Internal Audit, and When Your Company Needs One

That is the honest answer, and it is not the one you usually get from an audit firm.

Internal audit is not your statutory audit

These get confused constantly, and they do different jobs for different people.

Your statutory audit is done by an outside firm. It produces one opinion, on whether your financial statements are fairly stated. It is written for people outside the business: your bank, your shareholders, your free zone at licence renewal.

Internal audit sits inside the business and reports to the owner or the board. It does not opine on the accounts. It tests whether your controls work.

One looks backwards at the numbers. The other looks at the machinery that produces them.

You cannot use one to satisfy the other. Your free zone will not accept an internal audit report at renewal.

The three lines of defence

The standard model separates three jobs that owner-managed businesses tend to blur.

1. Management owns the risk and runs the controls day to day.
2. Risk and compliance functions oversee those controls and set the policy.
3. Internal audit independently tests whether the first two work.

The word doing the work is independent. If your internal auditor reports to the finance manager whose payments they are testing, you do not have internal audit. You have a second bookkeeper.

The real trigger point

The trigger is not your headcount or your revenue. It is the day you stop seeing every transaction yourself.

That day usually arrives with one of these:

You open a second location and can no longer see the cash.
You hire someone who can both raise a purchase order and approve the payment. You take on a shareholder who is not in the business daily.
Your bank or a lender starts asking how controls are governed.

Before that point, your own eyes are the control. After it, you are relying on people and systems you cannot personally watch.

What internal audit will not do

It will not catch all fraud. An auditor tests a sample. A determined person who controls both the record and the money can defeat a sample for a long time.

It will not fix a broken process. It tells you the process is broken. Fixing it is management's job and costs more than the audit did.

It will not reduce your statutory audit fee. Auditors may rely on some internal audit work, but they cannot outsource their opinion to you.

A cheaper first step

If you are not ready for a function, run one focused review instead of a programme. Pick the process where money leaves the building. For most UAE SMEs that is supplier payments or petty cash.

Test three months of it end to end. Who raised it, who approved it, who released the payment, and whether those were three different people. That single test finds more than a general risk assessment will.

Where we fit

We do statutory audits, and we do focused control reviews for companies not ready for a full internal audit function. If you want to know which one you need, tell us your headcount and who approves payments, and we will tell you straight.