BSRS & Associates is the internal audit and compliance partner for UAE companies. We audit your controls, write the policies and procedures that fix the gaps, put the protocols in place, and stay on as your advisor so you remain compliant as rules change.
Run your full internal audit function, support an in-house team on specialist areas, or take a single targeted review. Every engagement is scoped to your risk register, not a standard checklist.
A complete function reporting to your audit committee, or specialists alongside your team.
Independent testing against the rules your regulator will inspect you on.
Programme reviews for financial institutions and designated non-financial businesses.
Control reviews that keep filings defensible before the FTA asks questions.
Design, document and test the controls behind your financial statements.
A risk framework your management actually uses to make decisions.
General IT controls, ERP access and data protection reviews.
Fact-finding when something has gone wrong, and controls so it doesn't again.
An audit tells you where the gaps are. BSRS also stays to close them: we write the policies, build the procedures, train your people and run the compliance calendar with you, year after year.
Map every obligation from your licence, regulator and UAE law against what you do today.
Obligations registerBoard-approved policies and step-by-step procedures written for your business and systems.
Policy manual & SOPsConfigure controls, screening, approval workflows and records so the policies work in daily operations.
Live controls & templatesRole-based training for the board, management and staff, with attendance records for your regulator.
Training logMonthly monitoring, regulatory change alerts, filing calendar and board compliance reports.
Quarterly board reportDrafted to UAE requirements and tailored to your operations. Each comes with procedures, forms and an implementation checklist.
For new licences, new markets or a first regulatory inspection.
A named BSRS advisor working as an extension of your team.
For firms that need a compliance officer or MLRO support.
A typical process audit takes four to six weeks from kick-off to final report. You know the scope, team and fee before we start.
A free discovery session under mutual NDA. We look at your business, regulators and risk register, then agree objectives and a fixed fee. Nothing is billed before you sign off the scope.
Walkthroughs with process owners to map risks and key controls.
Control testing, sampling and data analytics on full populations where possible.
Rated findings with agreed management actions, owners and dates. Closing meeting with leadership.
We re-test each action on its due date and report closure status to the audit committee.
Every finding follows the same structure, so directors can read twenty of them in ten minutes and know exactly what to ask.
What we found, with the numbers: how many, how much, how often.
The policy, law or standard it was tested against.
Why it happened, whether people, process or system.
The financial, regulatory or reputational exposure in AED terms where possible.
An agreed fix with a named owner and a due date we will re-test.
Illustrative figures showing the report format.
The laws and regulators our compliance reviews most often test against.
| Area | Key requirement | How we help |
|---|---|---|
| AML/CFT | Federal Decree-Law No. 20 of 2018 and its implementing regulations · goAML | Risk assessment, KYC file testing, independent AML audit |
| Corporate Tax | Federal Decree-Law No. 47 of 2022 · return due 9 months after year end | Tax control framework, filing readiness, TP documentation |
| VAT | Federal Decree-Law No. 8 of 2017 · returns due 28 days after period | Return reviews, input tax recovery testing |
| Data protection | Federal Decree-Law No. 45 of 2021 (PDPL), DIFC and ADGM data laws | Data mapping, privacy controls, gap assessment |
| Beneficial ownership | Cabinet Decision No. 58 of 2020 · updates within 15 days | UBO register review and governance checks |
| Financial regulators | CBUAE, DFSA (DIFC), FSRA (ADGM), VARA, SCA rulebooks | Compliance monitoring, internal audit for regulated firms |
The partner who scopes your engagement attends walkthroughs, reviews every working paper and presents to your board. No hand-off to a rotating junior team.
When we help design your policies and controls, a different BSRS team performs the independent review, so you get a partner and an objective audit without a conflict.
Discovery is free and covered by an NDA. You then receive a scoping proposal within two business days with a fixed fee per audit, and no open-ended hourly billing.
What a mid-sized UAE group typically gets from each option.
| Building in-house | BSRS outsourced | BSRS co-sourced | |
|---|---|---|---|
| Time to first audit | 4–6 months to recruit | 4–6 weeks | 2–4 weeks |
| Specialists (IT, AML, tax) | Hired separately or missing | Included as needed | On call for your team |
| Independence from management | Reports up through the organisation | External and objective | External review of key areas |
| Cost profile | Fixed salaries, visas, training | Fixed annual retainer | Pay per engagement |
| Best suited to | Large groups with steady audit volume | Groups with no IA function today | Groups with a small IA team |
Six questions. Your answers stay on this page.
Not for every company. It is expected or required for many regulated entities, such as banks and finance companies, listed companies and firms supervised by the DFSA or FSRA. Many private groups adopt it anyway because lenders, investors and boards ask for independent assurance.
External audit gives an opinion on your financial statements for shareholders. Internal audit reports to management and the board on whether risks are controlled across operations, compliance and finance, and recommends improvements.
Outsourcing gives you a full team of specialists without permanent headcount, and independence from the functions being audited. Co-sourcing suits companies with a small in-house team that needs IT, AML or tax specialists for specific reviews.
Yes, with safeguards. Under the IIA Standards, people who designed a control should not audit it. We assign separate teams to advisory and assurance work, and the audit report states this so your board and regulator can rely on it.
Most new licensees start with our compliance set-up project: a gap assessment against the licence conditions, a policy manual and procedures, implementation of screening and record-keeping, and staff training. Many then move to a monthly retainer for ongoing support.
We quote a fixed fee per audit area based on the size of the process, number of locations and the testing required. An annual plan is priced as a retainer with quarterly reporting included.
Yes. We serve clients across all seven emirates, including mainland, free zone, DIFC and ADGM entities, and support group audits in other GCC countries.
Short, practical notes on UAE regulation and control practice.
Where tax data breaks between the ERP and the return, and how to evidence the fix.
Coming soonMoving beyond policy review to sample-testing KYC files, screening hits and goAML reporting.
Coming soonA first-year plan for groups that have never had an audit committee.
Coming soonA partner will reply within one business day to arrange a scoping call.
