Audit Rules and Procedures for Malaysian Enterprises

Corporate audits in Malaysia are not merely perfunctory formalities-they are statutory, mandatory requirements directly tied to a company’s regulatory compliance and continued legal existence, bank credit facilities, shareholder dividend distributions, and tax settlements. Starting in 2026, the Companies Commission of Malaysia (SSM) and the Inland Revenue Board of Malaysia (IRB) have significantly strengthened their cross-verification mechanism for audit data. Notably, for private limited companies (Sdn. Bhd.) with annual turnover exceeding RM500,000, applications for “audit exemption” are no longer accepted. This amendment took full effect as of March 2026. Consequently, numerous companies-having failed to timely update internal control procedures-have encountered automatic rejection by the SSM system when submitting their annual returns.

I. Which Entities Are Required to Undergo an Audit?

1. All private limited companies (Sdn. Bhd.) registered with the SSM-regardless of profitability-must complete an annual statutory audit in accordance with Section 248 of the Companies Act 2016.

2. Partnerships, sole proprietorships, and non-profit organizations are not subject to mandatory audit requirements; however, if an audit clause is stipulated in a bank loan agreement or shareholders’ agreement, such audit must be conducted in compliance with the contractual terms.

3. Representative offices (REPs) established in Malaysia by foreign companies lack independent legal entity status. Nevertheless, if an REP engages in revenue-generating activities and maintains a local bank account, the IRB may require submission of an audited statement of operational expenses.

II. Core Audit Process A Five-Step Framework

1. Appointment of a Qualified Auditor The auditor must be a Chartered Accountant (CPA) registered with the SSM-or a firm accredited by the Malaysian Accounting Standards Board (MASB). A real-time, searchable list of eligible auditors is available on the SSM website under the “e-Audit Register.”

2. Audit Preparation Period (Typically Within One Month After Fiscal Year-End) The company must provide the auditor with a complete set of accounting records-including the general ledger, subsidiary ledgers, bank reconciliation statements, fixed asset register-as well as its Memorandum and Articles of Association, minutes of board and shareholders’ meetings, a list of related-party transactions, and electronic tax filing records (including e-Filing ID and historical tax payment receipts).

3. On-Site Audit Execution (5-12 Working Days) The auditor focuses on key areas, including

• Whether revenue recognition complies with MFRS 15;

• Whether inventory valuation adopts either the weighted average cost method or first-in, first-out (FIFO) method;

• Whether related-party fund transfers are governed by written agreements and bear market-based interest.

4. Issuance of Draft Audit Report The report includes the auditor’s opinion-unqualified, qualified, adverse, or disclaimer-and an “Emphasis of Matter” paragraph where appropriate (e.g., material litigation, or the impact of foreign exchange volatility on overseas receivables).

5. Shareholder Approval and Filing The final audit report must be reviewed and approved by the Board of Directors and formally ratified via written resolution of the shareholders’ meeting. Both the signed audit report (in PDF format) and the audited financial statements must be uploaded concurrently to the SSM’s e-Annual Return system within six months after fiscal year-end.

III. Frequently Encountered Practical Issues in 2026 Audits

• Missing Bank Reconciliation Statement In over 67% of rejected annual return submissions, companies omitted the Bank Reconciliation Statement as of the balance sheet date-particularly failing to account for outstanding checks and interbank service charges among uncleared items.

• Inconsistent Fixed Asset Depreciation Methodology Some companies apply the straight-line method in their books but adopt accelerated depreciation for tax purposes-without disclosing the rationale for this difference or quantifying the corresponding tax adjustments in the audit report’s notes.

• Discontinuity in Electronic Invoice (e-Invoice) Integration Effective August 2026, the IRB mandates use of the MyInvois system for all B2B transactions. Yet many companies fail to embed the MyInvois reference number into the “narrative” field of their accounting vouchers-hindering auditors’ ability to verify revenue authenticity.

• Superficial Handling of Foreign Currency Transactions Companies holding U.S. dollar-denominated receivables often neglect to re-measure foreign exchange gains/losses monthly using the Central Bank of Malaysia’s (Bank Negara Malaysia) mid-rate as of the last business day of each month-resulting in inflated reported profits.

IV. Pre-Submission Self-Checklist for Audit Documentation

1. Are the financial statements stamped with the company’s official seal and signed by directors? (Scanned copies must be clear and legible.)

2. Does the cover page of the audit report display the registered auditor’s original signature stamp and the firm’s valid SSM practice license number?

3. Do bank statements for all accounts cover the entire fiscal year and reconcile transaction-by-transaction with the cash journal?

4. Does the accounts receivable aging analysis clearly identify customers with outstanding balances exceeding 90 days-and include supporting evidence of collection efforts?

5. Do Employees’ Provident Fund (EPF) and Social Security Organization (SOCSO) contribution records fully align-by headcount and contribution base-with payroll records?

The above outlines the statutory framework and practical implementation guidelines for corporate audits in Malaysia. We trust this summary proves helpful. Enterprises are strongly advised to initiate audit preparations at least 45 days in advance-to avoid delays caused by repeated documentation revisions, which could jeopardize compliance with the SSM’s annual return filing deadline (typically six months and 14 days after fiscal year-end) and adversely affect corporate credit ratings and future commercial engagements.