DIFC auditors

This is the thing almost every article on DIFC audit gets wrong, and it is worth being precise about because appointing from the wrong list is not a technicality.

• The Registrar of Companies register. The baseline. Any DIFC registered entity required to have its accounts examined and reported on by an auditor must appoint from it[DIFC — Registered and Recognised Auditors]. This catches ordinary non-regulated companies.
• The DFSA register. Separate, stricter, and mandatory for four categories of regulated entity[DFSA — Auditor Registration]. Different body, different rulebook, different conditions.

A firm being “a DIFC auditor” in general conversation tells you almost nothing. Ask which register, and check it.

Worth settling before you go looking for a firm, because not every DIFC company is audited.

The DIFC Private Company Handbook requires a non-small private company to file audited accounts within seven months of its financial year end; other private companies file accounts within nine months. DIFC defines a small private company as one with 20 or fewer shareholders or annual turnover of USD 5 million or less[DIFC — Private Company Handbook].

Two practical notes. The test is a threshold, so a company can cross it in a year it did not expect to — check it annually rather than once at incorporation. And being outside the audit requirement does not remove the filing requirement; the accounts still go in, just unaudited. Full detail on DIFC audit requirements.

The DFSA list is closed and short. You need a DFSA-Registered Auditor if you are a Public Listed Company, a Domestic Authorised Firm, an Authorised Market Institution or a Domestic Fund[DFSA — Auditor Registration].

If you are none of those — a consultancy, a holding company, a technology business, a family office that is not conducting a regulated financial service — you are on the Registrar’s track. If you are unsure whether your activity is regulated at all, that question comes first and it changes everything downstream: see how DFSA authorisation works.

Useful to know even if you will never need it, because it explains why the two lists are not interchangeable. The DFSA sets nine conditions for registration. A Registered Auditor must[DFSA — Auditor Registration]:

• be fit and proper;
• hold professional indemnity insurance as required under section 4.3 of the Auditor (AUD) Module of the DFSA Rulebook;
• maintain systems ensuring compliance with the International Standards on Auditing, the International Standard on Quality Management and the Code of Ethics for Professional Accountants;
• be controlled by a majority of individuals holding Recognised Professional Qualifications;
• appoint at least one Audit Principal and a Senior Officer.

The Audit Principal bar is the specific one: a Recognised Professional Qualification, membership in good standing of a Recognised Professional Body, at least five years of relevant post-qualification audit experience in the past seven years — including at least one year in a managerial role supervising and finalising audits — and fit and proper[DFSA — Auditor Registration].

The Senior Officer is the firm’s day-to-day management and its key point of contact with the DFSA, and must hold that role with an appropriate level of seniority and independence[DFSA — Auditor Registration].

Check the list, not the letterhead. Both registers are public.

• The Registrar’s register is published by DIFC as a list of firms with contact details and a status against each[DIFC — Registered and Recognised Auditors].
• The DFSA Public Register is searchable and covers Registered Auditors and Audit Principals[DFSA — Public Register].

One detail worth knowing, because it is the one that catches people out: the DFSA register carries a separate “Registered Auditors (Withdrawn)” list[DFSA — Public Register]. A firm that was registered when someone recommended it is not necessarily registered now. If a firm’s status is at all unclear, that withdrawn list is the one to look at.

A common and expensive assumption. Founders look for an audit firm with a DIFC address, find few, and conclude the market is thin.

Counting the Registrar’s published register in August 2026: 244 registered firms, of which 3 of 244 list an address inside the Centre[DIFC — Registered and Recognised Auditors]. The rest are in Deira, Business Bay, Bur Dubai, Sharjah and Abu Dhabi.

Those two numbers are our count of DIFC’s published list on that date, not a figure DIFC states, and the register changes. Count it yourself before relying on it — the point is the proportion, not the precise total.

What follows is simple: filter on the register, not the postcode. A firm three metro stops away that is on the list can audit you; a firm in the Gate Building that is not, cannot.

Once you have filtered to registered firms, the register itself stops helping — it tells you who is permitted, not who is any good. What actually separates them:

• Have they audited your structure before? A Foundation, a fund and a trading company are three different audits. Ask for comparable engagements, not a client count.
• Capacity at your year end. Most DIFC entities run to 31 December, which means most audits land in the same quarter. A firm that is excellent and fully booked is not available to you.
• Who actually does the work. The partner who pitches is not always the person on the file. Ask who runs the engagement day to day.
• Do they understand your tax position? Audit and corporate tax now interact — Qualifying Free Zone Person status turns on substance and income analysis[UAE Ministry of Finance], and an auditor who has never looked at that will not flag a problem before it becomes one.
• DFSA registration, if you are regulated. Non-negotiable, and the first filter rather than the last.

The most common structural mistake, and the easiest to avoid: the firm that keeps your books cannot audit them.

An auditor has to be independent of the records they are auditing. Bundling bookkeeping and audit into one engagement looks efficient and cheap, and it is the arrangement that has to be unpicked at exactly the wrong moment. Use separate firms from the start. See accounting and bookkeeping.

Earlier than most people do. Work backwards from the filing deadline — seven months after year end for a non-small private company[DIFC — Private Company Handbook] — and note that the audit itself is the last step, not the first.

Before an auditor can start, the books have to be closed and reconciled. If that takes six weeks and the audit takes six, a seven-month deadline is comfortable only if you appoint early. Appointing in month six is how a clean set of accounts turns into a late filing.

Audit fees are market prices set by the firm you engage, not published DIFC charges, so anyone quoting a number without seeing your accounts is guessing. What moves them:

• Transaction volume — the single biggest driver.
• Number of entities, and whether consolidation is needed.
• Whether you are DFSA-regulated — a regulated audit is a different scope of work[DFSA — Authorisation].
• The state of your bookkeeping. The cheapest thing you can do to lower an audit fee is hand over clean, reconciled records.
• How late you appoint. Peak season costs more, if you can get in at all.

• Assuming any qualified firm can audit you.The Registrar’s register is the gate[DIFC — Registered and Recognised Auditors].
• Assuming you need a DFSA-registered auditor. Only four categories do[DFSA — Auditor Registration], and the stricter register is not automatically the better fit for an unregulated company.
• Only looking for firms with a DIFC address. Almost none of the register is inside the Centre.
• Taking registration on trust. Registrations get withdrawn, and the DFSA publishes that list[DFSA — Public Register].
• Using your bookkeeper as your auditor. Independence is not optional.
• Appointing in month six of a seven-month deadline.
• Never re-checking the small-company test. Crossing the threshold turns an unaudited filing into an audited one[DIFC — Private Company Handbook].