What are audit confirmations (bank, debtor, creditor) and why do auditors send them?
A confirmation is a request the auditor sends directly to a third party, such as your bank, a customer or a lawyer, to verify a balance or fact. Evidence from outside the company is generally more reliable than the company's own records.
What they are. Instead of relying only on your records, the auditor writes to a third party and gets a reply directly. Typical examples:
- Bank confirmation: balances, loans, guarantees and securities at year-end for every account, including closed ones.
- Debtor and creditor confirmations: balances owed to or by key customers and suppliers.
- Lawyer's letter: known claims and litigation.
- Other: insurers, stockholders holding your goods, and group companies.
Why it matters. The auditor must form an opinion on whether proper accounting records were kept and whether all information and explanations needed were obtained (section 266(3)). Outside evidence supports those conclusions. Auditors follow the international auditing standard on external confirmations (ISA 505).
What you do
- Sign the authority your bank requires (the auditor usually sends the request, but the bank needs your permission).
- Provide complete lists of banks, loans, and key customers and suppliers.
- Tell customers and suppliers to expect and answer the request.
- Do not intercept or edit replies; the evidence is valuable only because it comes directly.
Delays. Replies can take time, so ask early. If a third party does not respond, the auditor will use alternative checks such as receipts after year-end, which may take longer.
A mismatch is common and often explained by timing, but investigate it.
Legal basis
- Companies Act 2016, s.266(3)-(4)
Sources
Applies to 2026 · Last reviewed 29 October 2026
General information for business owners, not legal, tax or professional advice. Rules change, so check the sources or ask a licensed professional before you act.
Related questions
- Does every Sdn Bhd in Malaysia need to be audited?Not every one, but audit is the default. Section 267(1) of the Companies Act 2016 requires a private company to appoint an auditor for each financial year, unless it qualifies for and elects the audit exemption set by SSM's Practice Directive 10/2024.
- What is audit exemption for private companies in Malaysia?Audit exemption lets an eligible private company choose not to appoint an auditor for a financial year. It rests on section 267(2) of the Companies Act 2016 and SSM Practice Directive 10/2024. The company still prepares and lodges unaudited financial statements.
- What are the audit exemption thresholds for a Sdn Bhd in 2026?For financial periods starting 1 January to 31 December 2026 (Phase 2), a private company must meet at least two of three tests: revenue up to RM2,000,000, total assets up to RM2,000,000, and no more than 20 employees. Each test covers the current and past two years.
- How do I check if my Sdn Bhd qualifies for audit exemption?Pass at least two of three tests (revenue, total assets, employees) for the current financial year and the past two, using the limits for the phase your period falls in. Also confirm you are not an excluded company type, such as a subsidiary of a public company.
- Is a dormant company exempt from audit in Malaysia?Yes, if it has been dormant since incorporation or was dormant in both the current and immediately preceding financial year. A company is dormant when it carries on no business and has no accounting transaction, ignoring payments it must legally make.