Muhammad Anas Kaleemullah
Internal Audit Risk Assessment Internal Control Investigations
Assurance that holds up when it is tested, for businesses growing faster than their controls. Eight-plus years of professional experience across the UAE and Pakistan, in risk-based assurance, internal control, fraud investigation and advisory work to the IIA Standards. Most recently I set up an internal audit function and led it, with a team of three, and up to six on larger engagements.
- CIA
- IAP
- CIMA Adv. Dip. MA
- GIAS 2024
- UAE visa & licence
- Open to GCC relocation
- 8+Years of professional
experience - 22Entities audited, standalone
and within groups - 5Sectors: F&B, shipping and commodities,
logistics, IT, healthcare - 14+Group audit engagements, reported
to the board and management
All figures drawn from documented engagements
About
Eight-plus years of assurance
and advisory.
headshot.jpg
My work covers internal audit, GRC, internal control, risk assessment and fraud investigation, across F&B, shipping and commodities, logistics, IT and healthcare. It began with contractual roles at EY Ford Rhodes and Grant Thornton. From there I held internal audit positions in healthcare, courier and IT services businesses in Karachi, and then spent two years in the group internal audit function of a UAE conglomerate with more than twelve entities.
Today I am head of internal audit for a multi-outlet F&B group in Abu Dhabi, reporting to the Managing Director, with a team of three that grows to five or six on larger engagements. I wrote the charter, the methodology, the risk-based annual plan and the investigation protocol, and I have run them through six audit cycles. Investigations reach findings that hold. Advisory work is done under documented safeguards, so independence is not compromised.
Work done
Four strands of work,
carried across five employers.
Each strand is set out the same way (context, approach, outcome) across the organisations where the work was done. Select a card to open it. Employer-level detail is in the Experience section.
-
Building the audit function
Internal audit set up where none existed (charter, methodology, risk-based plan, investigation protocol, reporting standards) and run to the IIA Standards as head of function with a small team.
Context
Organisations that had grown without independent assurance. There was no charter or methodology, controls were undocumented, and irregularities had no independent route for investigation. New sites were opening without any pre-opening check.
Approach
The charter and the reporting line came first, so that the function had authority from the start. Methodology, a risk universe, an annual plan, an investigation protocol and reporting standards followed. Under documented independence safeguards, I designed a controlled document set, a standards register and a monitoring programme, and supervised a small compliance and documentation team. For new sites I set audit gates: a pre-opening go or no-go review, Day-0 float and inventory count observation, and Day-30 and Day-60 reviews.
Outcome
A function operating to the IIA Global Internal Audit Standards 2024 within its first year. Six audit cycles were delivered. Investigations reached sustained findings with remediation endorsed by the executive. Point-of-sale privilege gaps were closed, every new outlet passed through audit review, and a set of more than fifty controlled governance documents is in place and in use.
-
Group internal audit
Entity and process audits across multi-entity groups (payments, reconciliations, inter-entity accounting, operations, fixed assets, petty cash), reported to the board and management.
Context
Groups of standalone and consolidated entities in trading, shipping, logistics, IT and F&B. Processes crossed entity lines and central controls were thin. Operational reporting had never been independently tested, capital purchases were being expensed instead of recognised as assets, and cash was handled at remote hubs and outlets.
Approach
Risk-based programmes across some twenty-two entities. Group-wide process audits covered payment execution, bank reconciliation across business units, inter-entity accounting and cargo release, among other processes. Operational audits ran end to end, from procurement through to consumption, with reported figures traced to delivery evidence. Where the data allowed, I reviewed full populations: petty cash including cash payroll, and a corporate fixed asset register built to item level from the expense records, tied out to the general ledger and physically tagged in several countries. Compliance monitoring reached hub and outlet level across national networks.
Outcome
More than fourteen group engagements reported to the board and management. Breaches of delegated authority, reporting gaps and gaps in delivery evidence were surfaced and acted on. The fixed asset register now agrees to the ledger and to physical verification, and includes assets that had previously sat in expenses. A last-mile network reached 99% compliance with its operational standard.
-
Advisory and assurance
Advice to directors and executives on the way forward from findings, and control, programme and channel design (including delivery aggregator onboarding) under documented independence safeguards, alongside assurance over the same organisations.
Context
Management teams that needed more than a list of findings. Controls had to be designed, compliance programmes reached, and remediation agreed and tracked. The audit function had to help with all of this without losing its independence.
Approach
Every advisory engagement was documented with safeguards separating it from later assurance over the same area. Design work included remote compliance monitoring with a defined review methodology, standards registers, scopes of work and a redesign of point-of-sale privileges. I supported two compliance programmes, ISACA's CMMI V2.0 Maturity Level 2 and ISO 18295-1:2017, including a review of the supplier agreement policy. I took over the onboarding of outlets onto third-party delivery aggregators part way through and carried it to completion, with the platform, menu and settlement arrangements recorded for each outlet and channel. Findings went to directors, the way forward was agreed with them, and remediation was tracked to closure.
Outcome
Both compliance programmes succeeded: the CMMI implementation audit was cleared and ISO compliance was attained. Monitoring programmes are in operation and controls were redesigned on the basis of investigation findings. Outlets are live on four delivery aggregators, with the arrangements on record. Remediation was endorsed by the executive and closed, and independence was documented and preserved throughout.
-
Governance and compliance
Whistle-blowing, conflict of interest and code of conduct frameworks written. Director-level disciplinary matters and investigations handled, board presentations prepared, and control design assessed against regulatory requirements.
Context
Organisations without the governance instruments a board expects: no whistle-blowing route, no incident reporting, no enterprise conduct policies. Matters were arising at director level that needed independent handling. Control frameworks had never been measured against regulation or the Standards.
Approach
I wrote the frameworks and policies (whistle-blowing, incident reporting, conflict of interest, code of conduct) and saw them adopted across each organisation. I prepared governance-level documents for director-level disciplinary hearings, and board presentations when assigned. I led a fraud investigation under the guidance of a Chief Audit Executive and examined a case of misuse of delegated authorities. I assessed control design across operations and head office functions against regulatory requirements and the IIA Global Internal Audit Standards 2024, using population-based judgmental sampling.
Outcome
The policies are in force across whole organisations. Director-level matters were documented to a standard the board could act on, and both investigations concluded with reported findings. Control observations went to management with their regulatory basis stated, and remediation was tracked.
Core competencies
What I am brought in to do.
Twelve areas where the work is documented, repeatable and standards-aligned. Select one to see where it has been applied.
-
Building the function
Charter, methodology, risk-based annual plan, investigation protocol and reporting standards, established from nothing and then operated.
Where it has been applied
- A charter and a reporting line to the Managing Director, which gave the function standing with the executive.
- Methodology, a risk-based annual plan, an investigation protocol and reporting standards, written and then run through six audit cycles.
- A controlled governance document set of 50+ items and a 27-sub-category standards register.
- Supervision of a three-person compliance and documentation team (QC, outlet auditor, technical writer).
-
Risk assessment and audit planning
Entity and process risk assessment, risk universe to annual plan, risk and control matrices, finding-closure tracking.
Where it has been applied
- Risk assessments across an IT services group and its logistics and e-commerce subsidiaries. At an F&B group, a risk universe built and prioritised into an annual plan for executive approval.
- Risk and control matrices, walkthroughs and control testing under annual risk-based plans at TCS and at the conglomerate, where there were more than fourteen group engagements in two years.
- Workpaper review and finding-closure tracking so that remediation is evidenced, not asserted.
-
Internal control assessment and Standards
Control design and operating effectiveness assessed against COSO, the IIA Standards and regulatory requirements, through walkthroughs, testing and workpaper review.
Where it has been applied
- IIA Global Internal Audit Standards 2024 and the COSO Internal Control framework as the working basis for planning, fieldwork and reporting.
- Control design assessed across operations and head office functions (HR, Finance, Project Management, IT) against UAE regulatory requirements, using population-based judgmental sampling. Walkthroughs and control testing under risk-based plans at TCS and the conglomerate.
- Independence documented and preserved. Advisory work is run under written safeguards so that later assurance over the same area is not compromised.
-
Fraud and misconduct investigation
Allegation to sustained finding: asset misappropriation, revenue suppression, misuse of delegated authority, conduct and policy breaches.
Where it has been applied
- Investigation types handled: misappropriation of cash and inventory, revenue suppression at point of sale, misuse of delegated authorities, breaches of conduct and food-safety policy, misstated costing.
- A written protocol governing intake, evidence preservation, interviews and reporting, so findings survive challenge.
- A fraud investigation led at TCS under the guidance of the Chief Audit Executive. Misuse of delegated authority investigated at a hospital. Investigations at an F&B group taken through to remediation endorsed by the executive.
-
Advisory and consulting
Advising directors and executives on the way forward from findings, and designing controls and programmes under documented independence safeguards.
Where it has been applied
- Advice to directors on the way forward from findings across an IT services group and its logistics and e-commerce subsidiaries.
- Programme and control design as advisory work at an F&B group, including a Remote Outlet Compliance Monitoring programme, a standards register, a scope of work and a CCTV review methodology.
- Every advisory engagement documented with safeguards separating it from subsequent assurance.
-
Governance policy and board support
Whistle-blowing, conflict of interest and code of conduct frameworks, documents for director-level matters, and board presentations.
Where it has been applied
- Whistle-blowing framework and policy, Conflict of Interest and Code of Conduct policies authored and adopted at a hospital and a national courier.
- Incident Reporting Framework implemented at the hospital.
- Governance-level documents prepared for director-level disciplinary hearings, and board presentations prepared as assigned by heads of department.
-
Compliance frameworks
Supporting organisations to attain and hold formal compliance and maturity standards.
Where it has been applied
- ISACA's CMMI V2.0 Maturity Level 2: the implementation audit was cleared at an IT services group, and the contribution was recognised with a Certificate of Achievement.
- ISO 18295-1:2017 compliance attained by the same group, including review and enhancement of the Supplier Agreement Management policy.
- UAE regulatory requirements used as the benchmark for control-design assessment in an F&B group.
-
Procure-to-pay and payments
Payment execution, procurement, delegated-authority breach reporting, bank reconciliation and inter-entity accounting.
Where it has been applied
- Payment execution audited group-wide across twelve-plus entities, with delegated-authority breaches reported.
- Bank reconciliation across five business units, inter-BU accounting, cargo release and other treasury and settlement processes.
- Accounts payable and procurement cycles audited at an F&B group.
-
Inventory, fixed assets and cash
Inventory and wastage controls, fixed asset registers to item level, petty cash and cash payroll populations.
Where it has been applied
- A corporate fixed asset register built to item level from expensed items, tied out to the general ledger and physically tagged across UAE and overseas offices.
- Full petty cash populations reviewed, including cash payroll, and petty cash reports from logistics hubs across a national network.
- Inventory and wastage controls audited at outlets, roastery and central production, with Day-0 float and inventory count observation at new outlets.
-
Revenue and point-of-sale assurance
Revenue integrity at the till: privilege design for discounts, voids and waived bills, and the evidence trail behind them.
Where it has been applied
- Point-of-sale privilege gaps in discount, void and waived-bill controls identified and closed.
- Waived-bill controls specified and piloted at outlet level before roll-out.
- Investigation findings on revenue suppression fed back into control redesign.
-
Data analysis and continuous monitoring
Population-based testing and CAATs, exception analysis, remote compliance monitoring, and AI-enabled audit automation.
Where it has been applied
- Full populations tested where the data allows (payments, petty cash, fixed assets), with exceptions analysed and traced to source.
- Remote Outlet Compliance Monitoring using CCTV and system data, with a defined review methodology.
- Network-wide weighing-machine compliance monitored across a last-mile delivery network, reaching 99%.
- AI-enabled tooling: a risk-assessment agent, an audit command centre integrated with Microsoft Dynamics 365 Business Central, and automated assurance-briefing pipelines.
-
Audit reporting and executive communication
Reports written to a standard for board and management readers, with findings that get acted on.
Where it has been applied
- Reporting standards authored so findings read the same way regardless of subject.
- Group audit reports issued to the board and management across fourteen-plus engagements.
- Board presentations prepared at a hospital and a national courier. Investigation reports taken through to remediation endorsed by the executive.
Experience
Experience
-
Internal Auditor
May 2025 to presentJoud Coffee · Crave Restaurants Management
Abu Dhabi, UAE · Reporting to the Owner / Managing Director. Multi-outlet F&B group: coffee shops, cafés, roastery, central production.
- Built the internal audit function end to end (charter, methodology, risk-based annual plan, investigation protocol, reporting standards) and supervised a three-person compliance and documentation team (QC, outlet auditor, technical writer) supporting the function's monitoring and documentation programmes.
- Led fraud and misconduct investigations to sustained findings with executive-endorsed remediation: cash-sale suppression, cash variances, unauthorised inventory use, food-safety breaches, misstated recipe costing.
- Delivered engagements across six cycles (accounts payable, procurement, inventory, roastery, central production, outlet operations), closing POS privilege gaps in discount, void and waived-bill controls.
- Ran independent pre-opening and post-opening audit reviews across outlet projects.
- Assessed control design across operations and head office functions against UAE regulatory requirements and the IIA Standards, reporting observations to management.
- Advisory, under documented independence safeguards: authored 50+ controlled governance documents and designed a Remote Outlet Compliance Monitoring programme, 27-sub-category standards register, scope of work and CCTV review methodology.
- Deployed AI-enabled audit tooling: risk-assessment agent, audit command centre integrated with Microsoft Dynamics 365 Business Central, automated assurance-briefing pipelines.
-
Internal Auditor
May 2023 to Apr 2025Private UAE group · commodity trading and shipping
Dubai, UAE · Group internal audit and advisory function covering entities across the UAE, China, India and other overseas offices.
- Delivered 14+ audit engagements across 12+ group entities in commodity trading (metals, oil, fuel), shipping and corporate functions, with reports issued to the board and management.
- Executed group-wide process audits, including payment execution, bank reconciliation across five business units, inter-BU accounting and cargo release, and reported breaches of delegated authority.
- Audited shipping end to end across four entities (bunkering, chartering, fleet catering) and surfaced gaps in consumption reporting and delivery evidence.
- Built the corporate fixed asset register to item level, with general ledger tie-out and physical tagging across UAE and overseas offices. Previously only vessels, vehicles and similar major items were recognised and other capital purchases were expensed. Reviewed the full petty cash population, including cash payroll.
-
Internal Auditor
Mar 2022 to Jan 2023Arpatech (Pvt) Ltd · software development, IT consultancy and customer support for international clients; owner of Forrun Logistics and an online pharmacy
Karachi, Pakistan
- Led the audit workstream that took the group to ISACA CMMI V2.0 Maturity Level 2 and to compliance with ISO 18295-1:2017 (customer contact centres), including redesign of the Supplier Agreement Management policy.
- Provided assurance across last-mile delivery operations, the e-commerce pharmacy and head office functions. Reviewed petty cash reporting from logistics hubs nationwide, checked weighing-equipment compliance at hubs (reaching 99% network-wide) and advised directors on control gaps.
- Recognised with a Certificate of Achievement for the CMMI implementation audit and the Extra Arpatech Mile team award, Q2 2022.
-
Senior Officer, Internal Audit
Feb 2020 to Feb 2022TCS Private Limited · logistics and courier
Karachi, Pakistan · Reporting to the Chief Audit Executive.
- Risk-based audits of general controls across the company's operations.
- Led a fraud investigation under the CAE's direction, from allegation through evidence to a documented outcome.
- Authored the whistle-blowing policy, Conflict of Interest policy and Code of Conduct adopted company-wide. Prepared governance papers, including director-level disciplinary hearing files and board presentations as assigned.
-
Assistant Manager, Internal Audit
Sep 2018 to Jan 2020Chiniot General Hospital · healthcare
Karachi, Pakistan · Joined as Internal Audit Officer and promoted in October 2019.
- Directed financial, operational and regulatory audits, and investigated a case of misuse of delegated authorities.
- Authored the whistle-blowing framework and policy, the Incident Reporting Framework, and the Conflict of Interest and Code of Conduct policies.
- Prepared governance-level documents for director-level disciplinary hearings, and board presentations as assigned by heads of department.
- Supervised deployment of an in-house inventory management system and optimised the financial close, including general-ledger reconciliations.
-
Internal Audit Associate
Nov 2017 to Jun 2018Grant Thornton Pakistan · Grant Thornton Anjum Rahman, chartered accountants
Karachi, Pakistan · Contractual engagement.
- Marwat Group, an oil transportation business (external audit): assisted the audit team with preparation and audit of financial statements for the six years to June 2017, including vouching of expenses, lead schedules, analytical review and substantive testing of receivables.
- Al-Abbas Fabrics (Pvt) Ltd (outsourced internal audit): pre-audit work verifying payments, expenses, overtime, final settlements, salary disbursements, allowances and advances.
- M3 Tech (Pvt) Ltd, an IT company headquartered in Malaysia (internal audit): two quarters completed in 24 working days, with tests of controls and details, walkthroughs, process descriptions, lead schedules and analytical review, covering direct and indirect expenses, cash and bank, and petty cash.
-
Tax Executive
Jan 2017 to Jun 2017EY Ford Rhodes Sidat Hyder · member firm of Ernst & Young Global
Abu Dhabi, UAE · Karachi, Pakistan · Contractual engagement.
- Seconded to First Abu Dhabi Bank (formerly NBAD) in Abu Dhabi, January to April 2017, on compliance with the OECD Common Reporting Standard and the Foreign Account Tax Compliance Act.
- Johnson & Johnson, Karachi: stock-taking, supervision of the destruction of expired products, reporting of discrepancies.
- International Brands Limited, Karachi: treasury department support, including MIS and sales and distribution reports, invoice knock-off and report tracking.
Certifications & education
Qualified, and current.
-
2024
Certified Internal Auditor (CIA)
The Institute of Internal Auditors
-
2021
Internal Audit Practitioner (IAP)
The Institute of Internal Auditors
-
2016
Advanced Diploma in Management Accounting
CIMA, United Kingdom
-
2019
Bachelor of Commerce
Dadabhoy Institute of Higher Education, Karachi
Prior designations (inactive): GRCP, GRCA (OCEG) · IDPP, IPMP (GRC Certify) · MIPA (Institute of Public Accountants, Australia) · AFA (Institute of Financial Accountants, UK)
Recognition
| Year | Recognition | From | Context |
|---|---|---|---|
| 2022 | Certificate of Achievement, CMMI 2.0 Model Implementation Audit | ARPATECH | In recognition of contribution to clearing the CMMI (Capability Maturity Model) 2.0 implementation audit. Signed by the SVP Operations and VP Human Resources. |
| 2022 | Team Award (The Extra Arpatech Mile Award), Q2 2022 | ARPATECH | Quarterly company award, in recognition of performance and dedication. Signed by the SVP Operations and VP Human Resources. |
Credential numbers and verification references are available on request. The IIA designations can be verified directly with the Institute.
Skills & tools
The working toolkit.
-
Standards & frameworks
-
Audit & investigation
-
Monitoring & analytics
-
Process controls
-
Systems
-
Languages
Contact
Let's talk about
the audit you need built.
Based in Abu Dhabi and open to relocation within the GCC.