Re-test, closure, or escalation to the audit committee.
Inputs and outputs
Inputs
Process maps, SOPs, organisation chart, delegations of authority
System extracts (ERP, payroll, vendor master)
Prior IA reports and open recommendations
Risk register and board / audit-committee minutes
Outputs
Annual IA plan and risk universe
Control test programmes by cycle
Five-column findings register, severity-rated
Audit-committee paper, board-ready
Case study
Family-owned manufacturing group · procurement & payables
A 40-year-old industrial group commissions an internal audit of its procurement and payables cycle following a near-miss vendor fraud (an attempt to create a phantom supplier with the same beneficial owner as a procurement manager).
The Internal Audit agent drafts a 14-step test programme over a single afternoon, runs the analytical procedures on the AP master file and three months of disbursements, and identifies four material control gaps:
No three-way match enforced for purchases below AED 50,000 — 31% of total spend.
Single approver for vendor master updates; no maker/checker.
No segregation between PO creation and goods-receipt entry — same user IDs in 64 cases.
Dormant vendor accounts not deactivated; 197 vendors with no transactions in 18 months remain active.
Outcome: a board-ready report in three working days instead of two weeks. The family adopts all four recommendations within the next quarter and the group's external auditor reduces planned substantive testing on procurement, saving an additional c. AED 35,000 in audit fees.
UAE regulations enforced
Companies Law — Federal Decree-Law 32 of 2021 (board duties, internal controls).
AML / CFT — Federal Decree-Law 20 of 2018 (DNFBP supply-chain controls).
UAE PDPL — Federal Decree-Law 45 of 2021 (HR & vendor personal data).
IIA Standards — referenced framework for IA performance and reporting.
Escalation triggers
Fraud indicator or whistleblower allegation.
Control failure with quantified loss greater than AED 100,000.
Sanctions or PEP exposure in the supply chain.
Management refusal to remediate a critical-severity finding.
Conflict of interest between the client's IA function and the firm's external audit role.