Internal Controls: A Practical Guide for UAE Businesses

Internal controls are the processes and procedures established by management to provide reasonable assurance that business objectives are achieved.

They generally address areas such as:

For example, a company may establish a policy requiring two authorised employees to approve payments above a specified threshold.

This is an internal control designed to reduce the risk of inappropriate or unauthorised payments.

Internal controls should therefore be viewed as part of the way a business operates, rather than as a separate compliance exercise.

As businesses grow, informal processes may no longer provide sufficient protection.

A business may start with:

1. 1Founder
2. 2Approves
3. 3Pays
4. 4Records

As the organisation grows, the same structure can create significant control risks.

A stronger structure may involve:

1. 1Request
2. 2Review
3. 3Approval
4. 4Payment
5. 5Recording
6. 6Reconciliation

This creates greater accountability and reduces the concentration of responsibilities with one individual.

The UAE Ministry of Finance highlights that effective segregation of duties can strengthen accountability, improve internal controls and mitigate risks relating to fraud, inaccurate financial information and inappropriate transaction approvals.

Internal controls can generally be grouped into several categories.

Preventive Controls

Designed to prevent an error or inappropriate transaction before it occurs.

Examples:

Detective Controls

Designed to identify issues after they occur.

Examples:

Corrective Controls

Designed to address identified issues and prevent recurrence.

Examples:

A mature control framework normally uses a combination of all three.

Segregation of Duties (SoD) means distributing conflicting responsibilities among different individuals.

The objective is to prevent one person from controlling an entire transaction from initiation to completion without appropriate review.

For example, the same employee should generally not have unrestricted responsibility to:

The UAE Ministry of Finance describes segregation of duties as distributing responsibilities among multiple employees so that an individual or group cannot easily commit or conceal errors or circumvent controls.

The exact allocation should depend on the size and structure of the business.

For smaller companies where complete segregation is not practical, management can introduce compensating controls, such as enhanced management review.

Bank Controls

Businesses should:

Accounts Receivable Controls

Businesses should:

Accounts Payable Controls

Businesses should:

Payroll Controls

Businesses should:

Fixed Asset Controls

Businesses should:

Procurement can represent a significant financial risk area.

A structured procurement process can include:

Step 1 - Purchase Request

A department identifies a business requirement.

Step 2 - Approval

The purchase request is approved according to the company's authority matrix.

Step 3 - Supplier Selection

The supplier is selected according to the company's procurement procedures.

Step 4 - Purchase Order

An approved purchase order is issued where applicable.

Step 5 - Receipt of Goods or Services

The business confirms that the goods or services were received.

Step 6 - Invoice Review

The invoice is reviewed against supporting documentation.

Step 7 - Payment Approval

Payment is approved by the authorised person.

This creates a stronger audit trail and reduces the risk of inappropriate purchasing.

Revenue is another important control area.

Businesses should consider controls over:

Management should also monitor unusual revenue trends and significant customer balances.

For example, an unexpected increase in credit notes could indicate:

Cash and bank accounts require particularly strong controls.

Businesses should consider:

Access Control

Only authorised employees should have access to online banking.

Payment Approval

Payments should require approval according to predefined limits.

Dual Authorisation

Higher-value transactions may require more than one authorised approver.

Bank Reconciliation

Bank balances should be reconciled to the accounting records regularly.

Exception Review

Unusual transactions should be investigated.

Signatory Review

Bank signatories should be reviewed when employees join, leave or change roles.

Reliable financial reporting depends on accurate accounting records.

Businesses should implement controls over:

A month-end closing checklist can help ensure that important accounting activities are completed consistently.

Modern businesses increasingly depend on accounting, payroll, CRM and cloud-based systems.

Internal controls should therefore include technology-related controls.

Businesses should consider:

User Access

Employees should only have access necessary for their responsibilities.

Password Security

Appropriate authentication and password controls should be implemented.

Joiner-Mover-Leaver Process

System access should be:

The UAE Ministry of Finance's financial framework, for example, includes role-based access, approval of access changes and expiry of system access when an employee's service ends.

Audit Trails

Important transactions should have an appropriate record of who performed and approved them.

Data Backup

Critical financial and operational data should be appropriately backed up.

Internal controls cannot guarantee that fraud will never occur.

However, appropriately designed controls can reduce opportunities for fraud and increase the likelihood that irregularities will be identified.

Potential fraud risks may include:

Controls such as segregation of duties, approval procedures, reconciliations and exception reporting can help mitigate these risks.

Businesses should establish a clear Delegation of Authority (DoA) framework.

For example:

Illustrative example only. Each business should establish approval thresholds appropriate to its size, ownership structure and risk profile.

The DoA should cover areas such as:

Growing businesses often experience a transition from informal management to structured governance.

Typical warning signs include:

Founder Dependency

Important approvals depend on one individual.

Spreadsheet Dependency

Critical financial processes rely heavily on manual spreadsheets.

Limited Segregation

The same employee performs multiple conflicting activities.

Unclear Authority

Employees are uncertain who can approve transactions.

Delayed Reconciliations

Bank, customer and supplier reconciliations are not performed regularly.

Weak Documentation

Processes depend on employee knowledge rather than documented procedures.

Excessive System Access

Employees retain access that is no longer required.

These issues should be addressed before they become significant operational or financial risks.

A practical approach can be structured into six stages.

Stage 1 - Understand the Business

Identify:

Stage 2 - Identify Key Risks

Consider where errors, fraud, financial loss or non-compliance could occur.

Stage 3 - Map Existing Controls

Document the controls already in place.

Stage 4 - Identify Control Gaps

Determine whether existing controls adequately address identified risks.

Stage 5 - Implement Improvements

Introduce appropriate:

Stage 6 - Monitor and Review

Controls should be periodically tested to determine whether they are actually operating effectively.

Having a documented policy does not necessarily mean that a control is effective.

Management should periodically test whether controls are operating as intended.

For example:

Control

All payments above AED 50,000 require two authorised approvals.

Testing

Select a sample of payments above AED 50,000 and verify:

Result

Any exceptions should be documented and investigated.

This approach helps management distinguish between controls that exist on paper and controls that actually work.

No Formal Approval Matrix

Employees may approve transactions without clearly defined authority.

Insufficient Segregation of Duties

Conflicting responsibilities may be concentrated with one person.

Infrequent Reconciliations

Errors can remain undetected for extended periods.

Poor Supplier Controls

Supplier bank details may be changed without independent verification.

Weak Payroll Controls

Salary changes may not receive appropriate approval.

Excessive System Access

Employees may retain unnecessary financial system permissions.

No Exception Monitoring

Unusual transactions may not receive management attention.

Lack of Documentation

Processes may not be documented sufficiently to ensure consistency.

ZILE Global provides Risk, Compliance & Assurance Advisory and Accounting & Bookkeeping support to help UAE businesses strengthen their internal control environment.

Our approach focuses on practical, risk-based controls that are proportionate to the organisation's size, complexity and operating environment.

We help businesses move beyond policies on paper by focusing on whether controls are clearly designed, consistently implemented and effectively monitored.

Are Your Internal Controls Ready for Growth?

As a business grows, informal controls may no longer be sufficient.

A stronger control environment can help businesses:

Internal controls should not create unnecessary bureaucracy.

The objective is to establish the right controls, at the right level, for the right risks.

ZILE Global can help you assess your existing control environment, identify weaknesses and implement practical improvements across finance, accounting, operations and governance.