Audit and Internal Control Policy

1 Purpose and independence

Internal control provides reasonable assurance over funds, records, compliance and operational effectiveness. Management remains responsible for implementing controls. The audit function or appointed reviewer reviews work they did not perform. Obstacles to independence or access are escalated to the Board, preserving privacy and confidentiality.(1)

2 Audit plan

An annual risk-based plan covers donations, assistance, banking, procurement, membership, data and access rights. Audit tests proportionate terrorist-financing risk measures approved by the regulator, accountability, transparency and use of regulated financial channels under Article 34 of Cabinet Resolution No. 134 of 2025. Tests include funding sources, disbursement destinations, risk-based due diligence, local and UN Security Council list screening, and documenting and resolving matches under targeted-financial-sanctions guidance. Each assignment specifies purpose, scope, owner, resources, timing and criteria. An independent specialist is appointed where skills are lacking or responsibilities conflict. Financial-statement audit does not replace operational-risk review.(2)

3 Performing tests

Transactions are tested from request and approval through execution and reconciliation, using justified evidence samples rather than merely signed policies. Sampling methods, exceptions, effects, causes and scope limitations are documented, preserving a reperformable trail. Reviewers do not alter original records to remove findings or export unnecessary data outside the Association environment. Donor and beneficiary data access is limited to assignment needs, using restricted permissions and secure channels. Federal Decree-Law No. 45 of 2021 applies according to its scope and exclusions, alongside relevant health-data or other sector legislation. An auditor’s request alone does not authorise data transfer.(3)

4 External auditor

The ordinary General Assembly appoints the audit firm and determines its remuneration under the Articles. Registration, licensing and independence are checked under Federal Decree-Law No. 41 of 2023 regulating accounting and auditing. Management provides documents and explanations on time, documenting engagement letters, representations and queries. If the auditor withdraws or is terminated during the year, replacement follows Board authority, fee limits and competent-authority approval under Article 75 of the Articles. Termination follows Article 77 and higher legislation. Replacement or removal must not conceal a financial-statement disagreement.(4)

5 Reporting and correction

Facts are discussed with the process owner without granting a right to delete valid findings, while protecting suspicion and investigation confidentiality. Findings are risk-rated with treatment, owner and deadline. Suspicions are immediately and confidentially escalated to the compliance officer or independent authorised person where interests conflict, preserving evidence without tipping off the subject. The authorised person immediately notifies the Ministry of Community Empowerment through the approved channel, supplies necessary documents, records the notification and follows instructions. The Ministry handles referrals and reporting within its powers. Under the current route, this policy does not assign goAML reporting to the Association. Ministry instructions, channel, authorised person and substitute are documented, respecting any direct statutory obligation. Audit tests the route’s effectiveness and reports to the Board to the legally permitted extent.(5)

6 Follow-up and closure

A finding closes only after testing remediation evidence and control effectiveness. Delay, recurrence or high risk is escalated to the Board; risk acceptance cannot authorise a legal breach. Administrative records and documents are retained for at least five years and financial records for at least ten years. Disposal after those periods still requires competent-authority approval under Article 8(6) of Cabinet Resolution No. 5 of 2025. Audit working papers have restricted access and are classified by nature; auditor reports and financial-transaction documents are financial records. The retention schedule defines owner, period, starting event and applicable basis, observing any longer mandatory minimum. Destruction is suspended during investigations, disputes or competent-authority requests until the impediment ends and approval is obtained. Audit quality and independence are reviewed, informing risk and training plans.(6)

References in the approved document

1. The Association’s approved 2026 Articles of Association, Articles 20 and 75–77, checked against the project’s Articles file. Federal Decree-Law No. 50 of 2023 and its executive regulations under Cabinet Resolution No. 5 of 2025. Official sources: uaelegislation.gov.ae/ar/legislations/2181 and 2792. This version does not rely on repealed Law No. 2 of 2008.

2. Federal Decree-Law No. 10 of 2025; Cabinet Resolution No. 134 of 2025, Article 34 on non-profit organisations, legal-library copy M04_134_2025.pdf, page 24; Cabinet Resolution No. 74 of 2020 and applicable targeted-financial-sanctions guidance. Source: uaelegislation.gov.ae/ar/legislations/3857.

3. Federal Decree-Law No. 45 of 2021 on personal-data protection, considering scope, exclusions and relevant sector legislation. Source: uaelegislation.gov.ae/ar/legislations/1972.

4. Federal Decree-Law No. 41 of 2023 regulating accounting and auditing. Source: uaelegislation.gov.ae/ar/legislations/2183. The Association’s Articles, Articles 75–77.

5. General legislative basis: Federal Decree-Law No. 10 of 2025 and its executive regulations under Cabinet Resolution No. 134 of 2025. The Ministry-notification route reflects the Association’s statement of its operating procedure; governing Ministry instructions are documented in the compliance register. Official source: uaelegislation.gov.ae/ar/legislations/3857.

6. Governance control: Cabinet Resolution No. 5 of 2025, executive regulations of Federal Decree-Law No. 50 of 2023, Article 8(2) and 8(6): financial-record classification, retention and competent-authority disposal approval. Official source: uaelegislation.gov.ae/ar/legislations/2792.