What powers does an auditor have, and when must they report to SSM?
The auditor can access all records at any reasonable time and require information from officers. They must report to SSM in writing if they find a breach of the Act that cannot be adequately dealt with by comment in the report or by raising it with the directors.
Section 266 of the Companies Act 2016 sets out the auditor's powers and duties.
Powers
- Access at all reasonable times to the accounting and other records, including registers (section 266(4)).
- The right to require information and explanations from any officer and from the auditor of a related company.
- For a holding company, access to subsidiaries' records and information (section 266(5)).
- Attend general meetings, receive notices and be heard (section 266(7)). In a private company, the auditor must attend a meeting where accounts are laid if given due notice of an intention to move a resolution requiring attendance (section 285(2)).
Duties
- Report to members on whether the statements give a true and fair view and comply with the Act and standards (section 266(2)).
- Form an opinion on whether all information and explanations were obtained and proper records and registers were kept, and give particulars of any deficiency (section 266(3)).
- Report to the Registrar if satisfied there has been a breach of the Act and the matter will not be adequately dealt with by comment in the report or by notifying the directors (section 266(8)).
- For public companies or companies controlled by public companies, report serious fraud or dishonesty offences (section 266(9)).
Protection. Good-faith reporting to the Registrar is not a breach of duty (section 266(10)).
What it means for you. Do not obstruct the auditor or withhold information; it can lead to a qualified report or a disclaimer, and the duty to report is not discretionary.
Legal basis
- Companies Act 2016, s.266
- Companies Act 2016, s.285
Sources
Applies to 2026 · Last reviewed 29 October 2026
General information for business owners, not legal, tax or professional advice. Rules change, so check the sources or ask a licensed professional before you act.
Related questions
- Does every Sdn Bhd in Malaysia need to be audited?Not every one, but audit is the default. Section 267(1) of the Companies Act 2016 requires a private company to appoint an auditor for each financial year, unless it qualifies for and elects the audit exemption set by SSM's Practice Directive 10/2024.
- What is audit exemption for private companies in Malaysia?Audit exemption lets an eligible private company choose not to appoint an auditor for a financial year. It rests on section 267(2) of the Companies Act 2016 and SSM Practice Directive 10/2024. The company still prepares and lodges unaudited financial statements.
- What are the audit exemption thresholds for a Sdn Bhd in 2026?For financial periods starting 1 January to 31 December 2026 (Phase 2), a private company must meet at least two of three tests: revenue up to RM2,000,000, total assets up to RM2,000,000, and no more than 20 employees. Each test covers the current and past two years.
- How do the 2025 to 2027 phases for audit exemption work?Practice Directive 10/2024 raises the audit exemption limits in three steps, based on when the financial period starts: 2025, 2026, and 2027 onwards. The final limits are RM3,000,000 revenue, RM3,000,000 total assets and 30 employees, reached for periods starting from 1 January 2027.
- How do I check if my Sdn Bhd qualifies for audit exemption?Pass at least two of three tests (revenue, total assets, employees) for the current financial year and the past two, using the limits for the phase your period falls in. Also confirm you are not an excluded company type, such as a subsidiary of a public company.