What does a statutory audit of a Sdn Bhd actually involve, step by step?
The auditor agrees the engagement, plans around risks, tests records and balances, gathers outside confirmations, discusses adjustments, obtains management's representations, then issues a report stating whether the accounts give a true and fair view. Directors approve and sign the accounts.
Section 266 of the Companies Act requires the auditor to report to members on whether the financial statements give a true and fair view and comply with the Act and approved accounting standards. How firms get there varies, but the usual sequence is:
- Engagement. The company appoints the auditor and agrees terms (scope, responsibilities, fee).
- Planning and risk assessment. The auditor learns the business, controls and key risk areas, and sets a plan.
- Records and balances testing. Sampling transactions, checking supporting documents, recalculating, and reviewing estimates.
- Third-party evidence. Bank and other confirmations, and attendance at stock counts where inventory matters.
- Review of the accounting policies and notes against approved standards.
- Findings discussed with management. Proposed adjustments and disclosures are raised.
- Management representation letter signed by the directors.
- Going concern and subsequent events review.
- Audit report (opinion) issued after the directors approve the financial statements (section 251).
- Circulation and lodgement with SSM.
Auditor's rights. Section 266(4) gives the auditor access at all reasonable times to the company's accounting and other records and the right to require information and explanations from officers.
Your part. Keep records complete and organised; answer queries promptly. Delays are the main cause of long audits.
An audit is not a guarantee that no error or fraud exists (see the related question).
Legal basis
- Companies Act 2016, s.266
- Companies Act 2016, s.251
Sources
Applies to 2026 · Last reviewed 29 October 2026
General information for business owners, not legal, tax or professional advice. Rules change, so check the sources or ask a licensed professional before you act.
Related questions
- Does every Sdn Bhd in Malaysia need to be audited?Not every one, but audit is the default. Section 267(1) of the Companies Act 2016 requires a private company to appoint an auditor for each financial year, unless it qualifies for and elects the audit exemption set by SSM's Practice Directive 10/2024.
- What is audit exemption for private companies in Malaysia?Audit exemption lets an eligible private company choose not to appoint an auditor for a financial year. It rests on section 267(2) of the Companies Act 2016 and SSM Practice Directive 10/2024. The company still prepares and lodges unaudited financial statements.
- What are the audit exemption thresholds for a Sdn Bhd in 2026?For financial periods starting 1 January to 31 December 2026 (Phase 2), a private company must meet at least two of three tests: revenue up to RM2,000,000, total assets up to RM2,000,000, and no more than 20 employees. Each test covers the current and past two years.
- How do I check if my Sdn Bhd qualifies for audit exemption?Pass at least two of three tests (revenue, total assets, employees) for the current financial year and the past two, using the limits for the phase your period falls in. Also confirm you are not an excluded company type, such as a subsidiary of a public company.
- Is a dormant company exempt from audit in Malaysia?Yes, if it has been dormant since incorporation or was dormant in both the current and immediately preceding financial year. A company is dormant when it carries on no business and has no accounting transaction, ignoring payments it must legally make.