ICFR Reporting and Certification - Where Assurance Meets Accountability
What is ICFR Reporting?
ICFR reporting consolidates the outcome of all the work done across the lifecycle:
It provides an official record of what was tested, what failed, and how it was resolved, giving management the basis to sign off on control effectiveness.
Key ICFR Reporting Components
| Report Type | Audience | Purpose |
|---|---|---|
| Control Test Summary | Internal Controls / Risk Team | Summarizes test results, by process and control |
| Deficiency Register | Control Owners, Auditors | Lists gaps, remediation status, and timelines |
| Management Assertion Letter | Board, Regulators, External Auditors | Official declaration of ICFR effectiveness |
| Audit Committee Pack | Board Audit Committee | High-level briefing on status, material issues, action plans |
| Audience | Internal Controls / Risk Team |
| Purpose | Summarizes test results, by process and control |
| Audience | Control Owners, Auditors |
| Purpose | Lists gaps, remediation status, and timelines |
| Audience | Board, Regulators, External Auditors |
| Purpose | Official declaration of ICFR effectiveness |
| Audience | Board Audit Committee |
| Purpose | High-level briefing on status, material issues, action plans |
Example: Management Assertion (UAE Context)
"Based on our evaluation, we believe that the Company’s internal control over financial reporting as of December 31, 2026, was effective and provides reasonable assurance regarding the reliability of financial statements in accordance with IFRS. All identified deficiencies have been evaluated and no material weaknesses remain unresolved."
– CEO / CFO, [Company Name]
UAE Regulatory Landscape
SCA (for PJSCs):
- 2025: Preparation and voluntary early disclosure for mature issuers
- 2026: Non-public ICFR/ICOFR management assessment and auditor opinion
- 2027: Public ICFR report with auditor opinion; 2028 onwards: risk management included. Management should provide formal ICFR/ICOFR certification and ensure the auditor engagement letter includes ICFR assessment from FY2026 onwards
CBUAE (for Insurers):
- Maintain evidence of risk management and internal control design and operating effectiveness under applicable CBUAE regulations and standards
- ICFR-related deficiency and remediation tracking should form part of prudential governance and supervisory readiness
Corporate Tax:
- ICFR documentation supports taxable income, expense recognition, transfer pricing, digital records, seven-year retention and nine-month Corporate Tax filing/payment deadlines
ICFR Dashboard Metrics to Monitor
| Metric | Target |
|---|---|
| % Key Controls Tested | ≥ 90% |
| % Controls Rated Effective | ≥ 85% |
| % Deficiencies Remediated On Time | ≥ 95% |
| % Automated Controls | Year-on-Year Increase |
| % Entity-Level Controls Documented | 100% |
| Target | ≥ 90% |
| Target | ≥ 85% |
| Target | ≥ 95% |
| Target | Year-on-Year Increase |
| Target | 100% |
Certification Timing and Readiness Tips
- Complete control testing, deficiency evaluation and remediation tracking before the ICFR/ICOFR reporting cut-off
- Schedule an FY2026 dry-run/internal readiness review with internal audit or advisors before the auditor assessment
- Ensure documentation is audit-ready: clear, versioned, signed-off
- Agree assertion wording, Board/Audit Committee reporting routes and CEO/CFO sign-off responsibilities early
How Crowe Can Support ICFR Certification
We assist in:
- Preparing ICFR summary and dashboard reports
- Drafting management assertion letters
- Supporting auditor walkthroughs, FY2026 non-public ICFR/ICOFR assessment and FY2027 public reporting readiness
- Facilitating SCA integrated-report support, CBUAE evidence packs and remediation reporting
- Acting as independent advisors to validate ICFR program maturity, ISAE 3000 readiness and risk management integration for 2028
Coming Next Week: Final Week of the ICFR Series
In our concluding session, we’ll spotlight ICFR Across Industries, highlighting how financial reporting risks and control practices differ in sectors such as banking, real estate, retail, manufacturing and tech. Don’t miss the final instalment as we bring the series to a practical close with real-world applications.
Echoes of truth
Wednesday Deep Dive Echoes of Truth is a weekly thought-leadership series by Crowe’s Risk Advisory - Forensic & Process Excellence Division. It delivers practical insights on forensic investigations, fraud risk, governance, internal controls and process excellence. Each edition draws from real-world engagements and global best practices to help organizations identify red flags, strengthen controls, optimize processes, and build resilient, transparent and high-performing operations.