ICOFR Requirements for Abu Dhabi Entities

As auditing standards continue to evolve, entities subject to Abu Dhabi Accountability Authority (ADAA) oversight face new requirements related to Internal Control Over Financial Reporting (ICOFR). The ADAA's "Standards for Auditing Financial Statements of Entities Subject to ADAA" outlines specific ICOFR expectations that auditors must address.

Key ICOFR Requirements:

1. Testing Effectiveness: Auditors must test the effectiveness of internal control systems over financial reporting, covering regulations and procedures relating to key transactions with material financial impact. This involves:

• Evaluating control design
• Testing operating effectiveness
• Assessing the impact of control deficiencies

2. IT Controls: The standards emphasize examining the effectiveness of control procedures related to information systems, applications, and software utilized in financial activities. This includes:

• General IT controls (e.g., access management, change management)
• Application controls within financial systems
• Data integrity and security measures

3. Reporting on ICOFR: Auditors are required to issue a separate report on the effectiveness of internal control systems over financial reporting. This report should:

• Express an opinion on ICOFR effectiveness
• Describe the scope of ICOFR testing
• Identify any material weaknesses or significant deficiencies

4. Key Audit Matters: The auditor's report must include key audit matters related to ICOFR, specifically:

• Material Weaknesses: Deficiencies that could lead to material misstatements not being prevented or detected timely.
• Significant Deficiencies: Important control issues deserving attention from those charged with governance.

These should be described in detail, including their potential impact and how they were addressed during the audit.

5. Comprehensive Scope: ICOFR testing must cover key operations including:

• Procurement and expenditure
• Human resources
• Investments
• Budgeting
• Revenue and accounts receivable
• Cash and bank account management
• Inventory management
• Asset management
• Financial statement preparation and closing process

Additional ICOFR Considerations:

Risk Assessment: Auditors must consider specific risk factors when assessing ICOFR, including:

• Lack of segregation of duties
• Budget overruns
• Non-compliance with laws and regulations
• Implementation of new financial systems
• Public-private partnerships

Materiality: The standards provide guidance on determining materiality for ICOFR testing, emphasizing the need to consider both financial and non-financial factors.

Communication: Auditors must communicate ICOFR findings to those charged with governance, including through a detailed management letter outlining issues and agreed-upon action plans.

How MBG Can Help:

At MBG, we understand the complexities of these ICOFR requirements and offer tailored solutions:

1. Gap Analysis: We'll assess your current ICOFR framework against ADAA requirements, identifying areas needing enhancement. This includes:

• Reviewing existing control documentation
• Mapping controls to financial statement assertions
• Identifying control gaps and redundancies

2. Control Design and Implementation: Our experts can help design and implement robust controls addressing key risk areas identified in the standards. We focus on:

• Developing risk-based control matrices
• Drafting clear control descriptions and procedures
• Implementing automated controls where possible

3. IT Control Evaluation: We specialize in evaluating and strengthening IT controls critical to financial reporting processes, including:

• Assessing cybersecurity measures
• Reviewing data backup and recovery procedures
• Evaluating system access controls and segregation of duties

4. ICOFR Testing Support: Our team can assist in developing and executing comprehensive ICOFR testing plans that meet ADAA expectations. This involves:

• Designing appropriate test procedures
• Determining sample sizes based on risk assessments
• Documenting test results and conclusions

5. Remediation Assistance: Should weaknesses be identified, we'll work with you to develop and implement effective remediation strategies, including:

• Root cause analysis of control deficiencies
• Developing action plans with clear timelines
• Monitoring remediation progress

6. Reporting Expertise: We'll ensure your ICOFR reporting aligns with ADAA requirements, including:

• Drafting clear and concise descriptions of key audit matters
• Properly disclosing material weaknesses and significant deficiencies
• Preparing management letters with actionable recommendations

7. Training and Knowledge Transfer: We offer customized training to help your team understand and maintain compliance with ICOFR requirements, covering:

• ICOFR fundamentals and best practices
• Specific ADAA requirements and expectations
• Ongoing monitoring and self-assessment techniques

By partnering with MBG, entities subject to ADAA oversight can confidently approach ICOFR compliance, ensuring robust financial reporting processes that meet regulatory expectations and contribute to overall organizational success. Our deep understanding of the ADAA standards, combined with our practical experience, positions us to provide valuable insights and support throughout your ICOFR journey.