ICFR requirements for DFM/ADX listed companies UAE

ICFR requirements for DFM/ADX listed companies in the UAE focus on a straightforward question: can the company demonstrate that its financial reporting controls work? For in-scope public joint stock companies, this involves a documented framework, management assessment, corrective action and external assurance under the applicable governance requirements.

A clean financial statement audit isn't, by itself, proof of effective ICFR. The controls need their own assessment.

What Is ICFR?

Internal Control over Financial Reporting (ICFR), also called ICOFR, concerns controls supporting reliable financial statements. It addresses risks such as incomplete revenue, unsupported journal entries, incorrect valuations and missing disclosures.

Think about a monthly reconciliation. Preparing it is one control; reviewing differences, investigating exceptions and retaining evidence are equally important. A signed cover sheet tells you little if nobody examined the underlying balances.

Which UAE Requirements Apply?

The starting point is the Governance Guide for Public Joint Stock Companies, issued under Decision No. 3/R.M of 2020, as amended. Article 14(7) addresses the board's responsibility for the internal control and risk management framework, including effectiveness assessment and corrective action.

Older material refers to the Securities and Commodities Authority (SCA). Since 1 January 2026, its legal successor is the Capital Market Authority (CMA).

For companies on Dubai Financial Market (DFM) or Abu Dhabi Securities Exchange (ADX), applicability needs checking against legal form, regulatory status and relevant exclusions. Don't assume every listed issuer has identical obligations. Foreign issuers, private joint stock companies and free zone issuers require particular attention to the applicable scope.

What Is the ICFR Reporting Timeline?

The November 2025 circular extended the transition timetable. Published explanations describe these stages:

These stages reflect published summaries of the circular. Confirm the current circular, reporting period and company-specific directions with the appointed auditor before fixing deliverables. An extension to public reporting doesn't mean controls can wait.

Who Owns ICFR Compliance?

The board approves the framework and retains oversight. Management implements the controls, evaluates their effectiveness and addresses weaknesses.

The audit committee should challenge the assessment, review significant findings and monitor remediation. Internal audit can provide independent assurance within its mandate. The external auditor performs the separately agreed assurance work.

These responsibilities connect, but they aren't interchangeable.

Here's the practical concern: appointing a consultant doesn't transfer management's ownership of the numbers or the control assessment.

How Should Companies Build Their ICFR Framework?

1. Define Scope Around Financial Reporting Risk

Identify significant accounts, disclosures, entities, locations and supporting systems. Consider materiality, complexity, fraud exposure and judgement—not just transaction volume.

Revenue recognition, impairment and consolidation may deserve closer attention even where transaction numbers are low.

2. Document Processes and Key Controls

Develop process narratives, flowcharts where useful, and a risk and control matrix (RCM). Each key control should identify its owner, frequency, purpose and retained evidence.

Descriptions need precision. “Finance reviews payments” leaves too much unanswered. Who reviews them, against what documents, and how are exceptions resolved?

3. Use a Coherent Control Framework

COSO provides five connected components: control environment, risk assessment, control activities, information and communication, and monitoring activities. Its framework contains 17 principles.

A company needs more than transaction approvals. Governance, competence, reliable information and deficiency reporting also influence whether controls operate effectively.

4. Test Design and Operating Effectiveness

Design testing asks whether a control could address the identified risk. Operating effectiveness testing asks whether it actually worked during the period assessed.

Walkthroughs, inspection, observation and reperformance can support the work. Enquiry alone rarely provides convincing evidence that a recurring control operated consistently.

5. Remediate and Retest Weaknesses

Assign an owner and target date to each finding. Evaluate its financial reporting implications and consider whether other controls compensate.

Then retest. Updating a procedure doesn't establish that the revised control has operated successfully.

Why Do IT Controls Matter?

Financial reporting depends on systems. Access rights, privileged users, programme changes and automated calculations can affect the reliability of accounting data.

Include relevant IT general controls (ITGC), interfaces, system-generated reports and critical spreadsheets in the assessment. If management relies on an ERP report, establish whether its inputs, logic and completeness can be trusted.

How ASC Global UAE Can Help

ASC Global UAE can support UAE-listed companies with ICFR readiness and implementation, tailored to their reporting structure and applicable requirements.

Support can include:

• Applicability reviews and implementation roadmaps.

• COSO framework mapping and process documentation.

• RCM development and identification of key controls.

• Design and operating effectiveness testing.

• ITGC assessment and spreadsheet control reviews.

• Remediation tracking and management reporting.

• Evidence preparation and coordination with external auditors.

Discuss your ICFR requirements with ASC Global UAE to establish clear responsibilities, realistic milestones and a defensible assessment process. Management retains ownership, while external assurance remains the appointed auditor's responsibility.

Frequently Asked Questions

Is ICFR the Same as Internal Audit?

No. ICFR focuses on reliable financial reporting. Internal audit has a broader assurance mandate that may include financial, operational and compliance risks.

Does a Financial Statement Audit Replace ICFR Assessment?

No. An opinion on financial statements and an opinion on control effectiveness address different matters. Agree the required ICFR assurance scope separately.

Should Subsidiaries Be Included?

Assess subsidiaries through group financial reporting risks and materiality. Any permitted temporary exclusion needs a valid basis and the required disclosure.

When Should ICFR Preparation Begin?

Start before year-end. Documentation, remediation and evidence of recurring control operation take time; they can't reliably be reconstructed during the reporting deadline rush.