discounts, rebates, or other benefits specified in the contracts
• Vendor concentration: whether the company is over-reliant on a single supplier for critical goods or services without documented justification, creating both commercial and continuity risk
• Related party vendors: whether any active vendors are related to company directors, shareholders, or employees. Under UAE Corporate Tax rules, related party transactions must be conducted at arm’s length; undisclosed related party vendor relationships create both a governance and tax compliance issue
• AML considerations: for higher-risk procurement categories, the auditor may review whether vendor due diligence procedures are proportionate to the AML risk profile of the supplier relationship, particularly for cash-intensive sectors or high-value transactions

Stage 3: Review of Internal Purchasing Procedures and Controls

The third stage examines how the procurement function actually operates in practice, as distinct from how the written procurement policy says it should operate. This stage identifies gaps between policy and practice, weaknesses in the control environment, and areas where the segregation of duties is insufficient.

Key areas examined include:

• Segregation of duties: whether the same individual can both raise a purchase order and approve it, or both approve a payment and process it. Inadequate segregation is the most common enabler of procurement fraud
• Approved supplier list management: whether the approved supplier list is actively maintained, regularly reviewed, and whether purchases from non-approved suppliers require documented exception approval
• Purchase thresholds and competitive tendering: whether purchases above defined value thresholds go through a competitive quotation or tender process, and whether the results of that process are documented and retained
• Emergency or urgent purchase procedures: whether there is a documented procedure for urgent purchases that bypass the standard approval process, and whether this procedure is being used appropriately or is being exploited to circumvent controls
• Petty cash and expense claim controls: whether small-value procurement through petty cash or employee expense claims is subject to appropriate limits, receipts, and approval requirements
• IT system access controls: whether access to the procurement and accounts payable systems is restricted to authorised users, and whether any access rights are inconsistent with current job roles

Stage 4: VAT and Corporate Tax Compliance in Procurement

For UAE businesses operating under VAT and Corporate Tax, the procurement audit has a specific compliance dimension that extends beyond operational and governance findings.

On VAT, the auditor verifies:

• Input VAT has only been recovered on purchases where the business has a valid tax invoice with all mandatory fields
• Input VAT on purchases with mixed business and personal use has been correctly apportioned rather than claimed in full
• Input VAT has not been claimed on categories of expenditure where recovery is specifically blocked under UAE VAT legislation, including motor vehicles used for personal purposes and certain entertainment expenses
• The total input VAT claimed in the VAT returns for the audit period reconciles to the input VAT recorded in the accounts payable ledger

On Corporate Tax, the auditor reviews whether procurement expenditure has been correctly assessed for deductibility. Costs that are not wholly and exclusively incurred for business purposes are non-deductible under Federal Decree-Law No. 47 of 2022. Entertainment expenditure is subject to a 50% deductibility restriction. Payments to related party vendors must be assessed for arm’s length pricing where the related party thresholds are met.

Stage 5: Reporting Findings and Recommendations

The final stage of the procurement audit is the preparation of the audit report, which presents the findings from each stage, rates them by severity, identifies the root cause of each issue, and makes specific, actionable recommendations for remediation.

Findings are typically classified by severity:

• High severity: control failures that create immediate financial, tax, or fraud risk requiring urgent remediation
• Medium severity: process weaknesses or documentation gaps that require addressing within a defined timeframe
• Low severity / observations: improvement opportunities that do not represent immediate risk but would enhance the efficiency or robustness of the procurement function

The recommendations are tailored to the company’s size, industry, and procurement volumes. A manufacturing business with high-value raw material procurement has different priority areas than a professional services firm with primarily people-related costs. The audit report should be specific enough for management to assign ownership and track implementation of each recommendation.

Common Procurement Fraud Indicators in UAE Businesses

Procurement is consistently identified as the function most exposed to fraud. The following are the indicators most commonly identified during UAE procurement audits:

• Vendors with no physical address, no online presence, or no verifiable trade licence
• Multiple vendors sharing the same bank account number or contact details
• Vendors registered at the home address of an employee
• A single vendor winning a disproportionate share of competitive tenders
• Purchase orders split just below approval thresholds to avoid escalated authorisation
• Invoices with sequential numbers, indicating a single person generating them for multiple supposed transactions
• Significant volumes of emergency or urgent purchases that bypass competitive tendering
• Payments to vendors that cannot be matched to any received goods or services in the warehouse or delivery records

Frequently Asked Questions (FAQs)

How Farahat & Co. Can Help

Farahat & Co. provides procurement audit services to businesses across the UAE, covering purchase review, vendor evaluation, internal controls assessment, VAT input tax recovery verification, and Corporate Tax deductibility review. Our team delivers findings and recommendations that address both the operational and regulatory dimensions of procurement compliance.

Contact Farahat & Co. today to discuss your procurement audit requirements.