A tax audit is a review process, not a finding about a taxpayer's conduct. The response that works is procedural: establish exactly what has been requested and under which framework, confirm which years can be reopened, settle the voluntary disclosure question before it closes, assemble the evidence, and treat the technical adjustment, the penalty and the appeal as three separate questions.
Confirm which framework governs the case
Check this first, because the position changed in 2025 and a good deal of the commentary still describes the older arrangement.
HASiL's Rangka Kerja Audit Cukai Pendapatan dan Majikan (RKA CPM) took effect on 15 March 2025 and consolidates what were previously several separate frameworks. It covers income tax audit, finance and insurance tax audit, withholding tax audit, capital gains tax audit, Labuan business activity audit and employer audit. HASiL's framework index records the 2022 tax audit, petroleum, and finance and insurance frameworks, the 2021 employer framework and the 2015 withholding tax framework as superseded by it.
It is not the only audit framework in force. Separate frameworks apply to transfer pricing audits (issued 31 July 2025), real property gains tax audits (effective 1 January 2025), e-Invoice compliance reviews (effective 15 December 2025) and stamp duty audits (effective 1 January 2026). A transfer pricing review is therefore not governed by RKA CPM, and working from the wrong document produces the wrong expectations about timing, penalties and process.
The legislation engaged is also wider than the Income Tax Act 1967 alone. RKA CPM records that HASiL's audit activity also draws on the Petroleum (Income Tax) Act 1967, the Real Property Gains Tax Act 1976, the Promotion of Investments Act 1986, the Stamp Act 1949 and the Labuan Business Activity Tax Act 1990, among others.
Establish whether this is a general review or a full review
RKA CPM sets out two review methods, and they behave differently. A general review (semakan umum) is document review carried out at HASiL's office only, covering matters that can be settled by correspondence — a focused examination of particular income, expense or claim entries in the return. A full review (semakan menyeluruh) may extend to a visit to the taxpayer's premises or another agreed location.
The timings that follow are short, and worth diarising on the day the letter arrives:
- A Document and Information Request Letter is issued by official email or post, and the taxpayer or employer is required to respond within 14 calendar days of its date.
- Where a full review involves a premises visit, a Compliance Visit Notification Letter is issued at least 14 calendar days before the visit date.
- A visit ordinarily takes one to three days, and may be extended according to the size and complexity of the transactions, the form in which records are kept, and the level of co-operation given.
Where accounting records are held electronically, RKA CPM permits the audit officer to access the computer system, server or device and to download the accounting data. That is better known in advance than discovered on the day: someone should be able to say what the system holds, confirm that it reconciles to the return as filed, and operate it under observation.
Establish which years can be reopened
Scope is not open-ended, and the limits differ by audit type. RKA CPM states that:
- a tax audit other than withholding tax, employer or Labuan issues may cover up to three years of assessment, and up to five years of assessment under subsection 91(1) of the ITA;
- a withholding tax audit may likewise cover up to three years of assessment, and up to five under subsection 91(1);
- an employer audit may cover up to two years of remuneration, with offences under section 83 of the ITA reachable up to twelve years from the year the offence was committed, under subsection 121(1);
- a Labuan business activity audit may cover up to three years.
The coverage limit does not apply at all where the case involves fraud, wilful default or negligence (subsection 91(3) of the ITA). The inclusion of negligence matters in practice: the time limit can fall away without any allegation of dishonesty.
Understand how cases are selected
Selection is not arbitrary, and it does not imply wrongdoing. RKA CPM states that cases are selected through computer-system analysis based on prescribed tax risk-assessment criteria and/or from various sources of information received, and that both the criteria and the types of source may change over time. The bases it names are information received from third parties, industry issues, and the value of controlled transactions carried out by a company relative to significant transaction values.
Two things follow. Records should be able to withstand comparison with what counterparties, employees and other agencies have reported. And related-party transactions draw attention through their scale relative to the business, not through anything improper in them — which is an argument for contemporaneous support, not for restructuring them under pressure.
Settle the voluntary disclosure question before it closes
A concessionary penalty rate is available where a taxpayer makes a voluntary disclosure, and RKA CPM is explicit that a taxpayer is not eligible to make one once audit action has begun.
The rates prescribed under subsection 113(2) of the ITA, and subsection 52(2) of the Petroleum (Income Tax) Act 1967, are 15% for a voluntary disclosure made after the return filing due date, and 10% where a first voluntary disclosure has been made through an Amended Return Form and a further disclosure follows within six months of the return filing due date.
For a general review, the case settlement period runs from the date the Document and Information Request Letter is issued. That date is a workable marker for when the disclosure route has closed, and it is the practical reason a known unresolved exposure is better addressed before correspondence begins than after it.
Assemble a controlled evidence file
Sections 82 and 82A of the ITA require records sufficient to allow income or loss from the business to be determined. Assemble what supports the return as filed: ledgers, reconciliations, contracts, invoices, bank records, board approvals, and the working papers behind material judgements. Record who prepared each item, who reviewed it, and the basis of any estimate or apportionment.
Keep a single log of what was requested, what was provided, when and by whom, and nominate one person to coordinate correspondence. Answer the question that was asked, in writing where the point is material, and separate fact, estimate and position taken. Where a document cannot be located, say so and explain what was searched. An acknowledged gap is a stronger position than a reconstruction offered without support.
Respond to the findings letter inside the eighteen-day window
Where the review produces findings, HASiL issues a Case Findings Letter setting out the issues raised and the reasons for them. The taxpayer may object formally within 18 calendar days of the date of that letter, submitting additional information and evidence in support. If no objection is received within those 18 calendar days, RKA CPM provides that the taxpayer is treated as having agreed with the findings and a Notice of Assessment will be raised. Objections are reviewed and the outcome confirmed through a Letter of Notification of the Discussion Decision. The same 18-day window applies to employer audit findings.
Case settlement periods, measured from the audit start date, are 90 calendar days for a tax or employer audit; 90 calendar days for a withholding tax audit on the payer and 180 calendar days on the payee; between 90 and 240 calendar days for finance and insurance cases depending on the activity; and 450 calendar days for petroleum exploration and production.
Treat the adjustment, the penalty and the appeal as three questions
Where an adjustment is proposed, evaluate it against the legislation, the applicable public rulings and the facts, rather than accepting or resisting it reflexively.
On penalties, RKA CPM applies a graduated scale under subsection 113(2): 15% for a first offence, 30% for a second, and 45% for a third and subsequent offence, with the count determined by reference to penalties imposed in an earlier defined period. A technical adjustment — a case turning on a difference in interpretation of the tax legislation, determined on the facts and issues of each case — attracts 0%. Tax fraud, where the taxpayer is found to have deliberately reported incorrectly, attracts 100% of the tax undercharged. The Director General retains a discretion under subsection 124(3) to reduce or remit a penalty imposed.
One qualification is easy to miss and often decisive. RKA CPM states that where HASiL has already issued its position through a Public Ruling, guideline, practice note, Income Tax Rules or exemption order, the technical adjustment ground does not apply. A published HASiL position should therefore be checked before an interpretation argument is built on the point.
Payment and appeal are separate again. Tax and penalties arising from audit adjustments are payable in full within 30 days of the date the Notice of Assessment is raised, although an application to pay by instalments over a set period may be considered on justification. An appeal against the assessment lies to the Special Commissioners of Income Tax within 30 days of service of the Notice of Assessment, through a complete Form Q submitted to the relevant State Director of Operations or Division Director. Separately, a payer liable to withholding tax under section 109, 109B or 109F may appeal to the Special Commissioners using Form CP15D, within 30 days of the date the amount became payable, where the ground is that the payment is not subject to tax under the ITA.
General-information limitation
This article is general information, not tax advice for a particular organisation, and it does not determine the treatment of any transaction, year of assessment or audit finding. Frameworks, penalty rates and procedural timeframes are periodically revised. Confirm the current position against HASiL's own published material and obtain fact-specific advice where a matter is material, time-sensitive or uncertain.
To discuss your circumstances, contact Saifudin & Co.