The Internal Audit Regulations for the Entities Subject to the Mandate of Abu Dhabi Accountability Authority

Article-level navigation isn't available for this document — showing the full text as extracted.

The Internal Audit Regulations for the
Entities Subject to the Mandate of Abu
Dhabi Accountability Authority
August 2021

Page 2 of 17
Table of Contents
Article (1) Definitions 3
Article (2) Objectives 5
Article (3) Approved Principles and Standards 5
Article (4) Scope and Date of implementation 6
Article (5) Internal Audit Guide 6
Article (6) Internal Audit Strategy 7
Article (7) Internal Audit Plan 8
Article (8) Consultation services 10
Article (9) Periodic Reports 10
Article (10) Coordinating with confirmation services Coordinators 12
Article (11) Independency of the internal audit services providers 13
Article (12) Confidentiality of Information 13
Article (13) Reporting the violations 14
Article (14) Disclosure, and the Conflict of Interest 14
Article (15) Responsibilities of the internal audit unit towards ADAA 15
Article (16) Executing the tasks assigned by ADAA to the internal audit unit 15
Article (17) ADAA’s oversight over the work of the internal audit unit 15
Article (18) Development and Emiratization 16
Article (19) Auditors Code of Ethics 16

Page 3 of 17
Article (1)
Definitions
In applying these Rules, the following words and phrases shall bear the meaning listed next to each of them
set forth below, unless the context dictates otherwise:
The Emirate : The Emirate of Abu Dhabi.
The Authority : Abu Dhabi Accountability Authority.
Chairman of The
Authority
: Chairman of Abu Dhabi Accountability Authority.
The Government: : The Government of Abu Dhabi.
The Authority’s
Law, or The Law
: Law No. (19) of 2020 pertaining the Reorganization of Abu Dhabi
Accountability Authority;
The Regulations : The internal audit regulations for the entities subjected to the mandate of
the Authority
Subject Entities; or
entities
: Entities subject to The Authority’s mandate in accordance with the
provisions of The Authority’s Law.
Those Charged with
Governance
: The highest authority responsible for governance in the subject entity, such
as the department head, the board of directors, the board of trustees, the
audit committee, or the like, and is responsible for supervising and directing
the activities of the entity and holding the executive management
accountable in it, in addition to supervising the process of auditing financial
statements and internal audit activities.
The Executive
Management
: The Deputies, General Managers and Executive Managers of subject
entities, and those, whom are responsible for implementing the policies and
procedures aimed at achieving the strategic objectives of the entity.
Internal Audit
Activities
: An independent and objective activity that provides assurances and
advisory services aimed at adding value to the entity, improving its
operations and achieving its objectives through a systematic and structured
approach to assess and improve the effectiveness of governance, risk
management and control processes.
Internal Audit Unit : The organizational unit responsible for the internal audit activity in the
Subject Entity, and whom name may differ from one entity to another. The
unit shall be independent in its activities from the executive management,
and its activities shall be supervised by those responsible for governance.
The executive management hereby shall be committed to supporting the
independency of the unit. Moreover, The executive management shall never
affect nor influence the outcomes of its work.
Internal Auditor : The employee whom is appointed or assigned to manage the internal audit
unit in the subject entity, and his job title may vary from one entity to
another.
Internal Audit
Employee
: The employee of the internal audit unit or the person assigned to carry out
the internal audit tasks in the entity.

Page 4 of 17
Governance : A set of regulations, controls, foundations and procedures that control the
work of the entity and achieve effective control over these works, and
regulate the relationship between the work and the various stakeholders,
and aim to achieve transparency, justice, combat corruption and enable the
entity in achieving its objectives.
The internal control
system
: The regulations adopted by the entity in order to achieve its objectives,
protect its assets, control and review its financial, operational and
administrative activities, and ensure their accuracy and compliance with the
laws and regulations regulating its work.
Oversight : Processes and procedures taken by those responsible for governance in
order to manage risks and ensure that the objectives set by the entity are
achieved effectively and efficiently, issue reliable reports and comply with
the laws, regulations, policies, decisions and circulars issued pursuant to
any of the aforementioned.
Risk Management : Regulated policies and procedures for identifying, analyzing and evaluating
potential risks and events, as well as factors that help mitigate or reduce
their impact to an acceptable level, to insure that they do not impact
negatively on the entity's ability to achieve its objectives. The responsibility
for developing a risk management system rests with the executive
management in the entity.
Financial and
Administrative
Violations
: The financial and administrative violations as stipulated in The Authority’s
Law.
Financial and
Administrative
Corruption
: Any act which is considered a financial or administrative violation in
accordance with the provisions of the Authority’s Law.
Fraud : Any illegal/unlawful act characterized by deception, concealment, or
breach of trust. Such actions are not limited to the cases where threatening
of or use of violence or physical force is present. Fraud is committed by
individuals or institutions with the intent to obtain money, property, or
services, to avoid payments, to avoid losing services, or to secure personal
or commercial benefits for oneself or others.
Conflict of interest : The conflict of interests of the entity’s employees or any other related
parties with the interests of the entity.
The International
Professional
Practices
Framework for
internal Auditing
(IPPF)
: The conceptual framework that organizes authoritative guidance
promulgated by The Internal Auditors Association (IIA).

Page 5 of 17
Article (2)
Objectives
Under these regulations, the internal auditors of the subject entity - whether they are employees of the
internal audit unit or those contracted for internal audit work - shall bear the responsibility of controlling
public funds and verifying the processes of its collection and spending for the designated purposes
efficiently, effectively and economically in a manner that contributes to achieving the entity’s objectives
and preserves the public funds.
In this regard, these regulations shall specify the additional requirements to be implemented by the internal
audit units in the Subject Entities in addition to the standards and principles approved under these
regulations for the implementation of internal audit activities in a manner that ensures the achievement of
the following objectives:
1. Upscaling the quality of the internal audit work in the Subject Entities through setting unified
foundations and regulations based on the best international standards and practices.
2. Establishing a strategic direction for the internal audit units to enhance control over public funds
and contribute to its protection and combating financial and administrative corruption in subject
entities.
3. Enhancing the efficiency and effectiveness of the internal audit activities in controlling the financial
and operational activities of the Subject Entities in a manner that ensures verification of their
efficiency, effectiveness and economy, and ensuring optimal utilization of the resources available
to the entity.
4. Providing a frame of reference that enables internal audit activities to provide objective and
independent value-added assurances and advisory services that contributes to achieving the entity's
strategic objectives.
5. Consolidating the foundations of institutional integrity and discipline and enhancing the efficiency
and effectiveness of governance, risk management and internal control systems in the subject
entities.
Article (3)
Approved Principles and Standards
1. The International Professional Practices Framework for internal Auditing (IPPF) promulgated by
The Internal Auditors Association (IIA) as amended from time to time thereto shall be adopted,
and the internal auditors and those performing internal audit work in Subject Entities must comply
with the requirements of the mandatory elements of this framework, which consist of:
a) The Basic Principles for the Professional Practice of Internal Auditing,

Page 6 of 17
b) The definition of internal audit,
c) Principles of professional code of ethics,
d) International Standards for the Professional Practice of Internal Auditing,
2. The Internal Audit Unit of the Subject Entity must apply the additional requirements specified in
these rules, in addition to the International Professional Practice Framework (IPPF) issued by The
Institute of Internal Auditors (IIA) and any other supplementary requirements issued from time to
time as deemed appropriate by The Authority regardless of how it has been issued or published.
3. The practical and complementary guidelines recommended in The International Professional
Practices Framework (IPPF) serve as an important reference for audit units to be guided by in
applying the mandatory aspects of IPPF and promoting best practices in this field that align with
governance and control systems used in the Entity.
Article (4)
Scope and Date of implementation
1. The provisions of these rules cover all Subject Entities, its employees, and the entities it have
contracted with for internal audit work, without conflicting with relevant laws and regulations that
are in force in this regard.
2. Any other entity may implement these rules, provided that does not entail any statutory or
contractual responsibility on part of The Authority or the government.
3. These rules shall be valid for internal audit activities in Subject Entities from its issuance date,
taking in to consideration relevant laws and regulations as per the Entity’s field of work and its
headquarters location.
Article (5)
Internal Audit Guide
1. The Internal Audit Unit shall develop a manual in which the adopted methodology of internal audit
is clarified, and it outlines the followed policies and procedures that provide a unified operational
framework for internal audit activities and operations. This manual shall be approved by Those
Charged with Governance.

Page 7 of 17
2. The Internal Audit Unit must develop the manual based on the provisions of these rules and any
other principles and standards used by The Authority for internal audit.
3. The internal audit manual should include all tasks and activities carried out by the Internal Audit
Unit.
4. The Internal Audit Unit shall conduct a periodic review for the internal audit manual to update it
as required.
5. Suitable controls shall be put in place to ensure that employees and those responsible of internal
audit work understand and comply with the internal audit manual.
Article (6)
Internal Audit Strategy
The Internal Audit Unit shall develop a strategic plan that aligns with the strategic plan of the Entity and is
subject to the approval of Those Charged with Governance, to include:
a) Vision, mission, and values on the Internal Audit Unit.
b) An analysis of the Internal Audit Unit’s weaknesses and strengths.
c) An analysis of risks and challenges that may encounter the Internal Audit Unit.
d) The alignment between the strategic objectives and initiatives of both the Internal Audit Unit
and the Entity to achieve the role entrusted to the Internal Audit Unit in implementing the
following:
- Monitor the Entity’s financial and operational activities and ensuring its efficiency and
economic effectiveness, as well as the optimal use of available resources at the Entity.
- Contribute to preserving public money and countering financial and administrative
corruption.
e) Internal Audit Unit’s performance indicators in light of the Unit’s strategic objectives and
initiatives.

Page 8 of 17
Article (7)
Internal Audit Plan
1. The Internal Audit Unit is responsible for developing the audit plan and prioritizing internal audit
activities based on a comprehensive assessment of risks that the Entity might face. All in line with
the responsibility of the Subject Entity’s internal auditor to oversee public money and ensure it is
disbursed efficiently as planned to achieve the Entity’s objectives and preserve public money.
2. Prior to developing the audit plan, the Internal Audit Unit must determine the scope of audit work
to include all organizational units within the Entity as well as activities, processes, systems,
projects, and contracts that are subject to audit, in addition to the Entity’s strategic initiatives and
associated programs and plans.
3. The risk level of the activities included in the scope of audit shall be determined according to the
internal audit methodology that is approved by Those Charged with Governance. The Internal
Audit Unit shall also consider the following aspects during the risk assessment process:
a) During the evaluation process, basic information related to the Entity and its activities shall
be collected, and a meeting is held with the executive management to understand the Entity’s
activities and operations, strategic objectives, and surrounding environment. This is in order
to identify the main challenges and risks associated with these activities and operations and
the efficiency of the used controls therein.
b) Financial and operational risks, as well as risks of financial and administrative corruption and
fraud in the Entity shall be assessed, taking into consideration the risks resulting from the
following violations:
- Trespass upon the funds or property of Subject Entities, such as negligence in collection of
revenues, assumption of financial commitments or dispersal of funds without financial
provision, or violation of the quorum or the financial authorities approved by Subject
Entities, or manipulation of Subject Entity’s banking records, or any violation of the
financial system applicable to the Subject Entity and the Emirate.
- Manipulate the Subject Entity procurements, commit fraud in executing its contracts, or
violate any procurement law or regulation applicable to the Subject Entity and the Emirate.
- Any negligence or dereliction of duties that results in direct financial damages to the
Emirate or Subject Entities, or infringes upon any of their financial interests.
- Manipulating the financial statements of the Subject Entity, or any financial reports issued
by it.
- Conflicts of interest, such as the participation or influence of the Chairman of a Subject
Entity, or any of its board members or Employees in a decision making process, wherein
he/she or one of his/her relatives or partners holds a personal interest.

Page 9 of 17
c) After identifying the risks, the Internal Audit Unit shall analyze these risks and determine the
risks inherent in them by evaluating the possibility of their occurrence and consequences or
impact if they do occur. The Unit shall also evaluate the efficiency of set up controls to be
able to identify the remaining risks and determine the risk level of various audit activities.
The internal audit manual must clarify the basis and criteria used in categorizing risks and the
mechanism for determining the risk level therein.
d) The Internal Audit Unit must document the risk assessment process and keep its own risk
records, as it serves as the basis for the risk assessment process in which the risks facing the
Entity’s strategic objectives and operations are described, along with these risks impact,
possibility of occurrence, and the controls used to mitigate their impact.
e) The Internal Audit Unit shall carry out a full evaluation of risks annually.
f) The Internal Audit Unit shall report the results of risk evaluation to Those Charged with
Governance for discussion and approval.
g) The Internal Audit Unit shall regularly update these records and brief Those Charged with
Governance on the main risks facing the Entity.
h) The main goal of the Internal Audit Unit’s risk assessment is to identify audit priorities in a
way that enables the Unit to develop internal audit plans and direct audit tasks to high-risk
activities and processes. However, this does not excuse the executive management of the
Subject Entity from assessing risks and keeping records that enable it to perform its duties
towards risk management.
4. Based on the risk assessment results, the audit plan shall determine audit tasks that will be carried
out during (3) years period. The set plan includes all activities and operations that are subject to
audit within the scope of audit.
5. The audit plan must include the following at minimum:
a) The nature of planned tasks;
b) Brief description of the scope and objectives of tasks;
c) Timing and expected period for tasks;
d) Required resources and expertise to carry out tasks;
e) Risk level of auditing;
f) Basis and standards used to prioritize audit activities

Page 10 of 17
6. The Internal Audit Unit shall conduct a detailed analysis of available resources and expertise and
align them with the audit plan’s requirements, identify differences, and report findings to Those
Charged with Governance to be addressed. The Internal Audit Unit shall clarify the basis and
criteria used to determine required resources and time frames to carry out various audit tasks and
activities.
7. The Internal Audit Unit shall report the results of risk evaluation to Those Charged with
Governance for discussion and approval.
8. The Internal Audit Unit shall regularly review the audit plan and make the necessary changes as
required, given that all changes must be reported to Those Charged with Governance for discussion
and approval.
9. Yearly objectives of the Internal Audit Unit and its employees must align with the implementation
level of the internal audit Plan.
Article (8)
Consultation Services
1. Specific criteria must be developed to be used to determine the acceptance or rejection of
consultation tasks that are requested from the Entity’s internal audit unit. These criteria should
include the following:
a) Evaluate the possible impact of consultation tasks on the independence of internal audit.
b) Evaluate consultation tasks’ impact on the implementation of other audit tasks.
c) The availability of required expertise to carry out these tasks.
2. The Internal Audit Unit must report evaluation results to Those Charged with Governance to
approve the provision of the services.
Article (9)
Periodic Reports
1. The internal audit unit shall send a quarterly report to Those Charged with Governance, to include:
a) A brief of the various types of audit work carried out by the Internal Audit Unit and the level
of completion of the approved audit plan.
b) Main results of the reports issued by the Internal Audit Unit.
c) Analyzing the results of the follow-up work related to the implementation of action plans set
by the Entity’s management to implement the internal audit unit’s recommendations.

Page 11 of 17
d) Issues that have not been addressed by the executive management and led to an unacceptable
level of risk.
e) Any suspected violations, financial and administrative corruption, and fraud.
f) Main risks that the Entity faces in achieving its objectives.
g) The results of the quarterly measurement of performance indicators for the Internal Audit
Unit.
h) Assurance of the independence of the Internal Audit Unit and its employees.
i) Main challenges facing the Internal Audit Unit while performing its work.
j) Any limitations imposed on the scope of work of the Internal Audit Unit and its resources, or
other aspects that may affect its ability to fulfill its responsibilities to the fullest extent, with
an indication of the size of the resulting impact.
k) Cases of conflict of interest identified within the Internal Audit Unit.
l) Other aspects deemed necessary by the Internal Audit Unit to be included in the report.
2. In addition to the aforementioned, the quarterly report of the fourth quarter shall include the
following:
a) The basis and criteria used for the risk assessment process and the audit plan and scope
development.
b) The results of the risk assessment as per the departments, sections, activities, processes, and
programs within the Entity.
c) Risk assessment records for financial and operational activities, as well as risks of financial
and administrative corruption and fraud within the Entity.
d) Yearly audit plan for the next (3) years.
e) Next year’s annual budget to be approved by Those Charged with Governance.
3. The Internal Audit Unit shall submit a yearly report, signed by the internal auditor, to Those
Charged with Governance within the (45) days of the end of each year. It must include the
following:
a) Performance of the Internal Audit Unit, to include:
- Level of achievement of the internal audit strategy.
- Actual level of implementation of the yearly internal audit plan for the previous year.
- Main yearly achievements for internal audit work.
- Consultation services that have been provided.
- Violations and cases of financial and administrative corruption and fraud that have been
identified by the Unit.
- Results of follow-up tasks that have been carried out for previous audit work.
- The Internal Audit Unit’s budget and actual disbursement for the previous year.
b) Evaluation of the internal control and governance systems based on the results of audit
activities that were carried out during the previous year, to include the following:

Page 12 of 17
- Assess the efficiency of the governance system in the Entity.
- Assess the efficiency of the risk management system in the Entity.
- Assess the Entity’s compliance to laws and regulations in force.
- Assess the efficiency of the Entity’s operational processes for the financial and strategic
sides.
Article (10)
Coordinating with confirmation services providers
1. The Internal Audit Unit shall set a mechanism to exchange information and coordinate with
external and internal parties that provide confirmation services related to audit activities such as
risk management, legal affairs, and statuary auditors during the audit activities of financial
statements of the Subject Entity. This is to ensure the required coverage of work and to avoid wasted
efforts. The type and volume of information that can be shared with other entities should be
considered to ensure the confidentiality of information in accordance with the policies in force
within the Entity.
2. The Internal Audit Unit can rely on the work of the confirmation service providers as long as the
former sets standards that assure that. These standards shall include evaluating the objectivity,
independence, competence and, professionalism of the service providers, ensuring a clear
understanding of the scope, objectives, and results of their actions. Even if the work is proven to
be relied upon, the Internal Audit Unit remains responsible and accountable for ensuring that the
conclusions and opinions reached are sufficiently supported.
3. The Internal Audit Unit shall prepare a list of the service providers who provided confirmation
services and whose work will be relied upon. This list shall be available to Those Charged with
Governance when presenting the audit plan.
4. The internal auditor shall communicate and coordinate with the Statutory Auditor by holding
meetings to discuss work plans and ensure that there is no duplication of work during the period of
auditing financial statements, as well as going through the most important observations related to
internal control systems and most important emerging issues such as the application of a new
accounting standard.
5. The internal auditor shall share internal audit reports with the Statutory Auditor, especially those
related to high-risk operations or activities, according to the results of the risk assessment.

Page 13 of 17
Article (11)
Independency of the internal audit services providers
1. The formal and substantive independence of the audit services provider shall be evaluated and
confirmed through the following:
a) Their commitment to principles of independence stipulated in The International Professional
Practices Framework (IPPF), issued by The Institute of Internal Auditors (IIA), and other
controls issued by the Authority from time to time.
b) The service provider, its responsible partners, or any member of the audit team and their
relatives up to the fourth degree shall have no financial interest in the Subject Entity.
c) The service provider shall not perform any other professional work for the Entity other than
the internal audit services.
2. The service provider’s team members must sign a commitment of independence letter in which
their independence is acknowledged and they undertake to inform the Entity as soon as their
independence is threatened.
3. The Subject Entity shall exclude any Audit Service proposal if the service provider is determined
not to be formally or substantively fully independent. In addition, the service provider shall be
immediately terminated if they are determined to be not independent.
Article (12)
Confidentiality of Information
The Subject Entity must obtain the following undertakings from the internal audit service providers::
1. Not to disclose any information or documents that the internal audit service provider has access to
or obtained during their work, and not to disclose such information or documents to any other
person or entity without the written consent of the Subject Entity.
2. An undertaking by the internal audit service provider to commit to not copying or transferring
documents that support internal audit work, whether manually or electronically, outside the Entity’s
headquarters, as well as documenting audit procedures in the audit record, whether manually or
electronically, within the Entity’s headquarters.

Page 14 of 17
Article (13)
Reporting the violations
1. The Subject Entity’s internal auditor and staff shall report cases of financial and administrative
corruption to the Authority as soon as they know of it, in accordance with the provisions of the
Authority’s Law and the legislation issued by the Authority in this regard.
2. The Subject Entity’s audit service provider shall report cases of financial and administrative
corruption to the Authority as soon as they know of it, in accordance with the provisions
manufacturers Authority’s Law and the legislation issued by the Authority in this regard.
Article (14)
Disclosure, and the Conflict of Interest
1. The internal auditor and internal audit staff must sign an yearly acknowledgment to:
a) Disclose any potential conflict of interest.
b) Any financial interest they have in the audit projects or programs whether directly or
indirectly.
c) Disclose any limitations that may affect their performance in any manner.
d) Disclose any relative ties to any of the Entity’s employees up to the fourth degree.
e) Any relationship with the employees of the Subject Entity and other parties that may affect
its ability to comply or appear independent when performing its work, or even harm or
threaten this ability.
f) Undertake to disclose such cases as soon as they appear.
The Internal Audit Unit must submit a summary of these declarations to Those Charged with
Governance, then present them to competent department within the Entity, such as Human
Resources Department, Legal Affairs Department, or any other party, in accordance with the
governance system approved in the Entity in order to save it and refer to it when needed.
2. The Internal Audit Unit must present the cases of conflict of interest that are disclosed to Those
Charged with Governance to take appropriate action in this regard.

Page 15 of 17
Article (15)
Responsibilities of the internal audit unit towards ADAA
The Internal Audit Unit shall commit to the following:
1. Adhere to the rules and standards adopted by the Entity regarding internal audit.
2. Grant the Authority unrestricted and unconditional access to internal audit reports and all work in
the Unit's possession.
3. Facilitate the work of the Authority while it is carrying out tasks in the Entity.
4. Implement the recommendations issued by the Authority related to internal audit work within the
time period determined by the Authority.
5. Follow-up on the implementation of the Authority’s recommendations that have been issued to the
Subject Entity.
Article (16)
Executing the tasks assigned by ADAA to the internal audit unit
1. The Internal Audit Unit is obligated to carry out the tasks assigned to it by the Authority in
accordance with the powers granted to it by its Law.
2. The Internal Audit Unit must adhere to the scope of work determined by the Authority and provide
the necessary resources to carry out the tasks required in order to achieve the desired goals.
3. The Internal Audit Unit must not inform any party of the results and conclusions of the tasks
assigned to it without obtaining prior permission from the Authority.
Article (17)
ADAA’s oversight over the work of the internal audit unit
1. The Authority shall monitor the efficiency and quality of internal audit processes in the Subject
Entity through the various control activities it exercises for the Entity, as well as make the necessary
recommendations to address the observations resulting from those actions.
2. The Authority shall evaluate the performance of the Internal Audit Unit based on the principles,
provisions and standards contained in these rules, methodologies and evaluation criteria used in the
Authority to identify opportunities for improvement and development, according to what it deems
appropriate.
3. The Audit Unit shall commit to implementing the recommendations of the Authority as per the
time frame set by the Authority.

Page 16 of 17
Article (18)
Development and Emiratization
1. The Internal Audit Unit shall develop Emiratization plans within the Unit in line with the
Emiratization rates specified for the Subject Entity, provided that they must be presented to those
Charged with Governance for discussion and approval.
2. The Internal Audit Unit shall prepare the necessary development plans for the professional
qualification of the national cadres in the Unit and to obtain the professional certificates of internal
auditing, provided that periodic follow-up reports are submitted on these plans and presented to
Those Charged with Governance.
Article (19)
Auditors Code of Ethics
The internal auditors of the subject entity - whether they are employees of the internal audit unit or those
contracted for internal audit work - shall bear the responsibility of controlling public funds and verifying
the processes of its and spending for the designated purposes efficiently, effectively and economically in a
manner that contributes to achieving the entity’s objectives and preserves the public funds.
In this regard, the internal audit employee is seen as a source of trust, honesty and credibility, which are
qualities that the auditor must support by adopting and applying the principles of professional ethics
specified in the Code of Ethics issued by the The Institute of Internal Auditors (IIA) and any other principles
issued by the Authority in this regard, regardless of the way it was published.

Abu Dhabi Accountability Authority
TEL: +97126392200
PO Box 435, Abu Dhabi
United Arab Emirates
www.adaa.gov.ae
© 2020 ADAA. All rights reserved. Not for further distribution without the permission of ADAA.