Review Engagements and Agreed-Upon Procedures: A 2025 Guide to Alternative Assurance in Malaysia

The Growing Importance of Alternative Assurance in Malaysia's 2025 Business Environment

In 2025, with the introduction of new audit exemption criteria under the Companies Act 2016, many Malaysian Small and Medium Enterprises (SMEs) no longer require a full statutory audit. However, the need for credible, independently verified financial information for lenders, investors, and other stakeholders remains. This is where alternative assurance services play a crucial role, offering a flexible and cost-effective way to meet these needs. The two primary alternative services are Review Engagements and Agreed-Upon Procedures (AUP).

Review Engagements (ISRE 2400): Limited Assurance for Stakeholder Confidence

A Review Engagement, conducted under the International Standard on Review Engagements (ISRE) 2400, is a popular choice for companies that do not need a full audit but still require a meaningful level of assurance on their financial statements.

• What it is: A review provides limited assurance that the financial statements are free from material misstatement. It is less comprehensive than an audit but more rigorous than a simple compilation of accounts.
• Procedures Performed: The practitioner primarily performs inquiry (asking questions of management) and analytical procedures (analyzing relationships in financial data). A review does not typically involve detailed testing of transactions or internal controls.
• The Report: The outcome is a review report that provides a "negative assurance" conclusion. The practitioner states whether anything has come to their attention that causes them to believe the financial statements are not prepared, in all material respects, in accordance with the applicable financial reporting framework.
• When it's Appropriate: A review is ideal when a company needs to provide a degree of confidence to external stakeholders like banks or potential investors, but the cost and complexity of a full audit are not justified or required.

Agreed-Upon Procedures (ISRS 4400): Factual Findings for Specific Needs

An Agreed-Upon Procedures (AUP) engagement, conducted under the International Standard on Related Services (ISRS) 4400, is a highly tailored service designed to address specific concerns of the engaging parties.

• What it is: An AUP engagement provides no assurance. Instead, the practitioner is engaged to carry out specific procedures that have been agreed upon with the client and/or a third party, and to report on the factual findings of those procedures.
• Procedures Performed: The procedures are entirely determined by the engaging parties and can be highly specific, such as verifying the existence of certain assets, checking the mathematical accuracy of a calculation, or confirming specific transactions with third parties.
• The Report: The report is a purely factual account of the procedures performed and the findings. It does not express an opinion or a conclusion. It is up to the users of the report to draw their own conclusions based on the factual findings.
• When it's Appropriate: AUPs are perfect for situations where a full financial statement review is not necessary, but there is a need for independent verification of specific information. Common use cases include grant acquittals, covenant compliance checks for lenders, due diligence on a specific part of a business, or royalty audits.

Choosing the Right Service: A Clear Comparison

Conclusion

For Malaysian businesses navigating the 2025 landscape, understanding the spectrum of assurance services available is key. While a statutory audit provides the highest level of assurance, Review Engagements and Agreed-Upon Procedures offer flexible, cost-effective, and targeted alternatives that can provide the right level of comfort and verification to meet the specific needs of stakeholders in a modern and dynamic economy.