Enhanced ICOFR Requirements Expected to Influence Market Confidence and Global Investment Appetite

In a significant move to elevate corporate governance and risk oversight standards across the UAE capital markets, the Securities and Commodities Authority (SCA) issued a comprehensive circular introducing enhanced obligations related to Internal Control and Risk Management Frameworks for Public Joint Stock Companies (PJSCs). The move, anchored in the global COSO framework and rooted in the SCA’s recent amendment to Article 14(7) of its Corporate Governance Guide (Decision No. 3/R.M of 2020), signals a decisive shift in how financial reporting controls and audit expectations are regulated in the UAE.

A. Summary of the New Circular’s Requirements

The circular, formally referencing Ref. 2025/1892/X/VA, introduces a multi-pronged governance obligation with a clear focus on Internal Control Over Financial Reporting (ICOFR). It outlines five critical dimensions that every listed PJSC must comply with:

1. Development of a Risk-Based Internal Control Framework

Companies must implement a robust internal control and risk management system, aligned with international standards (notably the COSO Framework), covering identification, assessment, monitoring, and reporting of material risks—both at the holding company and subsidiary level.

2. Three Lines of Defence Architecture

The organizational structure should reflect an integrated model involving first-line operational controls, second-line compliance and risk functions, and third-line independent assurance via internal audit.

3. Information Reporting & Control Mechanisms

Internal data must be timely, accurate, and governed by controls ensuring the availability of reliable reporting for management and board oversight.

4. Evaluation and Oversight by the Board

The board bears ultimate responsibility, despite delegation to senior management, for ensuring systems are not only in place but also periodically reviewed and corrected as necessary.

5. External Auditor Enablement

Boards must enable the company’s auditor to express a formal opinion on the effectiveness of internal controls and risk management systems, including ICOFR.

Additionally, an amendment to Article 73 of the Corporate Governance Regulations now expressly allows external auditors to issue a separate report providing an opinion on internal control effectiveness, thus formalizing audit involvement in governance assurance.

Implementation in Two Stages

The SCA has thoughtfully divided implementation into two phases:

Stage One (FY 2024)

Companies must perform a self-assessment of their internal control systems. The external auditor must review (but not audit) the company’s ICOFR processes and issue a private report, not subject to market disclosure.

Stage Two (FY 2025)

The auditor must conduct a full audit of the ICOFR framework and issue a publicly disclosed report identifying any deficiencies and required remedial actions.
This places the UAE among the few regional markets requiring a publicly disclosed audit opinion on internal controls—a standard typically associated with mature jurisdictions such as the U.S. (SOX-404) and select EU markets.

B. Impact on Publicly Listed Companies in the UAE

The circular represents one of the most consequential enhancements to the UAE’s corporate governance landscape since the introduction of the 2020 Governance Guide. The implications for PJSCs are wide-ranging:

• Board-Level Accountability: Boards must now oversee, evaluate, and ensure effective internal controls; no longer a compliance formality.

• Audit Committee Reinforcement: Committees must expand oversight to cover ICOFR implementation, auditor coordination, and remediation tracking.

• Increased Compliance Costs: Particularly for mid-sized or newly listed PJSCs with limited free float. Costs may include documentation, technology, and advisory engagements.

• Disclosure Risk: From FY 2025, externally reported ICOFR deficiencies can pose reputational risk, raising the bar for ERP readiness and risk function maturity.

• Audit Market Dynamics: Auditors may enhance testing scope, adjust engagement terms, and revise fee structures due to expanded responsibility.

While these changes require investment, they ultimately strengthen market credibility and investor protection—particularly following global scandals tied to internal control failures.

C. Implications for Foreign Investors and International Funds

From a global investment perspective, the SCA’s circular signals strong alignment with international governance and reporting standards. This is likely to be well received by:

• Sovereign wealth funds and institutional investors incorporating ESG and governance risk into asset screening.

• Global asset managers who evaluate exposure in emerging markets via internal control robustness.

• Rating agencies, for whom control environment quality affects credit ratings.

• Cross-listed or dual-listed companies, which now benefit from clearer UAE-side compliance mechanisms consistent with developed markets.

However, there may be short-term hesitation if PJSCs report material control deficiencies in FY 2025. This makes 2024 a critical preparation year—not just for compliance, but also for demonstrating control enhancement to stakeholders.

Connecting to Article 14(7) of the Corporate Governance Regulations

The legal foundation of the circular lies in the recent amendment to Article 14(7) of the SCA’s Corporate Governance Regulations (Decision No. 3/R.M of 2020), which now reads:

“Developing, defining and approving the appropriate internal control and risk management framework for the company’s work in line with global practices (COSO), and ensuring its implementation.”

The updated article reinforces that the board, not management, carries ultimate responsibility for ensuring that a globally recognised, effective, and auditable framework governs the company's internal control environment. The January 2025 circular operationalises this principle, transforming a previously generic board duty into a tested and publicly reported compliance obligation.

The updated article reinforces that the board, not management, has ultimate responsibility for ensuring a globally recognised, effective, and auditable internal control framework. The January 2025 circular operationalises this responsibility, turning a previously general board duty into a tested and publicly reported compliance obligation.

Conclusion

With this circular, the SCA is not merely refining regulations—it is redefining corporate accountability in the UAE. PJSCs must now swiftly assess and upgrade their risk and control frameworks, train boards and audit committees, and engage audit partners with proven ICOFR capabilities.

For forward-looking companies, the circular presents an opportunity to strengthen stakeholder trust and prepare for future international exposure. For others, it is a wake-up call that internal controls are no longer a backend process, but a board-level priority with public consequences.

The year 2024 is the rehearsal. The curtain rises in 2025.