News & updates

Enhanced ICOFR Requirements Expected to Influence Market Confidence and Global Investment Appetite – UAE’s Securities Regulator Sets Benchmark for Corporate Governance and Internal Controls in Listed Companies

In a significant move to elevate corporate governance and risk oversight standards across the UAE capital markets, the Securities and Commodities Authority (SCA) issued a comprehensive circular introducing enhanced obligations related to Internal Control and Risk Management Frameworks for Public Joint Stock Companies (PJSCs). The move, anchored in the global COSO framework and rooted in the SCA’s recent amendment to Article 14(7) of its Corporate Governance Guide (Decision No. 3/R.M of 2020), signals a decisive shift in how financial reporting controls and audit expectations are regulated in the UAE.

A. Summary of the New Circular’s Requirements

The circular, formally referencing Ref. 2025/1892/X/VA, introduces a multi-pronged governance obligation with a clear focus on Internal Control Over Financial Reporting (ICOFR). It outlines five critical dimensions that every listed PJSC must comply with:

1. Development of a Risk-Based Internal Control Framework:

Companies must implement a robust internal control and risk management system, aligned with international standards (notably the COSO Framework), covering identification, assessment, monitoring, and reporting of material risks—both at the holding company and subsidiary level.

2. Three Lines of Defence Architecture:

The organizational structure should reflect an integrated model involving first-line operational controls, second-line compliance and risk functions, and third-line independent assurance via internal audit.

3. Information Reporting & Control Mechanisms:

Internal data must be timely, accurate, and governed by controls ensuring the availability of reliable reporting for management and board oversight.

4. Evaluation and Oversight by the Board:

The board bears ultimate responsibility, despite delegation to senior management, for ensuring systems are not only in place but also periodically reviewed and corrected as necessary.

5. External Auditor Enablement:

Perhaps most notably, the board must enable the company’s auditor to express a formal opinion on the effectiveness of the internal control and risk management systems, including ICOFR.

Additionally, an amendment to Article 73 of the Corporate Governance Regulations now expressly allows external auditors to issue a separate report providing an opinion on the effectiveness of internal controls, thus formalising audit involvement in governance assurance.

Implementation in Two Stages

The SCA has thoughtfully divided implementation into two phases:

• Stage One (FY 2024): Companies must perform a self-assessment of their internal control systems. The external auditor must review (but not audit) the company’s ICOFR processes and issue a private report, not subject to market disclosure.
• Stage Two (FY 2025): The auditor must conduct a full audit of the ICOFR framework and issue a publicly disclosed report, identifying any deficiencies and required remedial actions. This makes the UAE one of the few markets in the region to require a disclosed audit opinion on internal controls, a standard largely associated with mature capital markets such as the U.S. (under SOX 404) and select EU jurisdictions.

B. Impact on Publicly Listed Companies in the UAE

The circular represents one of the most consequential enhancements to the UAE’s corporate governance landscape since the introduction of the 2020 Governance Guide. The implications for PJSCs are wide-ranging:

• Board-Level Accountability: Boards can no longer treat internal control as a compliance formality. The obligation to oversee, evaluate, and ensure implementation of effective controls is now statutory.
• Audit Committee Reinforcement: The role of audit committees will necessarily expand to oversee ICOFR implementation, auditor coordination, and remediation tracking. Many boards may need to reassess committee composition and skills.
• Increased Compliance Costs: Companies, particularly mid-sized and newly listed PJSCs, or those with limited free float, will face additional compliance burdens, ranging from control documentation to technology upgrades and external advisory engagement.
• Disclosure Risk: Starting FY 2025, companies will be exposed to reputational risk if auditors report ICOFR deficiencies in public reports. This raises the bar for internal audit maturity, ERP integration, and risk function effectiveness.
• Audit Market Dynamics: External auditors may revise engagement terms, expand internal control testing scope, and revisit fee structures in light of enhanced responsibilities and disclosure risks.

While these changes require significant investment, they also strengthen market credibility and investor protection, especially in the aftermath of global scandals linked to internal control failures.

C. Implications for Foreign Investors and International Funds

From a global investment perspective, the SCA’s circular sends a strong signal of alignment with international governance and financial reporting standards. This development is likely to be well received by:

• Sovereign wealth funds and institutional investors, who increasingly incorporate ESG and governance risk in their investment filters.
• Global asset managers, who often rely on the strength of internal control environments when evaluating exposure in emerging markets.
• Rating agencies, for whom control environment robustness is a factor in corporate and sovereign ratings.
• Cross-listed or dual-listed companies, who now benefit from clearer UAE-side compliance mechanisms that are consistent with those in developed markets.
• However, there may also be short-term hesitation among foreign investors if PJSCs begin to report deficiencies in FY 2025. This places pressure on companies to use 2024 as a true preparation year, not merely for compliance, but for communicating control improvements to stakeholders.

Connecting to Article 14(7) of the Corporate Governance Regulations

The legal foundation of the circular lies in the recent amendment to Article 14(7) of the SCA’s Corporate Governance Regulations (Decision No. 3/R.M of 2020), which now reads:

“Developing, defining and approving the appropriate internal control and risk management framework for the company’s work in line with global practices (COSO), and ensuring its implementation.”

The updated article reinforces that the board, not management, carries ultimate responsibility for ensuring that a globally recognized, effective, and auditable framework governs the company’s internal control environment. The January 2025 circular operationalises this principle, transforming a previously generic board duty into a tested and publicly reported compliance obligation.

Conclusion

With this circular, the SCA is not merely refining regulations, it is redefining corporate accountability in the UAE. PJSCs must now move swiftly to assess and upgrade their risk and control frameworks, train boards and audit committees, and engage audit partners with proven ICOFR capabilities.

For forward-looking companies, the circular presents an opportunity to deepen stakeholder trust and prepare for future international exposure. For others, it is a wake-up call that internal controls are no longer a backend process, but a board-level priority with public consequences.

The year 2024 is the rehearsal. The curtain rises in 2025.

By:

Ahmed Ibrahim

Managing Partner

IN’P IBRAHIM .N. PARTNERS