Audit in Malaysia

When you need an audit, who can do it, and what happens if you skip it. 50 questions answered.

Does every Sdn Bhd in Malaysia need to be audited?Not every one, but audit is the default. Section 267(1) of the Companies Act 2016 requires a private company to appoint an auditor for each financial year, unless it qualifies for and elects the audit exemption set by SSM's Practice Directive 10/2024.
What is audit exemption for private companies in Malaysia?Audit exemption lets an eligible private company choose not to appoint an auditor for a financial year. It rests on section 267(2) of the Companies Act 2016 and SSM Practice Directive 10/2024. The company still prepares and lodges unaudited financial statements.
What are the audit exemption thresholds for a Sdn Bhd in 2026?For financial periods starting 1 January to 31 December 2026 (Phase 2), a private company must meet at least two of three tests: revenue up to RM2,000,000, total assets up to RM2,000,000, and no more than 20 employees. Each test covers the current and past two years.
How do the 2025 to 2027 phases for audit exemption work?Practice Directive 10/2024 raises the audit exemption limits in three steps, based on when the financial period starts: 2025, 2026, and 2027 onwards. The final limits are RM3,000,000 revenue, RM3,000,000 total assets and 30 employees, reached for periods starting from 1 January 2027.
How do I check if my Sdn Bhd qualifies for audit exemption?Pass at least two of three tests (revenue, total assets, employees) for the current financial year and the past two, using the limits for the phase your period falls in. Also confirm you are not an excluded company type, such as a subsidiary of a public company.
How are revenue and total assets measured for the audit exemption test?Revenue means revenue received and receivable in the year, excluding reversals, tax entries, reversed provisions and gains on disposal of property, plant, equipment and investment property. Total assets are all current and non-current assets as defined by the applicable accounting standards.
Who counts as an employee for the audit exemption headcount?Only full-time paid workers at financial year-end count: local, foreign, contract and probationary staff. Full-time means at least six hours a day for at least 20 days a month, or 120 hours a month. Working directors, working shareholders and unpaid family or friends are excluded.
Is a dormant company exempt from audit in Malaysia?Yes, if it has been dormant since incorporation or was dormant in both the current and immediately preceding financial year. A company is dormant when it carries on no business and has no accounting transaction, ignoring payments it must legally make.
Which companies cannot use the audit exemption?Public companies (including listed ones), private companies that are subsidiaries of a public company, foreign companies, and exempt private companies that choose to lodge an exempt private company certificate instead of financial statements cannot use the audit exemption.
Can a Sdn Bhd with foreign or corporate shareholders claim audit exemption?Yes in principle. SSM's FAQ says a private company with corporate shareholders can use the exemption if it meets the criteria. The exclusion is for foreign companies themselves (such as registered branches) and subsidiaries of public companies, not for foreign shareholders.
Do I need to apply to SSM for audit exemption, and who decides?No application or form is needed. A company that meets the criteria simply elects not to appoint an auditor. In practice the directors make and certify that choice, since a director signs the certificate lodged with the accounts, but members can still force an audit.
What must an audit-exempt company still lodge with SSM?It must lodge unaudited financial statements, the directors' report, statement by directors, statutory declaration and a director-signed exemption certificate, within 30 days of circulating the accounts to members. Accounts must follow approved accounting standards.
Can shareholders or SSM force an audit-exempt company to be audited?Yes. An otherwise eligible company must audit if it receives written notice, no later than one month before its financial year ends, from members holding at least 5% of shares, at least 5% of voting members, or from the Registrar directing an audit.
When does a company lose its audit exemption?When it stops meeting the criteria (for example, it passes only one of the three tests, or stops being dormant), it is no longer exempt for future years but stays exempt for the years in which it did qualify. A 5% member notice or a Registrar direction can also require an audit.
Does the old Practice Directive 3/2017 audit exemption still apply?Only for financial periods that started on or before 31 December 2024. Practice Directive 10/2024 revoked PD 3/2017 and applies to financial periods commencing on or after 1 January 2025. A period's start date decides which regime applies.
If my company qualifies for audit exemption, can I still choose to have an audit?Yes. Exemption is a choice. SSM's FAQ says the company can always appoint an auditor if there is a need and it is not prohibited from doing so. Reasons include bank requirements, investor demands, tenders and group reporting.
If my company is audit-exempt, can I file Form C with LHDN using unaudited accounts?SSM's FAQ says LHDN has announced that if a company is not required to submit audited accounts to SSM, section 77A(4) of the Income Tax Act does not apply. The audit rule for tax sits in a separate law, so confirm LHDN's current practice before filing.
When must a new Sdn Bhd appoint its first auditor?The board must appoint the first auditor at least 30 days before the end of the period allowed for lodging the company's first financial statements with SSM. The first financial statements must be prepared within 18 months of incorporation.
How is the auditor reappointed each year in a private company?Members appoint the auditor by ordinary resolution during the 30 days before the lodgement deadline for the previous year's accounts. If no one is appointed, the sitting auditor is usually deemed reappointed, unless members object or the constitution requires actual reappointment.
What happens if a Sdn Bhd fails to appoint an auditor?The company and every director commit an offence under section 267(7). Any member can apply in writing for the Registrar to appoint an auditor under section 268. Failing to have the accounts audited can also expose directors under section 248.
Who can legally be the auditor of a Sdn Bhd in Malaysia?Only an approved company auditor, approved under section 263 of the Companies Act 2016, or a firm whose resident partners are all approved company auditors. The person must also pass the independence and disqualification tests in section 264.
How does someone get an approved company auditor licence in Malaysia?A chartered accountant applies for approval under section 263 of the Companies Act 2016, handled by the Accountant General's Department on behalf of the Finance Minister. Conditions include a valid MIA practising certificate, audit experience, MIA's Public Practice Program and an interview.
What is the difference between MIA membership, a practising certificate and an audit licence?MIA membership (chartered accountant) is the professional qualification. A practising certificate lets a member work in public practice. The audit licence is the separate approval under section 263 that lets a member act as company auditor. An auditor in Malaysia normally holds all three.
What is the Audit Oversight Board (AOB) and does it affect my Sdn Bhd?The AOB is a body under the Securities Commission that registers, inspects and disciplines auditors of public-interest entities such as listed companies. A typical private Sdn Bhd is not an AOB-regulated audit, though its auditor may also be on the AOB register.
Can the firm that does my bookkeeping also be my statutory auditor?The Companies Act bars auditors who are officers of the company or partners, employers or employees of officers, and those owed or owing over RM25,000. Whether a firm may both keep your books and audit them depends on professional ethics rules, which allow only routine or mechanical bookkeeping for most private-company audit clients, with safeguards.
How can shareholders remove a company's auditor?Members can remove an auditor at any time by ordinary resolution at a general meeting, on special notice. The company must send the notice to the auditor and SSM, the auditor may make written representations, and the company must tell SSM within 14 days of the resolution.
What happens when an auditor resigns from a Sdn Bhd?The auditor gives written notice to the company's registered office, and resignation takes effect after 21 days or a later date stated. The company must send a copy of the notice to SSM within seven days, and the auditor must also send the statement of circumstances to SSM.
How do I change auditors for my Sdn Bhd?Pick the new auditor, who must contact the existing one for professional clearance, then replace the old auditor by resolution (members) or fill the vacancy (board). Notify SSM of removal within 14 days or resignation within seven. A written resolution replacing an auditor needs 28 days.
What is a professional clearance letter when changing auditors?It is a written request from the incoming auditor to the existing auditor, asking whether there is any professional reason not to accept the appointment. It comes from professional ethics rules, based on the international Code that MIA's By-Laws follow, not from the Companies Act.
What does a statutory audit of a Sdn Bhd actually involve, step by step?The auditor agrees the engagement, plans around risks, tests records and balances, gathers outside confirmations, discusses adjustments, obtains management's representations, then issues a report stating whether the accounts give a true and fair view. Directors approve and sign the accounts.
How long does a Malaysian statutory audit take?The law sets no audit duration, only the end deadlines: accounts must be circulated within six months of year-end and lodged within 30 days after. How long fieldwork takes depends on company size, record quality and how fast you respond.
What documents will an auditor ask for in a Sdn Bhd audit?Expect trial balance and ledgers, bank statements and reconciliations, sales and purchase documents, stock records, a fixed asset register, loan and lease agreements, payroll and statutory contributions, related-party details, statutory registers and minutes, and tax computations and returns.
What are audit confirmations (bank, debtor, creditor) and why do auditors send them?A confirmation is a request the auditor sends directly to a third party, such as your bank, a customer or a lawyer, to verify a balance or fact. Evidence from outside the company is generally more reliable than the company's own records.
What is a management representation letter and do I have to sign it?It is a letter signed by the directors at the end of the audit confirming that they provided all records, disclosed all known matters and believe the accounts are fairly stated. Auditors normally require it before issuing their report, and refusal can lead to a modified opinion or no opinion.
What are audit adjustments and what should I do when the auditor proposes them?Audit adjustments are corrections the auditor proposes to your accounts, such as missing accruals, wrong cut-off or depreciation. Management decides whether to post them. If material errors are not corrected, the auditor may modify the opinion.
What are the types of audit opinion in Malaysia and what do they mean?There are four: unmodified (clean), qualified (accounts fair except for a specific matter), adverse (accounts materially misstated overall) and disclaimer (the auditor could not get enough evidence to give any opinion). The last three are called modified opinions.
What is an emphasis of matter paragraph in an audit report?It is an extra paragraph that points readers to something already disclosed in the accounts that is fundamental to understanding them. It does not change the opinion. A going concern problem that is properly disclosed is now shown in a separate material uncertainty section instead.
How does a qualified or adverse audit opinion affect bank loans and tax?No law bans lodging a modified opinion, but lenders, tenderers and investors usually treat it as a warning and may ask questions, add conditions or decline. Tax is mostly separate: LHDN works from your financial statements and tax computation, not the opinion type.
What does going concern mean in an audit?Going concern means the company is expected to keep operating for the foreseeable future. Directors assess it when preparing accounts, and the auditor checks that assessment. If doubt exists, it must be disclosed and the auditor reports it in a separate section.
What are the deadlines to circulate and lodge financial statements for a Sdn Bhd?A private company must prepare and circulate its financial statements to members within six months of its financial year-end, then lodge them with SSM within 30 days of circulation. The first accounts may cover up to 18 months from incorporation.
Does a Sdn Bhd have to hold an annual general meeting (AGM)?Under the Companies Act 2016, the AGM requirement in section 340 is written for public companies. A private company circulates its financial statements to members within six months of year-end and is not required by that section to hold an AGM, unless its constitution says otherwise.
What are the penalties for late lodgement or late circulation of financial statements?Late circulation under section 258 carries a fine up to RM50,000 plus RM500 a day after conviction. Late lodgement under section 259 carries a fine up to RM50,000 plus RM1,000 a day while it continues. SSM may extend lodgement if you apply before the deadline.
What are the consequences if a Sdn Bhd that must be audited does not have an audit?Directors can face a fine up to RM500,000 or up to one year in prison under section 248, the company and directors commit an offence under section 267(7), and SSM can appoint an auditor on a member's application. Accounts also cannot be properly circulated or lodged.
What determines how much a statutory audit costs in Malaysia?Fees are agreed between the company and auditor and depend mainly on the effort required: company size, transaction volume, complexity, record quality, group structure and the auditor's risk. The Companies Act does not set audit fees, so any specific price should come from the auditor.
What is different about the first-year audit of a new Sdn Bhd?The first financial period can run up to 18 months from incorporation, the board appoints the first auditor, and there are no prior-year figures to compare. The auditor focuses on set-up transactions, share capital and opening position, so good records from day one matter.
What is the difference between an audit, a review and a compilation of accounts?An audit gives the highest level (reasonable) assurance and is the only one that meets the statutory audit requirement. A review gives limited assurance, and a compilation gives none, because the accountant only assembles the figures. Only a valid audit or a valid audit exemption satisfies the Companies Act.
When do banks, tenders or grants require audited accounts even if my company is exempt?Company law may excuse an audit, but lenders, tender bodies, grant providers and investors set their own conditions and often ask for audited accounts. SSM itself notes exempt companies may still need audits for financing or contractual obligations.
What powers does an auditor have, and when must they report to SSM?The auditor can access all records at any reasonable time and require information from officers. They must report to SSM in writing if they find a breach of the Act that cannot be adequately dealt with by comment in the report or by raising it with the directors.
Does an audit guarantee that there is no fraud or error in the accounts?No. An audit gives reasonable, not absolute, assurance that the accounts are free of material misstatement. It does not test every transaction and is not designed to find all fraud. Directors remain responsible for the accounts and internal controls.
Who is responsible for the accounts: the directors or the auditor?The directors are responsible for keeping records, preparing the financial statements and approving them. The auditor is responsible only for forming and reporting an independent opinion. Hiring an auditor does not move the directors' duties onto the auditor.