Internal Controls for UAE MRV: source completeness, reconciliations, factors, estimates, approvals, audit trails, cybersecurity and internal audit

The law establishes the output and accountability framework: designated sources measure emissions regularly, prepare an inventory, report on required forms, reduce emissions, retain records and support authority verification. It does not provide a line-by-line corporate control manual. Management therefore needs to translate the obligation into control objectives that can be tested.

• Entity/facility register to general ledger, utility account list and equipment register.

• Fuel supplier totals to accounts payable and inventory movement.

• Electricity invoices to meter reads, site opening/closure dates and landlord statements.

• Refrigerant purchases and service logs to equipment charge and recovery.

• Activity-data subtotals to calculation workbook input ranges.

• Factor IDs and versions in the workbook to the approved factor register.

• Final emissions by source and gas to the submission form and verifier statement.

• Prior-period totals to restatement or methodology-change register.

Factors are master data, not text copied into a formula cell. Each factor needs a stable ID, publisher, edition, geography, technology, numerator/denominator unit, heating-value basis, GWP source and effective period. Changes should trigger an impact assessment and an approved decision on recalculating comparatives.

Estimates should have a reason, coverage period, proxy source, formula, uncertainty or sensitivity, reviewer and remediation date. Formula cells should be protected, tested against known cases and independently recalculated for material sources.

• Data owner confirms source completeness and explains anomalies.

• Method owner approves factor hierarchy, formulas and departures.

• Finance or operational reviewer performs reconciliations.

• Sustainability reviewer consolidates and challenges classification and estimates.

• Legal reviewer controls claims, authority wording and protected information.

• Management approves the final representation and submission package.

• System administrator manages access but does not approve the emissions result.

Show data lineage and cross-cutting cyber safeguards.

Cyber controls are not stated as a detailed checklist in Federal Decree-Law No. 11. They are implementation safeguards for the integrity and availability of evidence that the law requires companies to retain and provide. The control design should reflect the company’s risk profile and applicable UAE cyber/privacy requirements.

Internal audit can evaluate whether the control framework is designed appropriately and operated during the reporting period. It can test samples, observe reconciliations, inspect access logs and track remediation. It should not prepare the data it later audits, make management’s legal representation, or present its work as the authority’s verification.

“Each material data stream is reconciled to an independent operational or financial population. Emission factors are selected from an approved, version-controlled register. Estimates and formula changes require documented review. The final package is locked after technical, legal and management approval, and the submitted version and receipt are retained with the five-year evidence file.”

• Control descriptions exist but no owner or evidence is assigned.

• Finance and sustainability use different site lists.

• Factor URLs are stored without downloaded editions.

• Formulas are reviewed visually rather than recalculated.

• Estimates are overwritten when actual data arrives, losing the original trail.

• Administrator access is shared.

• The verifier receives a different version from management.

• Internal audit tests only the final total, not the source-to-submission lineage.

• Backup success is assumed without a restore test.

• A late correction is made without assessing the filed report or authority notification.

Perform source-population and data-stream reconciliations: entities, facilities, accounts and equipment to masters; fuel to invoices, ledger and stock; electricity and cooling to meters and accounts; refrigerants to equipment and gas movement; and factors to the approved register. Reconcile final totals to the approved workbook, submission form and receipt, and prior periods to the restatement or methodology-change register.

The audit trail should identify the preparer, reviewer, change, evidence and final approved version for each material data stream. Retain stable source and factor identifiers, calculation inputs and formulas, estimates, approvals, the locked submission, receipt, correction history and access logs.

Use role-based access and least privilege, multi-factor authentication, immutable change and approval logs, encryption and secure transfer, tested backups and recovery, incident response and legal hold. These are implementation safeguards for the integrity and availability of retained evidence, not detailed controls prescribed by the Decree-Law.