Audit management software for the UAE's audit firms and internal audit teams.
Client and auditee documents in your own SharePoint with a receipt for each, the statutory audit from tender to archive with clearance and archive clocks, request lists that clients and auditees answer online, findings followed up to implementation, and timesheets and fee notes in dirhams, for accounting firms under Federal Decree-Law No. 41 of 2023 and for internal audit functions in banks, listed companies and government-owned entities.
Built for the Ministry's inspections and a ten-year working-paper rule.
Decree-Law No. 41 of 2023 asks every accounting firm to run a quality control system, protect client data, keep its engagement files for ten years and produce them when the Ministry asks. Ministerial Decision No. 195-3 of 2024 makes ISA, ISQM and the IESBA Code mandatory. Each duty below maps to a capability, so the evidence sits where an inspector will look for it.
Keep the data and documents of each engagement for at least ten years from the date of the report, longer while a claim is pending (Decree-Law 41 of 2023, Art. 19)
Retention dates by document type, set to ten years for engagement files when the deployment is set up for the UAE at implementation; legal hold for a file under dispute, so it stays past its date until the claim is settled
Provide the reports issued, with their supporting documents and working papers, whenever the Ministry asks (Art. 16(2)(c))
Every client document filed against the engagement with who sent it and when, and a printable compliance view of every stage, its evidence, dates and who completed it
Run a quality control system that meets the Ministry's standards, and protect the secrecy of client data (Art. 16(2)(a))
Entra ID sign-in under your own multi-factor policies, permissions checked on every request, and an audit trail of every action; documents stay in your own SharePoint
Assemble the audit file promptly after the report and keep it unchanged (ISA 230, mandatory under Ministerial Decision 195-3 of 2024)
An archive clock from sign-off to your firm's deadline (45 days by default, ceiling 60), with reminders and escalation; versioned, checksummed files and an audit trail of any later change
Ask the existing or predecessor auditor for relevant facts before accepting an audit (IESBA Code R320.8)
A clearance stage before the engagement letter, which waits the period your firm sets and closes early only when the reply is recorded
Evaluate the firm's system of quality management each year (ISQM 1 para 53)
Each engagement's printable history of stages, gates, evidence and sign-offs, for the file reviews that feed the evaluation; the evaluation and independence confirmations stay with the firm
Keep corporate tax records for seven years and company accounting registers for five (Corporate Tax Law Art. 54; Commercial Companies Law Art. 26)
Retention dates by document type, set at implementation to seven years for a client's ledgers and tax documents and ten for the engagement file
Keep an independent, permanent and effective internal audit function in every bank, reporting to the board or its audit committee (CBUAE Circular 161/2018)
Internal audit engagements run through stages from notification to final report, with request lists to branches and departments; findings and management's agreed actions are followed to verified implementation, and a follow-up register lists open and overdue actions for the audit committee
This maps software capability to obligations; it is not professional advice. AuditEDMS follows management's agreed actions to implementation in its findings register; it does not hold an audit universe or a risk-based annual plan.
For the UAE's accounting firms, and for internal audit where regulators require it.
The CA firms on the Ministry's Auditor Register, practising under Decree-Law No. 41 of 2023. The law applies to firms practising in the State, and to free-zone firms when they practise outside the free zones. Every joint stock company and limited liability company must have an auditor each year, and a public joint stock company's audit firm may serve at most six consecutive financial years, with the engagement partner changing after three.
The law counts internal audit among the "other assurance services" an accounting firm provides, so a firm running internal audit for clients can run those engagements, request lists, findings follow-up and timesheets in the same system as its statutory audits.
Every bank must have an independent, permanent and effective internal audit function with full access to records, reporting to the board or the board audit committee; the head of internal audit reports serious violations to the Central Bank, and replacing or dismissing that person needs the Central Bank's no-objection (CBUAE Circular 161/2018).
The Abu Dhabi Accountability Authority oversees Abu Dhabi government entities and those in which the Abu Dhabi government holds more than 25 percent. Government audit bodies sit outside the auditing profession law; internal audit units in the entities they oversee can use AuditEDMS for the engagement record.
IFAC lists the listed-company regulator among the UAE's audit oversight bodies; its website now names it the Capital Market Authority. Internal audit departments in listed groups use AuditEDMS for engagement stages, auditee requests, evidence and the follow-up of findings.
Frequently asked questions.
Does AuditEDMS replace CaseWare or our working-paper software?
No. Those hold audit working papers; AuditEDMS holds what surrounds them: the client's documents with a receipt for each, the engagement from tender to archive with its gates and clocks, the request lists, the time and the fee notes. A firm keeps its working-paper tool and runs AuditEDMS alongside it. AuditEDMS does not connect to any of them today.
How long must a UAE audit firm keep its working papers?
At least ten years from the date of the report, under Article 19 of Decree-Law No. 41 of 2023. Where a claim is pending in the courts, the period runs from the final judgment, and the partners stay responsible for the records even if the firm's licence is cancelled. That is longer than ISA 230's ordinary minimum of five years, so the national rule governs. A client's own records carry other periods: corporate tax records seven years after the tax period, and company accounting registers at least five years. AuditEDMS sets a retention date by document type, so each record carries its own period, and legal hold keeps a file past its date while a claim is open.
Is audit mandatory in the UAE?
For joint stock companies and limited liability companies, yes: each must have one or more auditors to audit its accounts every year (Commercial Companies Law, Art. 27). The Minister may also require categories of corporate taxpayers to prepare audited financial statements (Corporate Tax Law, Art. 56). A company in a free zone or financial free zone should also check its zone's own rules.
Can banks and listed companies use it for internal audit?
Yes: stages, document requests to branches or departments, evidence custody, time and sign-offs, and a findings register that follows management's agreed actions to verified implementation. For a bank's audit committee, the follow-up register lists every open action with its owner and due date, and which are overdue. AuditEDMS has no audit universe or risk-based annual plan.
Where is the data hosted?
In your own Azure subscription, in the region you choose, with documents in your own SharePoint. Azure has two UAE regions: UAE North in Dubai, with three availability zones, and UAE Central in Abu Dhabi, whose access is restricted to specific scenarios such as disaster recovery. Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data sets requirements for transferring personal data across borders, and the DIFC and ADGM run their own data protection regimes. No client data sits in Creodata's cloud, but Creodata operates the deployment and holds standing management access to its managed resource group; every action it takes is recorded in your Azure activity log. Settle the question with your data protection officer or legal adviser before choosing a region; ask us how the deployment fits your assessment.
Is there an Arabic interface?
No. AuditEDMS is in English today. Documents in Arabic are filed, versioned and retained like any other document, but screens, emails to clients and the compliance view are in English.
Does it handle fee notes, VAT and e-invoicing?
Billing milestones raise draft fee notes in dirhams at the stages you choose (40, 40 and 20 percent of the fee by default), with VAT at 5 percent on each, part payments, and work in progress and yield from approved time; the deployment is set up for the UAE at implementation, and its tax compliance template ends at "Filed with the FTA". Fee notes stay in AuditEDMS: it does not prepare VAT or corporate tax returns, does not post to an accounting system, and does not issue e-invoices through an accredited service provider under the UAE's e-invoicing programme.
How much does it cost?
On Microsoft Marketplace, Basic is US$200 a month for firms of up to 30 staff and Enterprise US$500 a month for firms of up to 75 staff, with priority support; the pilot is free for 90 days, by invitation. Azure resources are billed to your own subscription, typically US$45 to 80 a month for a firm of 20 to 50 staff. Implementation is quoted separately.