Statutory Audit vs Internal Audit vs External Audit: What’s the Difference?

Statutory audit, external audit and internal audit are often used as if they mean the same thing. They do not. Two of them overlap, and one is a completely different function. The short version:

• A statutory audit is an audit the law requires you to have.
• An external audit is any audit carried out by an independent firm from outside the company. Every statutory audit is an external audit, but not every external audit is statutory.
• An internal audit is a review of the company’s own risks and controls, done for management and the board. It does not replace a statutory audit and cannot produce one.

This guide explains each one, what it is used for in the UAE, and how to tell which ones your company needs.

What Is a Statutory Audit?

A statutory audit is an audit of a company’s annual financial statements that is required by law or by the company’s licensing authority. The auditor examines the financial statements and issues an independent opinion on whether they give a true and fair view in line with International Financial Reporting Standards (IFRS).

In the UAE, the requirement comes from three places:

• Company law. The Commercial Companies Law (Federal Decree-Law No. 32 of 2021) requires limited liability companies and joint stock companies on the mainland to appoint an auditor every year.
• Free zone rules. Most free zones, including DMCC, JAFZA and DAFZA, require audited financial statements every year, usually as a condition of licence renewal. Many also require the auditor to be on the zone’s approved list.
• Corporate Tax. Under Ministerial Decision No. 84 of 2025, audited financial statements are required for businesses with revenue above AED 50 million, for every Qualifying Free Zone Person regardless of revenue, and for every Tax Group.

Only an auditor licensed by the Ministry of Economy can sign a statutory audit report, and in many free zones the auditor must also be approved by that zone. The result is a signed audit report attached to the financial statements, which the company submits to its licensing authority and uses for banks, Corporate Tax and other formal purposes.

What Is an External Audit?

An external audit is an audit performed by an independent audit firm that is not part of the company. The firm reports on information prepared by management, most often the annual financial statements, and its value comes from that independence.

A statutory audit is the most common type of external audit, but companies also commission external audits when no law requires one:

• Bank and lender requests. A bank may require audited accounts before approving or renewing a facility, even for a company below every legal threshold.
• Investors and buyers. Shareholders, investors or a potential buyer may want audited figures before investing or acquiring.
• Group reporting. A foreign parent company may need its UAE subsidiary audited for consolidation.
• Special purpose audits. Audits of specific balances, projects, grants or statements, prepared for a particular user.

External auditors work under International Standards on Auditing (ISA). They plan the audit around the risk of material misstatement, test balances and transactions, obtain confirmations from third parties such as banks, and issue an opinion. Their report goes to the shareholders and to whoever relies on the financial statements, not to management alone.

What Is an Internal Audit?

Internal audit is an assurance and advisory function that looks inside the business. It assesses whether risks are identified and managed, whether internal controls work as intended, and whether governance processes are effective. It is forward-looking: its job is to find weaknesses before they become losses, errors or fraud.

Internal audit can be run by the company’s own internal audit team, or outsourced or co-sourced to an external firm. Even when it is outsourced, it remains an internal function, because it works for the company’s management and board and its scope is set by them.

Typical internal audit work includes:

• Testing controls over purchasing, payments, payroll, inventory and cash
• Reviewing compliance with company policies and with regulations such as AML, VAT and labour law
• Assessing IT controls, data access and segregation of duties
• Investigating suspected fraud or control failures
• Recommending process improvements and following up on whether they were implemented

Internal auditors generally follow the Institute of Internal Auditors’ Global Internal Audit Standards. They report to the board or its audit committee, ideally with direct access to it so that management cannot filter the findings.

Internal audit is voluntary for most private companies. It is expected or required for listed companies and for regulated sectors such as banking and insurance, where regulators set governance and internal control rules.

Statutory vs External vs Internal Audit: Key Differences

Point of difference	Statutory audit	External audit (non-statutory)	Internal audit
Why it happens	Required by law, the licensing authority or Corporate Tax rules	Requested by a bank, investor, buyer, parent company or management	Chosen by the board or required by a sector regulator
Main purpose	Independent opinion on the annual financial statements	Independent assurance for a specific user or purpose	Improve risk management, controls and governance
Who performs it	Independent audit firm licensed by the Ministry of Economy, and approved by the free zone where required	Independent audit firm	In-house team, or an outsourced or co-sourced provider
Independence	Must be independent of the company	Must be independent of the company	Independent of the areas it reviews, but works for the company
Reports to	Shareholders, and filed with the authority	Shareholders or the party that requested it	Board or audit committee, and management
Standards	ISA for the audit, IFRS for the financial statements	ISA, or the relevant standard for the engagement	IIA Global Internal Audit Standards
Scope	Set by law and auditing standards	Set by the engagement and its purpose	Set by the board, based on the company’s risks
Timing	Once a year, after the financial year end	When needed	Throughout the year, based on an audit plan
Output	Signed audit report with an opinion	Audit report or agreed-upon findings	Internal reports with findings and recommendations
Who relies on it	Authorities, FTA, banks, shareholders, investors	The bank, investor, buyer or parent that asked for it	Board, audit committee and management

How Statutory and External Audits Relate

The relationship is simple once you separate the reason for the audit from the person doing it:

• “External” describes who performs the audit: an independent firm from outside the company.
• “Statutory” describes why it happens: because a law or authority requires it.

So a DMCC company’s annual audit is both external and statutory. A company below every legal threshold that has its accounts audited because its bank asked is having an external audit that is not statutory. The audit work can be almost identical. What changes is who requires it and who receives the report.

How Internal Audit Differs From Both

The difference is not just who does the work. Internal and external audits answer different questions.

• External and statutory audits ask: are these financial statements free from material misstatement? They look backwards at a completed year and focus on the numbers.
• Internal audit asks: are our risks under control, and will our processes keep working? It looks at how the business runs day to day, including areas that never appear as a number in the accounts, such as access controls, approval limits or regulatory compliance.

A company can have a clean audit opinion and still have weak controls, because the external auditor only needs enough evidence to support an opinion on the financial statements as a whole. Equally, a strong internal audit function does not satisfy any legal audit requirement. The two work best together: external auditors can review internal audit’s work when planning their own audit, and internal audit’s findings often fix the issues that would otherwise appear as audit adjustments.

Which Audit Does Your Company Need?

Your situation	What you need
Mainland LLC or joint stock company	Statutory audit every year
Free zone company (DMCC, JAFZA, DAFZA and most others)	Statutory audit every year, usually by an auditor approved by the zone
Qualifying Free Zone Person, Tax Group, or revenue above AED 50 million	Audited financial statements for Corporate Tax, in addition to any licence requirement
Company below legal thresholds, but a bank or investor asks for audited accounts	External audit (non-statutory)
Growing company with several locations, high transaction volume or past control failures	Internal audit, alongside the statutory audit
Listed company, bank, insurer or other regulated entity	Statutory audit plus an internal audit function, as the regulator requires

If you are unsure, start with the legal question: does your licence, your company type or your Corporate Tax position require audited financial statements? If yes, you need a statutory audit. Internal audit is then a decision about how much control and risk assurance the board wants.

Can the Same Firm Do Your External and Internal Audit?

Not for the same client in the same period without careful limits. Auditor independence rules, based on the IESBA Code of Ethics, restrict an external auditor from providing internal audit services to its audit client, because the auditor would end up reviewing its own work. For listed companies and other public interest entities, it is generally prohibited.

In practice, a company that wants both should appoint one firm as its external auditor and use its own team or a different provider for internal audit. The same principle applies to bookkeeping: the firm that audits your financial statements should not also prepare them.

Common Misunderstandings

• “Our internal auditor can sign the annual audit.” No. Only an independent, licensed external auditor can issue a statutory audit report.
• “An audit finds all fraud.” No. A statutory audit gives reasonable assurance that the financial statements are free from material misstatement. It is not designed to detect every fraud. Fraud investigations are a separate engagement, such as a forensic audit.
• “Small companies never need an audit.” Not in the UAE. Company type and licence rules apply regardless of size, and every Qualifying Free Zone Person needs audited statements for Corporate Tax whatever its revenue.
• “Internal audit is only for large companies.” It is most common there, but outsourced internal audit lets smaller companies test their key controls without hiring a full team.

Choosing the Right Audit Partner

Whichever audit you need, check three things before you appoint a firm: that it is licensed by the Ministry of Economy, that it is on your free zone’s approved auditors list if you are in a free zone, and that it is independent of anyone who prepares your accounts. For annual statutory and bank-required audits, work with an established firm offering external audit services for both mainland and free zone companies. If you are comparing firms, our list of trusted auditors in Dubai is a good place to start.