SCA Listed Company Audit Requirements in UAE (2026)

Listed company audits are the highest-stakes engagements in UAE accounting. The SCA sets the rules, and the consequences of non-compliance are severe.

The Securities and Commodities Authority (SCA) regulates all companies listed on the Dubai Financial Market (DFM) and Abu Dhabi Securities Exchange (ADX). Audit requirements for these companies go far beyond standard statutory audit obligations. They include mandatory auditor rotation, audit committee governance, interim reporting, and disclosure standards aligned with international best practices.

This guide covers every audit requirement that UAE listed companies must meet in 2026. For audit firms qualified to handle listed engagements, browse the FindCPA auditor directory.

What Is an SCA Listed Company Audit?

An SCA listed company audit is the annual independent examination of financial statements for companies listed on the DFM or ADX, conducted in accordance with International Standards on Auditing (ISA) and regulated by SCA Corporate Governance Rules. The audit must be performed by an auditor approved by the SCA from its registered auditor list. The output is an audit report expressing an opinion on whether the financial statements present a true and fair view in accordance with IFRS — this report is published alongside the financial statements and is available to all market participants.

The audit of a listed company differs from a private company audit in several critical ways:

• Regulatory oversight: The SCA actively monitors audit quality and can sanction both the company and the auditor
• Public accountability: The audit report is public — shareholders, analysts, and regulators rely on it
• Expanded scope: Beyond financial statements, the auditor must report on internal controls, related party transactions, and compliance with governance rules
• Tighter deadlines: Interim and annual reporting deadlines are prescribed and non-negotiable
• Higher standards: The SCA can and does remove auditors from its approved list for quality failures

Legal framework:

• Federal Decree-Law No. 32 of 2021 (Commercial Companies Law)
• SCA Board of Directors' Decision No. 3/R.M of 2020 (Corporate Governance Guide)
• SCA Auditor Registration Requirements
• International Financial Reporting Standards (IFRS)
• International Standards on Auditing (ISA)

What Qualifications Must an Auditor Have to Audit a Listed Company?

An auditor must be registered on the SCA's approved auditor list to audit a listed company. The SCA requires the audit firm to hold a valid UAE audit license, have at least one partner with a recognized professional qualification (CPA, CA, ACCA Fellow), demonstrate experience in auditing listed entities, maintain professional indemnity insurance, comply with ISQM 1 quality management standards, and pass the SCA's periodic quality review. Individual audit partners must also meet specific experience thresholds.

Big Four vs. mid-tier firms:

All Big Four firms (Deloitte, PwC, EY, KPMG) are registered with the SCA and audit the majority of DFM and ADX listed companies. However, several mid-tier firms also hold SCA registration and handle listed audits — particularly for smaller-cap companies. The choice between Big Four and mid-tier often comes down to cost, sector expertise, and analyst/investor expectations.

Disqualifying factors:

• The auditor has provided non-audit services to the company that impair independence
• The engagement partner has served for more than the allowed rotation period
• The auditor has a financial interest in the company
• The auditor has a close business relationship with company management

What Is the Role of the Audit Committee?

Every listed company must have an audit committee comprising at least three non-executive board members, with a majority being independent directors. The committee chair must be an independent director with financial expertise. The audit committee oversees the external audit relationship, reviews financial statements before board approval, monitors internal controls, assesses risk management systems, and reviews related party transactions. It reports directly to the board and has the authority to recommend the appointment or removal of the external auditor.

Key responsibilities:

1. External auditor oversight: Recommend appointment, assess independence, approve fees, review audit plan, evaluate performance
2. Financial reporting: Review quarterly and annual financial statements before board approval
3. Internal controls: Monitor effectiveness of internal controls and internal audit function
4. Risk management: Review risk assessment processes and significant risk exposures
5. Compliance: Ensure compliance with SCA regulations, IFRS, and other applicable laws
6. Related party transactions: Review and approve related party transactions before execution
7. Whistleblowing: Oversee the company's whistleblowing mechanism

Common governance failures:

• Audit committees that rubber-stamp management's financial statements without substantive review
• Committees lacking members with genuine financial expertise
• Failure to meet privately with the external auditor (without management present)
• Not challenging management on judgmental accounting areas (provisions, impairments, revenue recognition)

What Are the Auditor Rotation Rules?

SCA regulations require mandatory rotation of the audit engagement partner every 3 consecutive years. Additionally, the SCA recommends (and in some cases requires) rotation of the audit firm every 6 years. After rotation, a cooling-off period of 2 years applies before the same partner can re-engage with the company. These rules prevent the development of overly close relationships between auditors and management that could compromise independence and audit quality.

Transition planning:

Auditor rotation requires careful planning. The incoming auditor needs:

• Access to prior year working papers (with outgoing auditor cooperation)
• Understanding of significant accounting policies and judgments
• Awareness of any ongoing regulatory matters
• Introduction to the audit committee and key management personnel

Best practice: Begin the auditor selection process 12 months before the rotation is required. This allows time for proposals, audit committee evaluation, shareholder approval (if required), and a proper transition.

What Financial Reports Must Listed Companies Publish?

Listed companies must publish quarterly unreviewed financial statements (within 45 days of quarter-end), semi-annual reviewed financial statements (within 45 days of half-year), and annual audited financial statements (within 90 days of year-end). All financial statements must comply with IFRS. The annual report must include a corporate governance report, directors' report, audit committee report, and the auditor's report. Publication is through the DFM/ADX disclosure systems and the company's website.

Consequences of late publication:

• SCA administrative fines
• Trading suspension (in severe cases)
• Negative market perception
• Analyst downgrade risk

Practical reality: The 90-day deadline for annual audited financials is tight for complex groups. The audit process must begin well before year-end. Pre-year-end audit procedures (interim testing, controls testing) should be completed by November to allow sufficient time for year-end work.

What Are Key Audit Matters and Why Do They Matter?

Key Audit Matters (KAMs) are those matters that, in the auditor's professional judgment, were of most significance in the audit. ISA 701 requires auditors of listed companies to communicate KAMs in the audit report. Common KAMs for UAE listed companies include impairment of goodwill, expected credit loss provisions, revenue recognition, investment property valuation, and related party transactions. KAMs increase transparency by telling shareholders exactly where the auditor focused attention and why.

Most common KAMs for UAE listed companies (by sector):

How to read KAMs:

1. Read what the matter is and why it was significant
2. Understand the auditor's response (what procedures they performed)
3. Note the auditor's findings and observations
4. Compare KAMs year-over-year — new KAMs signal new risks

KAMs are not qualifications. They do not indicate problems with the financial statements. They indicate areas of complexity and judgment where the auditor applied the most scrutiny.

What Internal Control Requirements Apply to Listed Companies?

SCA regulations require listed companies to maintain effective internal controls over financial reporting. The board must assess the adequacy of internal controls annually and disclose its assessment in the corporate governance report. Listed companies must have an internal audit function (either in-house or outsourced) that reports to the audit committee. The external auditor must report on identified significant deficiencies in internal controls as part of the audit management letter.

Internal control framework requirements:

• Adopt a recognized framework (COSO is most common in the UAE)
• Document key controls over financial reporting
• Test controls periodically through internal audit
• Remediate identified weaknesses within defined timelines
• Report control effectiveness to the audit committee and board

Internal audit requirements:

Interaction between internal and external audit:

The external auditor relies on the internal audit function's work to the extent it is relevant and reliable. Strong internal audit reduces external audit effort (and cost). Weak internal audit increases external audit scope and fees. The external auditor must assess the internal audit function's competence, objectivity, and systematic approach before relying on its work.

How Are Related Party Transactions Audited?

Related party transactions receive heightened scrutiny in listed company audits. The SCA requires all material related party transactions to be disclosed in the financial statements (per IAS 24), approved by the audit committee before execution, conducted at arm's length terms, and disclosed to the market through the DFM/ADX if material. The auditor must specifically evaluate whether related party transactions are properly identified, accounted for, and disclosed — and must assess whether any undisclosed related party relationships exist.

Auditor's procedures for related party transactions:

1. Obtain management's list of related parties and verify completeness
2. Search for undisclosed related parties through public records, board minutes, and shareholder registers
3. Test whether transactions occurred at arm's length pricing
4. Verify audit committee approval was obtained before execution
5. Confirm proper IFRS disclosure (nature, amounts, terms, guarantees)
6. Assess whether transactions distort the financial position or results
7. Report findings to the audit committee

SCA disclosure requirements:

Red flags the auditor watches for:

• Transactions at non-market prices (especially loans at 0% interest)
• Significant balances owed by related parties with no repayment schedule
• Services from related parties without clear contracts
• Round-trip transactions (company pays related party, related party pays back)
• Year-end transactions reversed in the new year

What Happens If a Listed Company Fails to Comply?

Non-compliance with SCA audit requirements triggers a graduated enforcement response. First, the SCA issues a warning requiring corrective action within a specified period. If not remedied, financial penalties follow — ranging from AED 100,000 to AED 10 million depending on severity. For serious violations, the SCA can suspend trading of the company's shares, remove board members, or refer the matter for criminal prosecution. Auditors who fail in their duties face removal from the SCA approved list and potential disciplinary action.

Recent enforcement trends:

The SCA has increased its enforcement activity since 2023. Notable actions include:

• Fines for late financial reporting
• Removal of board members for governance failures
• Requirements for companies to restate financial statements
• Increased scrutiny of auditor quality through inspection programs

Keep Reading

• Audit Requirements for Government Contracts
• AML Audit Requirements in UAE
• Special Purpose Audit Engagements
• Auditor Directory

Frequently Asked Questions

Can a non-Big Four firm audit a DFM or ADX listed company?

Yes. Any firm registered on the SCA approved auditor list can audit a listed company. Several mid-tier firms (BDO, Grant Thornton, Baker Tilly, Crowe, RSM) hold SCA registration and actively audit listed companies. The key requirement is SCA registration and adequate experience, not firm size.

How much does a listed company audit cost in the UAE?

Audit fees vary significantly by company size and complexity. Small-cap listed companies (market cap under AED 500 million) typically pay AED 200,000–500,000 in audit fees. Mid-cap companies pay AED 500,000–2 million. Large-cap companies and financial institutions can pay AED 2–10 million or more. Fees are disclosed in the financial statements.

Does the SCA require listed companies to adopt ESG reporting?

The SCA has been progressively encouraging ESG and sustainability reporting. While comprehensive ESG reporting is not yet mandatory for all listed companies, the SCA's governance rules require disclosure of environmental and social practices. Several listed companies voluntarily publish sustainability reports aligned with GRI or SASB standards.

What happens if the auditor issues a qualified opinion?

A qualified opinion means the auditor found a material but not pervasive misstatement or limitation. The SCA will typically require the company to explain the qualification, present a remediation plan, and resolve the underlying issue. Repeated qualifications trigger enhanced regulatory scrutiny and can affect investor confidence and share price.

Can shareholders request a change of auditor?

Yes. Shareholders can vote on the appointment and removal of the external auditor at the annual general meeting (AGM). The audit committee recommends the auditor, but shareholder approval is required. Shareholders holding at least 5% of shares can typically request a special general meeting to address auditor concerns.

Find an Auditor in Dubai →