What is an audit?

Learn what an audit is, the types of audits in Malaysia, and which companies must be audited.

Published Monday 17 August 2026

Table of contents

Key takeaways

  • An audit is an independent examination of a company's financial records and statements to give an opinion on whether they present a true and fair view, regulated in Malaysia by the Malaysian Institute of Accountants (MIA) under the Companies Act 2016.
  • Every private company (Sdn Bhd) must appoint an auditor each financial year unless it qualifies for audit exemption under SSM Practice Directive 10/2024, which phases in threshold requirements from 2025 to 2027.
  • The Companies Commission of Malaysia (SSM) oversees company filings, while the Inland Revenue Board of Malaysia (LHDN) may conduct separate tax audits on any business.
  • You must keep your financial records for at least seven years to comply with tax audit requirements under Section 82A of the Income Tax Act 1967.

What is an audit?

An audit is an independent examination of your company's financial records and statements to give an opinion on whether they present a true and fair view. In Malaysia, audits are regulated by the Malaysian Institute of Accountants (MIA), with the statutory basis set out in the Companies Act 2016.

Your auditor reviews your accounting records, tests internal controls and verifies that your financial statements comply with applicable reporting standards. The auditor then issues a formal opinion that shareholders and other stakeholders can rely on when making decisions.

Statutory audit under the Companies Act 2016

Under Section 267(1) of the Companies Act 2016, every private company (Sdn Bhd) must appoint an auditor for each financial year unless it qualifies for audit exemption. Public companies (Berhad), including those listed on Bursa Malaysia, must be audited every year with no exemption available.

Most private companies prepare their financial statements using the Malaysian Private Entities Reporting Standard (MPERS), while public and publicly accountable entities use the Malaysian Financial Reporting Standards (MFRS), which are equivalent to full IFRS. The reporting standards are issued by the Malaysian Accounting Standards Board (MASB).

Under Section 248 of the Companies Act 2016, your directors must prepare financial statements within six months of the financial year end. Section 258 requires you to circulate these statements to members within six months of the financial year end, and Section 259 gives you 30 days from circulation to lodge them with SSM. Your corporate tax return (Form C) is due to LHDN within seven months of the financial year end, with e-Filing via MyTax adding approximately one extra month.

Types of audits

Your business may encounter several types of audits in Malaysia, each serving a different purpose.

  • External (statutory) audit: an independent review of your financial statements by an approved company auditor, required annually for most companies under the Companies Act 2016.
  • Internal audit: a voluntary examination of your company's processes, controls and risk management, often conducted by in-house staff or consultants to improve operations. You can learn more about internal audits and how they differ from external audits.
  • LHDN tax audit: a review by the Inland Revenue Board of Malaysia to verify that your tax returns accurately reflect your income and expenses.
  • Compliance audit: an assessment of whether your business adheres to specific laws, regulations or internal policies.

Who can perform an audit in Malaysia?

Only an approved company auditor can conduct a statutory audit in Malaysia. Under Section 263 of the Companies Act 2016, this must be a member of MIA who holds a practising certificate approved by the Ministry of Finance. The approval is valid for two years and must be renewed.

Your company's bookkeeper or in-house accountant cannot serve as the statutory auditor, even if they hold accounting qualifications. The auditor must be independent of the company to provide an objective opinion on the financial statements.

Which companies need an audit (and who is exempt)?

Public companies (Berhad) and subsidiaries of public companies must be audited every year without exception. Private companies (Sdn Bhd) must also appoint an auditor unless they qualify for audit exemption under SSM Practice Directive 10/2024.

A private company qualifies for exemption if it meets at least two of three criteria in the current financial year and the two preceding financial years. The thresholds are phased in as follows:

  • Financial years starting in 2025: revenue up to RM1,000,000, total assets up to RM1,000,000, up to 10 employees.
  • Financial years starting in 2026: revenue up to RM2,000,000, total assets up to RM2,000,000, up to 20 employees.
  • Financial years starting on or after 1 January 2027: revenue up to RM3,000,000, total assets up to RM3,000,000, up to 30 employees.

Dormant companies have a separate ongoing exemption. Foreign companies registered in Malaysia do not qualify for exemption. Even if your company is exempt from audit, you must still prepare financial statements under MPERS, lodge them with SSM and include an audit exemption certificate.

Statutory audit vs LHDN tax audit

A statutory audit is conducted by an approved company auditor to verify that your financial statements present a true and fair view. The auditor reports to shareholders under Section 266 of the Companies Act 2016.

An LHDN tax audit is a separate process conducted by the Inland Revenue Board of Malaysia to ensure your tax returns accurately reflect your taxable income. LHDN uses risk-based, computerised case selection to identify businesses for review. Common triggers include significant income fluctuations, persistent losses, spending inconsistent with declared income and non-filing of returns.

Tax audits typically review up to three years of assessments, though LHDN may go back further in cases of negligence or fraud. Under the Tax Audit Framework 2022, penalties for understated income under Section 113(2) are 15% for a first offence, 30% for a second offence and 45% for third and subsequent offences. You must keep your financial records for at least seven years under Section 82A of the Income Tax Act 1967.

The audit process

An external audit typically follows four main stages, from initial planning through to the final report.

  1. Planning: the auditor gains an understanding of your business, assesses risks and develops an audit strategy.
  2. Gathering evidence: the auditor collects documentation, including invoices, bank statements, contracts and other records that support your financial statements.
  3. Evaluation and testing: the auditor tests your internal controls and verifies account balances through sampling and analytical procedures.
  4. Reporting the opinion: the auditor issues a formal opinion on whether your financial statements present a true and fair view.

Types of audit opinions

Under International Standards on Auditing adopted by MIA, an auditor can issue one of four opinions on your financial statements.

  • Unmodified (unqualified): the financial statements present a true and fair view with no material issues identified.
  • Qualified: there is a material issue, but it is not pervasive enough to affect the overall fairness of the statements.
  • Adverse: the financial statements are materially and pervasively misstated and do not present a true and fair view.
  • Disclaimer of opinion: the auditor could not obtain sufficient evidence to form an opinion on the statements.

Why audits matter

Regular audits provide benefits beyond meeting your legal obligations. Sound small business accounting practices, combined with audited accounts, strengthen your business in several ways.

  • Compliance: fulfilling statutory requirements under the Companies Act 2016 and avoiding penalties from SSM.
  • Access to finance and credibility: audited accounts give banks, investors and business partners confidence in your financial position.
  • Better decisions: an audit can highlight areas for improvement in your financial management and internal controls.
  • Error and fraud detection: independent scrutiny helps identify mistakes or irregularities before they become serious problems.

How to prepare for an audit

Preparing well in advance makes the audit process smoother and reduces the risk of unexpected findings.

  1. Keep thorough records: maintain organised documentation for all transactions, including invoices, receipts and contracts.
  2. Reconcile accounts regularly: match your bank statements to your accounting records throughout the year. Bank reconciliation helps you catch errors early and keeps your books accurate.
  3. Separate business and personal finances: use dedicated business bank accounts and avoid mixing personal expenses with company funds.
  4. Prepare financial statements to MPERS: ensure your accounts comply with Malaysian Private Entities Reporting Standard if you are a private company.
  5. Keep records for seven years: retain all financial documentation to meet LHDN requirements under the Income Tax Act 1967.
  6. Engage an approved auditor early: contact your auditor well before the financial year end to plan the engagement. Understanding what an accountant does can help you work more effectively with your audit team.

Keep your records audit-ready with Xero

Xero helps you stay organised year-round with automated bank feeds that import transactions directly into your accounts. You can reconcile your records in real time, store digital copies of invoices and receipts, and generate financial reports whenever you need them. When audit time arrives, your documentation is already in order. Ready to simplify your bookkeeping? Get one month free and see how Xero keeps your business audit-ready.

FAQs on audits

Here are answers to common questions about audits for Malaysian businesses.

Is an audit compulsory for all Sdn Bhd companies in Malaysia?

Not necessarily. From financial years starting on or after 1 January 2025, qualifying small private companies may apply for audit exemption under SSM Practice Directive 10/2024 if they meet at least two of the three threshold criteria for the current year and two preceding years.

Who qualifies for audit exemption in Malaysia?

Private companies that meet at least two of three criteria (revenue, total assets and employee count) across three consecutive financial years may qualify. The thresholds increase in phases from 2025 to 2027, starting at RM1,000,000 revenue and assets with 10 employees.

What is the difference between a statutory audit and an LHDN tax audit?

A statutory audit is performed by an approved company auditor to verify your financial statements for shareholders. An LHDN tax audit is conducted by the tax authority to check that your tax returns accurately reflect your taxable income.

How long must I keep my financial records?

Under Section 82A of the Income Tax Act 1967, you must retain your financial records for at least seven years from the end of the year of assessment to which they relate.

What happens if a company does not lodge its audited accounts?

Failing to lodge financial statements with SSM under Section 259 is an offence carrying a fine of up to RM50,000, plus up to RM1,000 for each day the offence continues. Persistent non-compliance can result in the company being struck off the register.

Related terms

Learn more about audits

Handy resources

Advisor directory

You can search for experts in our advisor directory

Find an advisor

Xero Small Business Guides

Discover resources to help you do better business

See all our guides and articles

Financial reporting

Keep track of your performance with accounting reports

Find out more

Disclaimer

This glossary is for small business owners. The definitions are written with their requirements in mind. More detailed definitions can be found in accounting textbooks or from an accounting professional. Xero does not provide accounting, tax, business or legal advice.