By: ASHRAF MASADEH, MSC, CIA, CRMA, CFA Internal Audit Manger at Etihad Rail

Edited by: Meenakshi Razdan


By now, majority of the audit community is already aware that UAE, as well as other GCC countries will start implementing Value Added Tax (VAT) effective 1st of January, 2018. Rest of the GCC countries will follow by January 2019. A Federal Tax Authority (FTA) has been established to govern, manage the implementation process, collect federal taxes and apply the tax-related procedures. The VAT procedures
are defined in the Tax Procedures Law, which has been approved recently.
Two sets of administrative and tax evasion penalties have been defined in the Tax Procedure Law.
Although VAT will come into effect in less than four months, recent surveys conducted by professional firms concluded that GCC businesses are not yet prepared for VAT. Lack of VAT readiness exposes businesses to a new set of inherent risks that need to be managed by implementing a proper tax strategy and compliance framework. Internal Auditors, as integral part of the governance framework of the business, are expected to add value to the VAT readiness project by providing their shareholders with an objective assurance on the adequacy and effectiveness of the internal controls and governance arrangements implemented in the project.

“Internal Auditors are expected to add value by providing an objective assurance on the adequacy and effectiveness of the
internal controls and governance arrangements implemented in the project.”


Starting from the 1st of January, 2018, entities in the UAE will be required to collect, record, and pay the due VAT to the FTA.

Registration with FTA will be opened in the last quarter of 2017 and businesses that meet the registration threshold should register by the end of the year. New compliance requirements will be introduced. Key accounting records will be mandatory for businesses with a certain annual turnover. Tax auditors will be visiting businesses to audit their revenue, operating expenses, contracts, and inventory. Attention
will be given to every detail, such as all types of discounts, gifts, production waste, bad debt, and bonus paid to agents… etc.
Businesses can get ready for these changes and challenges in the business environment by implementing a proper VAT
readiness project. VAT preparation and implementation is not a simple process that can be accomplished by just adjusting the
accounting systems. In fact, it is a much wider process that needs a great deal of work and preparation in most of the business
functions, including the commercial planning, procurement, sales, finance, IT, and customer service activities.
As a result, it is important to deal with this task as a structured project. A task force should be formed to oversee this project
and to ensure the proper implementation of the tax strategy, systems, and processes right from the beginning. This task force
should include members from various departments chaired by an expert.vat1

During the implementation project, all associated VAT risks should be methodically assessed and accounted for to avoid any future
surprises, as well as to minimize the cost of implementation and to optimize future compliance.

“Internal“Lack of VAT readiness exposes businesses to a new set of inherent risks that need to
be managed by implementing a proper tax strategy and compliance framework.”

In today’s highly competitive market where businesses are fighting for their market share, Boards are showing less tolerance in accepting risks, which may result in losing revenue or increasing cost. VAT money will belong to the government, so any errors made due to an inaccurate implementation of VAT will leave the businesses vulnerable, losing a portion of their profit or paying hefty penalties.
Depending on the existing level of expertise within the internal audit department resources, CAEs should plan their involvement
by either providing a proactive consultancy service to help assess the risks and controls at an early stage, or by deciding to be involved at a later stage by conducting post-implementation audits. According to the standard 1210.C1 (Proficiency) of the IPPF, The chief audit executive must decline the consulting engagement or obtain competent advice and assistance if the internal auditors lack the knowledge, skills, or other competencies needed to perform all or part of the engagement.
If the latter decision is taken, the CAE can still use the golden opportunity of participating as an observer within the task force.
This will give Internal Audit a great deal of exposure in understanding the mechanism of implementing VAT, as well as changes
within the existing systems and processes,project deliverable, and associated risks and controls. Taking part will also help the
CAE in planning and phasing the future assurance audit, as well as identifying the scope and objectives of future audits. In the
meantime, the internal audit team should start building and shaping their knowledge by attending VAT-related training and seminars.

“VAT preparation and implementation is not a simple process that can be accomplished by just adjusting the accounting systems.”

To plan for VAT risks, CAEs need to take them in consideration when they reassess their business and control environment
and update their risk universe. VAT inherent risks should be assessed and linked with the overall strategic objectives and
with the operational business plans. Controls should be evaluated and documented to identify the residual risks.
After conducting the typical risk assessment, a quick comparison between both the previous year and current year heat
maps will clearly indicate the impacted functions, processes, and systems where assurance needs to be provided. The scattering
of risks will help the CAE in defining the processes and systems to cover, the scope of audit, and the audit approach.
There are various options on how a VAT audit can be scoped. The VAT preparation project can be covered as a single audit
assignment of the entire project. Or, two or more linked areas could be covered together, such as Procurement and Contracts,
Commercial and Sales, Account Payable and Sales. The CAE may also decide to audit the VAT readiness indirectly, as part
of the regular audit of relevant processes (i.e. sales, finance, procurement, and legal… etc.). However, this approach is not
favorable because of the delay in reporting VAT weakness, which could take years depending on the audit cycle.
Audit objectives should focus on ensuring that effective and efficient internal controls are designed and implemented to comply
with VAT regulations and to respond to urgent changes without interrupting the business operations.
In order to reach accurate conclusions and to provide valuable reports to shareholders, internal auditors should be able to define
the appropriate criteria against the controls to be assessed. That usually goes at the beginning of most of our audit reports as,
“What should be happening?” Given below are some key technical audit criterions that can help in auditing or providing consultancy on the VAT readiness project. Next to each criterion is the rationale to help understand each criterion. It is important to highlight that this table covers the overall process and is not necessarily detailed enough to fit all entities. Auditors should adapt in line with the nature of their
business, systems in place, and complexity of transactions.


Once VAT has gone live, businesses will be responsible and accountable to comply with VAT regulations by collecting VAT,
maintaining accurate accounting records,and filing a tax return on time.
While the level of Internal Audit involvement in the VAT implementation process may vary from business to business and
from one CAE to the next, it is foregone conclusion that Internal Audit will have a critical role to play in this changing regulatory
and business environment whether that is by providing pro-active and preventive consulting services at the initial implementation
phase or by doing post event audits. This role should continue to assure the Board that the business is not paying excessive VAT or incurring fines due to noncompliance with laws and regulations. Bearing all this in mind, we, as the audit community, must ensure that we train ourselves to grasp the necessary details and nuances of the new VAT regulations and their impact on our duties and responsibility.