SCA Circular 2025: Strengthening Internal Control and Risk Management Compliance for UAE-Listed Companies

The Securities and Commodities Authority (SCA) has introduced a new circular, effective January 16, 2024, that significantly impacts corporate governance in UAE-listed companies. One of the most critical mandates is the requirement for an audit opinion on Internal Control Over Financial Reporting (ICOFR) starting in FY 2024. However, this circular extends beyond financial reporting, covering broader aspects of internal control and risk management.

This blog breaks down the critical aspects of the SCA circular, explaining how it impacts corporate governance in UAE-listed companies and outlining the key compliance steps businesses must take.

Key Takeaways:

  • Mandatory ICOFR audits for FY 2024
  • Expanded internal control requirements beyond financial reporting
  • Broader risk management framework for UAE-listed companies
  • Auditor opinion disclosure required from FY 2025 onwards

Background

On January 10, 2024, the Securities and Commodities Authority (SCA) introduced amendments to the Code of Corporate Governance, which became applicable from January 16, 2024. One of the key amendments were related to the Board responsibilities around Internal Control & Risk Management. Through the amendment Board is required to enable the Auditor to express an opinion on the effectiveness of Internal Control & Risk Management including Internal Control Over Financial Reporting.

Understanding the SCA Circular (January 14, 2025)

The SCA Circular 2025 aims to reinforce corporate governance and ensure transparency in financial reporting for UAE-listed companies.

Key Provisions of the SCA Circular:

  • The Internal Control & Risk Management system applies only to material risks.
  • While COSO (Committee of Sponsoring Organizations of the Treadway Commission) is the preferred framework, companies using an existing regulatory-mandated framework meeting minimum requirements do not need modifications.
  • The opinion on Internal Control & Risk Management can be provided by the current or any other licensed auditor.
  • Companies must conduct a self-assessment to identify internal control gaps and address them.
  • Auditors must provide an opinion only on ICOFR, but disclosure is not required.
  • Auditor opinions must be obtained and publicly disclosed for all aspects of Internal Control & Risk Management.

Why This Matters for UAE-listed Companies

For CFOs, Financial Controllers, and Chief Audit Executives, these regulatory updates require companies to:

  • Strengthen internal governance frameworks to comply with the SCA Circular 2025
  • Expand risk management practices beyond financial reporting
  • Ensure proactive compliance with UAE corporate governance standards

Scope of Internal Control & Risk Management

The SCA Circular 2025 requires listed companies to broaden their internal control mechanisms beyond financial reporting.

Internal Control: More Than Just Financial Reporting

Traditionally, Internal Control Over Financial Reporting (ICOFR) has been the primary focus. However, the latest SCA directives expand the scope to include:

Operational Risks – Business continuity, efficiency, and alignment with corporate objectives.
Regulatory Compliance – Ensuring adherence to UAE governance laws and global best practices.
IT & Cybersecurity Risks – Strengthening cybersecurity frameworks and data protection strategies.

This shift in governance strategy requires companies to adopt a holistic risk management approach instead of limiting it to financial compliance.

Next Steps for UAE-Listed Companies

To achieve full SCA compliance, companies must:

Identify and reassess material risks across operations, reporting, and compliance.
Conduct management or third-party ICOFR testing for FY 2024 audits.
Develop a self-assessment framework to strengthen operational and compliance controls.

Internal Control Beyond Financial Reporting

While ICOFR remains critical, the SCA Circular 2025 emphasizes holistic governance measures. Companies must now focus on:

Operational Resilience – Ensuring business continuity and reducing disruptions.
Regulatory & Legal Compliance – Strengthening adherence to UAE financial and governance laws.
Fraud Prevention & Detection – Implementing advanced fraud risk management strategies.
Data Security & IT Governance – Enhancing cybersecurity policies to safeguard sensitive company data.

Conclusion

The SCA Circular 2025 introduces critical changes that require UAE-listed companies to reassess their internal control and risk management frameworks. While these updates enhance corporate governance and financial transparency, they also raise important questions about implementation, compliance, and best practices.

Every organization’s internal control environment is unique, and the steps needed to achieve compliance will vary. Whether you need to evaluate your current framework, identify potential gaps, or align your risk management strategy with regulatory requirements, having the right insights is essential.

We invite you to book a free consultation call, where you can:

Discuss your specific challenges related to SCA compliance.
Gain clarity on audit requirements and internal control best practices.
Understand practical steps your organization should take in 2024 and beyond.

By taking a proactive approach, you can ensure that your organization is fully prepared to meet these new requirements without unnecessary disruption. If you have questions, let’s talk. Our team is here to help.

Contact us today to learn how our expert accounting services can help your business navigate complex transactions and ensure compliance with international standards.

We invite you to book a free consultation call, where you can:

  • Discuss your specific challenges related to SCA compliance.
  • Gain clarity on audit requirements and internal control best practices.
  • Understand practical steps your organization should take in 2024 and beyond.

By taking a proactive approach, you can ensure that your organization is fully prepared to meet these new requirements without unnecessary disruption. If you have questions, let’s talk. Our team is here to help.

Contact us today to learn how our expert accounting services can help your business navigate complex transactions and ensure compliance with international standards.