A statutory audit is an independent examination of a company's financial statements, carried out by an approved auditor. This article covers who must undergo one, who may be exempt, which standards apply, how the process runs, what records you need, filing responsibilities, and how to prepare.
Key Takeaways
- The Companies Act 2016 sets core audit and reporting obligations; SSM administers corporate compliance.
- Audit exemption doesn't remove the need for proper records, financial statements, approvals, and SSM lodgement.
- Your reporting framework, auditor eligibility, and filing deadline depend on legal form, size, and activity.
- Organised records and regular reconciliations reduce audit delays and support director accountability.
What Malaysian Statutory Audit Requirements Cover
The Companies Act 2016 requires directors to:
- Keep records that explain transactions and financial position (section 245)
- Prepare financial statements that comply with approved accounting standards (section 244)
- Obtain Board approval of those statements (section 251)
SSM administers and enforces these obligations across incorporation, compliance monitoring, and enforcement.
A statutory audit is the report an approved auditor issues under section 266, stating whether the financial statements give a true and fair view and comply with the Act and approved standards. That's a distinct exercise from:
- Internal audit – reviews internal controls and operations, not a legal filing requirement
- Tax audit – examines tax compliance, run by tax authorities
- Voluntary assurance engagement – limited review or agreed-upon procedures, chosen rather than mandated
- Management accounts – internal reporting for decision-making, not independently verified
Note that a statutory audit provides an opinion on the financial statements. It's not a guarantee every fraud or error will be caught.
Entity Categories to Confirm
Rules differ by structure:
- Public and listed companies
- Private companies
- Subsidiaries of public companies
- Dormant entities
- Foreign companies registered in Malaysia
Across all of these structures, directors carry the responsibility, not the auditor. They must maintain records, prepare statements, support figures with evidence, and make representations to the auditor during the engagement.
Auditor appointment is tightly controlled. Section 263 places approval with the Minister of Finance. Auditors must hold MIA Chartered Accountant status, a valid practising certificate, and meet independence requirements under the section 264(4A) guideline. For example, a spouse involved in a client's records can bar that auditor from the engagement entirely.
Because thresholds and definitions get updated through practice directives, confirm all section references and filing requirements against current Companies Act 2016 materials, SSM guidance, and MIA publications before relying on them.
Who May Qualify for Audit Exemption in Malaysia?
Practice Directive No. 10/2024, issued 16 December 2024, applies to financial periods beginning on or after 1 January 2025. The older PD 3/2017 covers periods before that. Confirm which directive governs your company's financial year before applying the thresholds below.
The Two-of-Three Test
A private company qualifies if it meets at least two of three conditions across the current and immediate past two financial years:
| Financial period starting | Revenue ≤ | Total assets ≤ | Employees ≤ |
|---|---|---|---|
| 1 Jan 2025 | RM1,000,000 | RM1,000,000 | 10 |
| 1 Jan 2026 | RM2,000,000 | RM2,000,000 | 20 |
| 1 Jan 2027 | RM3,000,000 | RM3,000,000 | 30 |
These thresholds phase in over three years, so double-check which phase applies to your reporting period.
Dormant and Zero-Revenue Companies
A company dormant since incorporation, or dormant across both the current and prior financial year, stays exempt. Dormant means no business activity and no accounting transaction that year, though the directive excludes certain administrative payments from this test.
Zero revenue alone is no longer a standalone exemption route. It now falls under either the two-of-three test or the dormancy rules.
Excluded from exemption:
- Public and listed companies
- Private subsidiaries of public companies
- Foreign companies
- Companies subject to separate statutory provisions
Exemption status is not permanent. Reassess it every financial year, since circumstances or prior-period results can change eligibility.
Even eligible companies can be pulled back into audit. Members holding at least 5% of shares (or a class of shares), 5% of eligible voting members, or the Registrar can require an audit by written notice. That notice must be issued no later than one month before the financial year ends.
Exempt companies still have ongoing filing duties:
- Maintain proper accounting records
- Prepare compliant unaudited financial statements
- Secure director or board approval
- Lodge appropriate documents with SSM
How the Statutory Audit Process Works
Malaysia follows International Standards on Auditing (ISA) adopted through the Malaysian Institute of Accountants (MIA). Here's the practical sequence:
- Engagement and planning – the company and auditor agree scope, reporting framework, timetable, and information requirements before fieldwork starts.
- Risk assessment and control review – the auditor learns the business, identifies areas vulnerable to misstatement or fraud, and evaluates internal controls to decide the nature and extent of testing.
- Fieldwork and substantive testing – auditors test transactions and balances against invoices, contracts, bank confirmations, payroll records, inventory documentation, and fixed-asset registers.
- Completion and management discussions – review of evidence, proposed adjustments, subsequent events, going-concern considerations, and communication of control weaknesses.
- Audit opinion and reporting – the auditor issues either an unmodified opinion or a modified one.
Understanding the Opinion Types
An unmodified opinion means the statements are prepared, in all material respects, under the applicable framework. A modified opinion (qualified, adverse, or disclaimer) arises when there's a material misstatement or insufficient evidence. Not every audit issue triggers a modified opinion; smaller adjustments get resolved during fieldwork.
Essential Documents to Prepare
Clear opinions depend on complete working papers. Build an audit-ready file well before year-end:
- Trial balance and general ledger
- Bank reconciliations
- Sales and purchase records
- Receivables and payables schedules
- Inventory counts and fixed-asset registers
- Loan, lease, and payroll records
- Tax records and contracts
- Related-party transaction details
- Board and shareholder minutes
Keep these supporting records with the file as well:
- Statutory registers and incorporation documents
- Prior-year statements and prior audit reports
- Accounting policies and evidence for significant estimates
What slows an audit down: missing documents, unreconciled balances, late entries, unsupported journal adjustments, and inconsistent tax or management reports. These generate extra queries and push out completion dates.
Reporting Standards, Deadlines and Filing Obligations
MFRS vs MPERS
A qualifying private entity may fully adopt either MPERS or MFRS. That means the entity is not itself required to report under Securities Commission Malaysia or Bank Negara Malaysia law, and is not connected to one that is.
MPERS (2025) applies for periods beginning on or after 1 January 2027, with early adoption permitted. Confirm the current MASB position before finalising your framework choice.
The reporting framework governs how financial statements are prepared. Auditing standards, adopted through MIA, govern how the auditor conducts the work. These are two separate rulebooks operating side by side.
Filing Timeline
| Step | Private company | Public company |
|---|---|---|
| Circulate financial statements | Within 6 months of year-end | At least 21 days before AGM |
| Lodge with SSM | Within 30 days after circulation | Within 30 days after AGM |
Confirm current deadlines separately for your entity type — don't assume one universal date applies.
Consequences of Non-Compliance
Breaches under sections 257–259 carry real exposure: fines up to RM50,000 for failing to circulate statements, plus daily continuing fines once convicted.
SSM's 2024 enforcement report recorded 429 cases registered for the duty to lodge and 521 cases charged, alongside an 85% overall filing compliance rate.
Late or incomplete compliance also creates friction with lenders and during transactions, since audited or properly filed accounts are often a prerequisite.
Why Compliance Matters and How to Prepare
Reliable financial reporting builds credibility with lenders, investors, shareholders, and commercial partners. As MIA notes, understandable financial health information helps stakeholders identify opportunities and avoid undue risk. That said, an audit doesn't replace sound internal controls. It verifies what's already there.
Year-Round Readiness Checklist
- Reconcile bank and control accounts on a regular schedule
- Maintain a documented approval process for transactions
- Separate key financial duties among staff
- Preserve records in an accessible, organised format
- Monitor related-party transactions closely
- Review reporting changes before year-end close
When Exempt Companies Choose Voluntary Audit
Even a company that qualifies for exemption might still opt for a voluntary audit or lighter assurance engagement when:
- Seeking financing from banks or investors
- Preparing for a sale or investment round
- Managing multiple shareholders with differing interests
- Growing rapidly and needing stronger internal reporting discipline
For companies operating between Malaysia and India, coordinating the India-side accounting, tax, and advisory work adds another layer of complexity. VJM Global supports cross-border businesses with India-side coordination; that support does not extend to Malaysian statutory audit work.
If your company needs a Malaysian audit, appoint an auditor approved under Malaysia's own regulatory framework. That is a distinct engagement from cross-border advisory support.
Conclusion
Malaysian statutory audit obligations hinge on your company's structure and the rules applicable to its financial period — there's no single answer that fits every entity. And even where exemption applies, the wider financial reporting and corporate compliance duties don't disappear.
Directors and foreign investors should confirm their status against the latest SSM guidance, keep records audit-ready throughout the year, and get qualified advice before relying on an exemption or risking a missed filing deadline.
Frequently Asked Questions
Who is required to do a statutory audit?
Most Malaysian companies must appoint an auditor each financial year under the Companies Act 2016. Qualifying private or dormant companies may be exempt under current SSM criteria, but public companies and their subsidiaries generally aren't.
Is audit mandatory in Malaysia?
Audit is the default legal requirement for Malaysian companies. However, limited exemptions exist for qualifying private and dormant companies under Practice Directive No. 10/2024, subject to specific thresholds and exclusions.
What documents are required for a statutory audit?
Core requirements typically include:
- Trial balance and general ledger
- Bank reconciliations
- Sales and purchase records
- Receivables and payables schedules
- Supporting statutory and board documentation
Prior-year statements and audit reports should also be on hand.
What are the audit standards in Malaysia?
Financial statements follow MFRS or MPERS, depending on entity type, while auditors follow ISA-based standards adopted through MIA. The reporting framework and auditing standards serve separate but connected purposes.
Can a private company in Malaysia be exempt from statutory audit?
Yes, qualifying private companies may be exempt if they meet at least two of three thresholds (revenue, assets, employees) under current SSM criteria. Exclusions apply, and continuing filing obligations remain regardless.
What happens if a company does not comply with Malaysia's audit requirements?
Non-compliance can trigger late-lodgement fines, continuing daily penalties, and regulatory action against directors. Verify current penalty amounts and deadlines directly with SSM or a qualified adviser.
