General UAE Legal Questions LawLaw No. (4) of 2018 Establishing the Financial Audit Authority

Article (5) The Authority will have the following objectives: 1. to audit Public Funds by verifying that they are legitimately and properly used and managed; 2. to ensure that the financial, administrative, accounting, operational, and smart duties and activities of Auditees are conducted efficiently and effectively; 3. to promote, and ensure the implementation of, effective accountability and appropriate management practices of Auditees; 4. to contribute to the creation of a supportive audit and risk management environment that promotes transparency and integrity; 5. to verify that the administrative resolutions and procedures adopted by Auditees are in compliance with the legislation in force in the Emirate; and 6. to promote the principles of transparency and integrity; and to combat all types, forms, and methods of financial and administrative corruption. Functions of the Authority

Article (6) a. For the purpose of achieving its objectives, the Authority will have the duties and powers to: 1. audit the periodic and annual consolidated Financial Statements of the Government and the consolidated Financial Statements of Auditees, in accordance with the Authority’s methodology; establish the rules, principles and standards that govern the preparation and presentation of the financial reports and the draft consolidated Financial Statements of the Government 2. investigate the financial and administrative violations detected by the Authority or by Auditees; and identify the causes of these violations and take the appropriate action in this respect; 3. verify the complaints, data, and information received by the Authority about any financial irregularities committed by Auditees; 4. provide Auditees with financial and accounting expert services as may be assigned by the Ruler or the Chairman, or provide these services at the request of Government Entities or entities which are not subject to audit in the Emirate;

-- 3 of 22 --

Law No. (4) of 2018 Establishing the Financial Audit Authority Page 4 of 22 5. verify the Auditees' compliance with the legislation, and with the policies, regulations, bylaws, and resolutions issued in pursuance thereof; 6. verify the accuracy of calculation and collection of the Public Revenue and financial proceeds generated from the services provided, and the activities conducted, by Auditees, by the banks operating in the Emirate, and by the entities that are not subject to audit as may be assigned by the Ruler or the Chairman. These revenues and proceeds include, without limitation, taxes, fees, prices, tariffs, fines, sale proceeds, rental income, franchise revenue, profits, proceeds from encashing guarantees, and other sources; 7. express an opinion and provide observations on the Financial Statements of the Government and Auditees, and issue the required reports and submit them to the Ruler for appropriate action, prior to the date of approval of these statements; 8. provide appropriate audit advice and recommendations to improve the performance of the Government and Auditees to meet international standards; 9. participate in, and represent the Authority on, boards and committees as may be directed by the Ruler or the Chairman; 10. follow up on the recovery of funds and proceeds generated from financial and administrative violations; 11. review the Auditees’ work practices and procedures to identify and rectify weaknesses that may result in committing financial and administrative violations; 12. propose the legislation, regulations, and policies required to combat financial and administrative violations; 13. regulate the criteria for appointment and reappointment of auditors; and evaluate the performance of their audit duties at the respective Auditees; 14. provide direct communication channels with the parties dealing with Auditees in order to receive complaints in relation to acts involving financial or administrative violations; investigate such violations; and take the necessary action in this regard; 15. conduct specialised studies and research in the pursuit of achieving administrative and financial integrity; 16. create a database of financial and administrative violations; analyse these violations; and develop appropriate solutions to address, and prevent reoccurrence of, the same;

-- 4 of 22 --

Law No. (4) of 2018 Establishing the Financial Audit Authority Page 5 of 22 17. organise conferences, seminars, and training courses on transparency, integrity, and combating financial and administrative violations; and collaborate and cooperate with relevant regional and international organisations to promote and ensure effective accountability and adoption of appropriate management practices; and 18. exercise any other duties or powers that are assigned to the Authority by the Ruler or the Chairman and that are relevant to auditing Public Funds or required for the achievement of its objectives. b. The Authority may, through the Director General, inquire of any Auditee official about any information or data related to any irregularities committed within these Auditees; and that official must fully cooperate with the Authority in this respect. Organisational Structure of the Authority

Article (8) a. A Chairman will be appointed to the Authority pursuant to a decree issued by the Ruler. b. The Chairman will undertake general supervision of the work of the Authority, and ensure the achievement of its objectives under this Law. In particular, the Chairman will have the duties and powers to: 1. approve the general policies, plans, and work programmes of the Authority; 2. approve the draft annual budget and the Financial Statements of the Authority, and submit the same to the Ruler for final approval; 3. approve the organisational structure of the Authority; 4. approve the bylaws, regulations, and resolutions regulating the administrative, financial, and technical work of the Authority, including human resources regulations and financial approval powers;

-- 5 of 22 --

Law No. (4) of 2018 Establishing the Financial Audit Authority Page 6 of 22 5. approve charges for the services provided by the Authority; 6. approve the initiatives, programmes, and projects that are relevant to the Authority’s objectives; 7. appoint executive directors of the Authority upon the recommendation of the Director General; and 8. exercise any other duties or powers assigned to him by the Ruler. c. The Chairman may delegate any of the powers referred to in paragraph (b) of this Article to the Director General, provided that such delegation is specific and in writing. Appointment and Duties of the Director General

Article (9) a. A Director General will be appointed to the Authority pursuant to a decree issued by the Ruler. b. The Director General will manage the Authority and will verify that the executive body exercise all its duties and powers under this Law. In particular, the Director General will have the duties and powers to: 1. develop the general policies, strategic plans, and work programmes of the Authority; submit the same to the Chairman for approval; and follow up their implementation; 2. prepare the draft annual budget and Financial Statements of the Authority, and submit the same to the Chairman for approval; 3. prepare the organisational structure of the Authority, and submit the same to the Chairman for approval; 4. develop the financial rules and regulations of the Authority, including the accounting principles and standards to be adopted by the Authority to maintain its financial records; and submit the same to the Chairman for approval; 5. represent the Authority before third parties and execute contracts, agreements, and memoranda of understanding with local, regional, and international entities in areas of expertise relevant to the work of the Authority; 6. propose the bylaws, regulations, and resolutions regulating the administrative, financial, and technical work at the Authority, including

-- 6 of 22 --

Law No. (4) of 2018 Establishing the Financial Audit Authority Page 7 of 22 human resources regulations and financial approval powers; and submit the same to Chairman for approval; 7. appoint deputy executive directors, managers, advisers, experts, and technical and administrative staff; 8. supervise the executive body of the Authority and ensure the effective performance of the duties and functions assigned to it; 9. propose the initiatives, programmes, and projects that are relevant to the objectives of the Authority; and submit the same to the Chairman for approval; 10. prepare periodic reports outlining the achievements and activities of the Authority, and present the same to the Chairman to take the appropriate action in this regard; 11. approve the provision of audit services and financial and accounting expert services to entities that are not subject to audit upon their request, and issue the resolutions prescribing the fees applicable thereon; 12. propose charges for the services provided by the Authority; and submit the same to the Chairman for approval; and 13. exercise any other duties or powers that are required for the achievement of the objectives of the Authority and that are assigned or delegated to him by the Chairman. c. The Director General may delegate any of the powers referred to in paragraph (b) of this Article to any Employee of the Authority, provided that such delegation is specific and in writing. Taking the Oath

Article (10) a. The Chairman and the Director General must, upon appointment and prior to assuming their employment duties, take the following oath before the Ruler: “I swear by Allah/God the Almighty to be faithful to the Ruler and the Emirate; to respect the legislation in force; to protect Public Funds; to perform my duties with utmost honesty and integrity; and to protect the confidentiality of work- related information”. b. Executive directors must, upon appointment and prior to assuming their employment duties, take the oath referred to in paragraph (a) of this Article before the Chairman.

-- 7 of 22 --

Law No. (4) of 2018 Establishing the Financial Audit Authority Page 8 of 22 c. Experts, technical staff, and auditors must take the oath referred to in paragraph (a) of this Article before the Director General. Conflict of Interest

Article (11) a. Neither the Director General, nor executive directors, nor other Employees of the Authority may conduct any financial, professional, or commercial activities, or hold any post that conflicts with their work at the Authority, without the approval of the Chairman or the Director General, as the case may be. b. A former Employee of the Authority may work for any Auditee that he has audited during his service with the Authority only after the lapse of three (3) years from the end date of his service or with the approval of the Director General. c. Neither the Director General, nor executive directors, nor other Employees of the Authority may serve as members on the boards or committees formed by any Auditee without the approval of the Chairman. d. Subject to liability, Employees of the Authority are prohibited from disclosing or divulging any information or data relating to their job duties. Audit Work

Article (13) The Authority will perform financial audit and compliance audit on all operations to verify their legitimacy and appropriateness, and accuracy of calculations; and to detect financial and administrative violations and take the necessary corrective actions, through the following steps:

-- 8 of 22 --

Law No. (4) of 2018 Establishing the Financial Audit Authority Page 9 of 22 1. examine the financial transactions undertaken by Auditees in the course of conducting and handling their financial and operational activities and transactions; 2. examine all data, documents, and instruments relating to the Auditees' Financial Statements; 3. verify, in coordination with concerned entities, proper implementation by Auditees of the legislation, policies, regulations, bylaws, and resolutions relevant to their work; of those they issue; or of those regulating their affairs; 4. audit the consolidated Financial Statements of the Government and issue an audit opinion thereon; issue a report on the outcomes of that audit stating the actual consolidated financial position of the Government; and review the final accounts of Auditees, in accordance with the work methodology and framework adopted by the Authority; 5. examine the final and consolidated Financial Statements of Auditees and their auditors’ working papers and reports; and issue the relevant reports; 6. verify the accuracy of calculation and collection of the Public Revenue and financial proceeds generated from the services provided, and the activities conducted, by Auditees and by the banks operating in the Emirate. These include, without limitation, taxes, fees, prices, tariffs, fines, sale proceeds, rental income, franchise revenue, profits, proceeds from encashing guarantees, and other sources; and 7. examine and audit the human resources administrative resolutions and procedures adopted by Auditees in relation to appointments, promotions, bonuses, increments, settlements, allowances, and other similar affairs to ensure that these resolutions are valid and compliant with the legislation in force and their regulatory bylaws. Performance Audit

Article (14) The Authority will conduct a performance audit of the duties and activities of Auditees in order to verify their efficiency and effectiveness. This includes the following: 1. verifying the effectiveness of optimal use of available resources “inputs” in delivering the required “outputs”, and assess to what extent organisational effectiveness and proper conduct of work have been achieved; 2. examining deviations that have arisen in the course of performing duties and activities, and identifying the causes of these deviations;

-- 9 of 22 --

Law No. (4) of 2018 Establishing the Financial Audit Authority Page 10 of 22 3. verifying the cost-effectiveness and quality of completed work and that it was implemented at the appropriate time and place; 4. verifying the extent of achievement by Auditees of their objectives and of their contribution to the achievement of the general strategic objectives and plans of the Government; 5. verifying the extent of achievement of prescribed performance goals with a view to improving the performance of Auditees; and 6. verifying that Auditees have responsibility accounting principles and rules in place. Auditing of Audit Systems

Article (15) The Authority will, in coordination with the concerned entities in the Emirate, conduct audit of Audit Systems in order to verify the efficiency and effectiveness of these systems in performing all operational activities and financial transactions of Auditees. This will include the following: 1. evaluating all assets, applications, software; operations, data, investments, means of communication and servers; and examining databases and the reports generated from Audit Systems to verify their efficiency and effectiveness in achieving the Auditees' objectives; 2. verifying the availability of Audit Systems that ensure the protection of Auditees; 3. verifying that Audit Systems are appropriate and effective; and evaluating the effectiveness of the procedures adopted by Auditees to protect the assets of these systems; 4. examining the reliability of Audit Systems, the integration of the operations and reports of these systems, and the governance systems of Auditees; 5. verifying that the funds allocated for Audit Systems have been used for the intended purposes and in accordance with the relevant regulatory legislation; and 6. verifying that the funds allocated in the General Budget for Audit Systems have not been exceeded.

-- 10 of 22 --

Law No. (4) of 2018 Establishing the Financial Audit Authority Page 11 of 22 Auditing the Efficiency and Effectiveness of Audit Systems

Article (16) The Authority will conduct audit of the efficiency and effectiveness of Audit Systems through: 1. examining Audit Systems and the procedures thereof in order to verify their appropriateness, identify weaknesses, and to provide recommendations to rectify any such weaknesses; and 2. evaluating, as per international best practices, the application of governance and enterprise risk management principles, performance management practices, internal control systems, the practices of internal audit units, and other practices adopted by Auditees, to identify the obstacles faced by Auditees and highlight development and improvement opportunities. Functions of Dubai Electronic Security Centre

Article (18) In accordance with its annual audit plan, the Authority will exercise its duties and powers under this Law in respect of the following entities whether they are located within or outside of the Emirate: 1. Government Departments; public agencies and corporations; Government authorities and councils, including the authorities supervising Special Development Zones and free zones, such as the Dubai International Financial Centre; and any other entities affiliated to the Government; 2. companies owned by the Government or Government Entities or those in which they hold twenty-five percent (25%) or more of the share capital. The Authority may, at its own discretion, audit companies in which the Government or Government Entities hold less than twenty-five percent (25%) of the share capital;

-- 11 of 22 --

Law No. (4) of 2018 Establishing the Financial Audit Authority Page 12 of 22 3. companies for which the Government guarantees a minimum profit; 4. entities which receive financial subsidies from the Government; 5. any enterprise or other entity which the Ruler or the Chairman assigns the Authority to audit; 6. other entities or enterprises that are audited by the Authority pursuant to the legislation regulating these entities and enterprises; and 7. any entity identified by the Authority to be involved in financial and administrative violations committed within any of the entities referred to in this Article, in which case, the Authority’s audit will be limited to such violations and in accordance with the legislation in force in the Emirate. Conduct of Audit Work

Article (20) a. The Authority may audit any accounts, documents, records, or papers as it deems necessary to conduct audit work effectively. Audit may be conducted at the premises of the Authority, the premises of the Auditee, or the premises of the entity where the accounts, records, and documents subject to audit are maintained. b. The Authority may require Auditees to link their Audit Systems with the Authority’s systems to enable remote audit and analysis of data relating to financial transactions and operational transactions. c. All information, data, and documents which will be perused by the Authority for audit purposes will be treated as confidential, whether disclosed at the premises of the Authority, the premises of an Auditee, or the premises of the entity where the accounts, records, and documents subject to audit are maintained. Audit of Documents and Records

Article (21) a. The Director General and the Authority Employees assigned to conduct audit may access any books, documents, records, or papers as required for

-- 12 of 22 --

Law No. (4) of 2018 Establishing the Financial Audit Authority Page 13 of 22 conducting the audit, and directly contact any of the Auditee Employees to enquire into any matter related to an audit or investigation conducted by the Authority. For this purpose, they may interview any Employee involved in any financial or administrative violation committed at an Auditee. b. Auditees must facilitate the work of Authority Employees by providing the required documents and records, or any other data they deem required for conducting the Audit; by enabling them to inspect Audit Systems; and by providing them with a suitable place to perform their work. Internal Audit Units

Article (26) An Auditee must: 1. provide the Authority with whatever is necessary to enable it to perform its duties, including any documents, records, papers, and information as the Authority may deem required for audit work in accordance with the provisions of this Law and the legislation in force; 2. enable Authority’s Employees to examine and assess Audit Systems in accordance with the provisions of this Law and the legislation in force; 3. provide the Authority with all data and information contained in its financial records, its draft Financial Statements, and the supporting documents thereof; 4. notify the Authority with and provide a copy of the resolutions issued for the delegation of authorities by the officials of Auditees to any of their Employees in accordance with the provisions of the above-mentioned Law No. (1) of 2016; 5. report to the Authority any financial and administrative violations committed within the Auditee; 6. establish organisational units for internal control; and 7. perform any other obligations as may be determined by the Chairman by virtue of resolutions issued in this respect. Financial Statements

Article (31) The following cases and incidents, without limitation, will be considered as financial and administrative violations and must be referred by an Auditee to the Authority for investigation: 1. failure to comply with the financial rules, regulations, and bylaws applicable to the Auditee; 2. failure to comply with the rules and provisions governing the implementation of the items of the General Budget or the Auditee's budget; 3. failure to comply with the rules and provisions governing the contracts and agreements concluded by the Auditee; 4. issuance of administrative resolutions that contradict with the legislation in force which may have a financial impact; 5. failure to comply with the rules and regulations governing warehouses and with the accounting policies issued by the Auditee; 6. failure to timely provide the Authority with the financial data, draft Financial Statements, and their supporting documents by the prescribed deadlines; or

-- 15 of 22 --

Law No. (4) of 2018 Establishing the Financial Audit Authority Page 16 of 22 failure to provide the Authority with the documents required to conduct audit work; 7. any disposition, act, omission, negligence, or dereliction of duty that results in damage to the Auditee or causes the loss of, or compromises, the financial rights thereof; 8. misappropriation of the Public Funds or Auditee’s funds, facilitating the misappropriation or embezzlement of such funds, or causing loss of the interests thereof; 9. wasting Auditee funds, or acting fraudulently with the intention of embezzling such funds; 10. abuse of a public office for deriving personal gains for himself or others; or for obstructing, hindering, or delaying the collection of the Public Revenue generated from the funds, taxes, and fees prescribed for the Government or Auditees; 11. falsification of official documents or use of false instruments; 12. receiving or soliciting a bribe; and 13. violations related to tax or customs evasion. Acts Subject to Investigation and Questioning

Article (32) Any person will be considered as a violator under the provisions of this Law, and will be subject to questioning and to disciplinary and criminal action, if he engages in any of the following acts: 1. obstructing audit work; or refusing to cooperate with the Authority Employees or to enable them to perform their duties as stipulated in this Law; 2. refusing to provide any information relevant to any investigation conducted by the Authority; 3. refraining from responding to any observation or correspondence of the Authority or delaying in providing such response for a period exceeding thirty (30) days without reasonable justification; 4. refusing to comply with any requirements or measures prescribed by the Authority; or 5. concealing any incident or case whose referral to the Authority for investigation is required by law.

-- 16 of 22 --

Law No. (4) of 2018 Establishing the Financial Audit Authority Page 17 of 22 Disciplinary Liability

Article (34) During any violation investigation conducted under the provisions of this law, the Director General, or his authorised representative, may take any of the following actions and measures: 1. request the Auditee to suspend the service of the violating Employee until the investigation is concluded; 2. retain the documents, papers, and records used in committing the violation; 3. close the investigation if the violation is found to be false or if it is proven that the Employee has not committed any of the violations stated in this Law; 4. refer investigation documents to the Public Prosecution if the investigation reveals that a criminal offence punishable by the law has been committed; 5. request the withdrawal of all decisions issued in relation to the violation and to reverse all legal or financial consequences that ensued from these decisions from the date on which such decisions are rendered; and/or 6. request the imposition of disciplinary action against the violating Employee, in which case the official in charge of the Auditee must issue an administrative resolution imposing the appropriate disciplinary action against that Employee and notify the Authority of the same within fifteen (15) days from the date of imposing the disciplinary action. Imposing Disciplinary Action on Violating Employees

Article (35) a. If the Director General considers the disciplinary action imposed on a violating Employee commensurate with the gravity of the committed violation, the

-- 17 of 22 --

Law No. (4) of 2018 Establishing the Financial Audit Authority Page 18 of 22 Auditee will be notified of the approval of the decision issued in respect of the violation. b. If the Director General considers the disciplinary action taken against a violating Employee incommensurate with the gravity of the committed violation, the Director General may request the official in charge of the Auditee to impose a severer disciplinary action that is commensurate with the gravity of the committed violation within seven (7) days from the date of being required to do so. If the official in charge of the Auditee fails to respond to that request, the matter will be referred to the Chairman to take the appropriate action in this regard. c. In any event, an Employee may submit a written grievance to the Grievance Committee referred to in Article (36) of this Law against any decision taken against him within fifteen (15) days from the date of being notified of the contested decision. Grievances Committee

Article (36) a. Pursuant to a resolution of the Chairman, a committee named the “Grievances Committee” will be formed, and will comprise three (3) to five (5) members. The committee will be chaired by a representative from the Authority with the membership of a representative from the Supreme Legislation Committee in the Emirate of Dubai and a representative nominated by the official in charge of the Auditee for which the aggrieved Employee works. The committee will consider the grievances submitted by the Employees against whom a disciplinary action is taken pursuant to the human resources legislation applicable within the Auditee. b. The Chairman will issue a resolution determining the terms of reference, powers, and the procedures for dealing with the committee. The decision issued by the Grievances Committee on a grievance will be final and non- appealable by any method of administrative review without prejudice to the aggrieved Employee’s right to have recourse to court. Liability for Violations

Article (37) a. An Employee will remain liable for any violations committed by him even if his service ends for any reason whatsoever. He may be subject to investigation, legal action, and any of the following penalties: 1. depriving the Employee of no more than twenty-five percent (25%) of the Pension for a period not exceeding three (3) months; or

-- 18 of 22 --

Law No. (4) of 2018 Establishing the Financial Audit Authority Page 19 of 22 2. cutting the Pension or the End-of-service Gratuity by no more than twenty- five percent (25%) from the date on which the disciplinary action is imposed against him. b. The Employee’s absence from work will not prevent him from being held disciplinarily liable for the violations he has committed, and his resignation may not be accepted if he is under investigation unless a final decision is issued in this regard. c. A disciplinary violation will expire upon the death of the violating Employee or upon the lapse of five (5) years from the date of discovery thereof. This limitation period will be interrupted once an investigation of the violation is initiated or upon referral of the violating Employee to the entity responsible for imposing the disciplinary action against the Employee or to any judicial authority having jurisdiction over any felony resulting from, or relating directly or indirectly to, that violation. A new limitation period will commence from the date of the last action taken in respect of the violation. Where multiple Employees are under investigation for the same violation, any interruption of that period for any Employee will be deemed an interruption of the limitation period for the other Employees even if no other interrupting action is taken against them. d. A penal action against a violating Employee will lapse in accordance with the general rules of limitation applicable to penal cases pursuant to the legislation in force. Law Enforcement Officers

Article (39) The Authority will issue the following reports: 1. a general annual report to be submitted by the Chairman to the Ruler on all activities and audit work performed by the Authority, observations and recommendations arising from the audit work conducted by the Authority, committed violations and the relevant action taken, including the penalties imposed against violators, and the requests and proposed corrective measures;

-- 19 of 22 --

Law No. (4) of 2018 Establishing the Financial Audit Authority Page 20 of 22 2. reports on audit findings, which contain the observations and recommendations of the Authority. These reports must be communicated in writing to Auditees; 3. a report on the results of auditing the draft consolidated Financial Statements of the Government. This report must contain the Authority’s audit opinion on the financial position of the Government and will be sent to the Department of Finance to implement any required changes and amendments based on the Authority’s feedback; 4. reports on the findings of the audit of the financial data and consolidated Financial Statements of Auditees; 5. reports on the findings of the general assessment of governance, enterprise risk management, performance management, internal control system, and the internal audit units of Auditees, and on the recommended development and improvement opportunities; 6. reports on the violations committed by Auditees; 7. special reports on any matter of critical importance that requires review by the competent authorities in the Emirate given its gravity and importance; and 8. any other reports that the Authority deems necessary and that are required to enable it to perform its duties under this Law. International Cooperation and Coordination

Article (41) a. The financial resources of the Authority will consist of: 1. the annual budget approved by the Ruler for the Authority; 2. the charges for the services provided by the Authority;

-- 20 of 22 --

Law No. (4) of 2018 Establishing the Financial Audit Authority Page 21 of 22 3. the charges for financial and accounting expert services assigned to or requested from the Authority; and 4. any other resources approved by the Chairman. b. The Director General will have all the powers required to manage, use, and implement the approved budget of the Authority. This includes the distribution of its appropriations, allocation of its revenues, supervising its implementation, and reallocation of budgetary chapters and items, in accordance with the relevant financial regulations adopted by the authority. Regulating the Authority Accounts and Records