Good audit preparation does not change the audit opinion. What it changes is how much of the audit is spent locating information rather than examining it — and that proportion is largely within management's control. An audit that begins with three weeks of reconstruction is not a more rigorous audit; it is the same audit, later and more expensively.
Preparation does not shift responsibility
Worth stating plainly at the outset, because it shapes everything that follows. Management and those charged with governance remain responsible for the financial statements, for the underlying records and for the system of internal control. An audit provides reasonable assurance, which is a high level of assurance but is not a guarantee that every misstatement will be detected.
Preparation is therefore not about presenting a favourable picture. It is about making the actual position traceable — so that a figure in the financial statements can be followed back to the evidence that supports it without anyone having to remember what happened.
Whether an audit is required is a separate question, and SSM settles it
Under subsection 267(1) of the Companies Act 2016, a private company shall appoint an auditor for each financial year. Subsection 267(2) then empowers the Registrar to exempt a private company from that requirement, according to conditions determined by the Registrar and set out in the Companies Commission of Malaysia's practice directive on audit exemption.
Those qualifying conditions are deliberately not reproduced here. Eligibility is assessed against a company's own figures across more than one financial year, the conditions have been revised before, and a table on a website is a poor instrument for a determination that turns on a particular company's numbers. Read the current directive on SSM's audit exemption pages and apply it to your own financial statements.
Two qualifications matter even where exemption is available. First, exemption from audit is not exemption from preparing, circulating and lodging financial statements. Second, company law is not the only source of an audit requirement: lenders, shareholders' and joint venture agreements, group parents, grant conditions and tender requirements each impose their own, and any one of them can make an audit necessary for a company that is not statutorily required to have one. The rest of this article assumes that question has been answered.
The dates that constrain the timetable
Audit preparation is usually discussed as a records exercise. It is at least as much a calendar exercise, because the audit sits inside a fixed statutory chain and every delay moves everything after it.
- Under section 248, directors are to prepare financial statements within eighteen months from incorporation and, subsequently, within six months of each financial year end.
- Under paragraph 258(1)(a), a private company circulates its financial statements and reports within six months of financial year end. A public company circulates at least twenty-one days before its annual general meeting.
- Under paragraph 259(1)(a), a private company lodges with the Registrar within thirty days from circulation. A public company lodges within thirty days from its annual general meeting.
- Under subsection 259(2), the Registrar may grant an extension, but the application has to be made before the relevant period expires — an extension is not available retrospectively.
- Under section 245, accounting and other records are to be retained for seven years after completion of the transactions to which the entries relate.
Where an audit is required, the auditor's report has to be in place before circulation. That single dependency is why an audit that slips by a month tends to move the lodgement date with it, and why the timetable is worth agreeing before the year end rather than after it.
Reconciliations are the single biggest lever
Most avoidable audit delay comes from balances that cannot be tied to independent evidence. Before fieldwork, complete and document reconciliations for bank balances, trade receivables and payables, inventory quantities to the general ledger, intercompany balances, fixed asset registers to the ledger, loan and financing balances to lender statements, and tax accounts.
Two of these are worth separating out. Intercompany balances in a group must agree in both directions, and a disagreement discovered during fieldwork consumes disproportionate time because resolving it requires two sets of records and often two teams working to different priorities. Inventory is the other: where quantities are material, the count arrangements, cut-off procedures and the treatment of goods in transit or held by third parties should be settled in advance, because an attendance cannot be repeated after the date has passed.
A reconciliation that exists but is undocumented is only half the benefit. The reviewer's name and the date are part of the evidence.
Judgement areas need a written basis, prepared before fieldwork
Estimates and judgements are where audit questions concentrate: expected credit losses, inventory provisioning, useful lives and residual values, impairment indicators, accruals, provisions, contingent liabilities and revenue cut-off.
For each material judgement, record the method used, the inputs and where they came from, the assumptions and why they are reasonable, who prepared it, who reviewed it, and what changed from the prior year and why. Where an assumption has moved, say so and explain the movement rather than leaving it to be discovered.
The sequencing point is the substantive one. A judgement documented when it was made carries a different weight from the same judgement written up after a question has been asked about it, and the difference is visible.
Contracts, minutes and related parties
The second common bottleneck is not numbers at all. Assemble, for the period and up to the date the financial statements are approved, the contracts entered into, lease and financing agreements including any covenants and their compliance position, board and members' minutes and written resolutions, and evidence of approvals for significant transactions.
Related parties deserve deliberate attention before fieldwork rather than during it. Identify the parties, then identify the transactions and balances — including those with no documentation because they were between people who did not think documentation necessary. Directors' balances, management fees, shared costs, guarantees given or received, and property occupied without a formal lease are the recurring examples. These are disclosed items, and they are far quicker to establish from the inside than to reconstruct from the outside.
Group audits changed for periods beginning on or after 15 December 2023
Where a company is part of a group, ISA 600 (Revised) applies. The standard, as published by MIA, is effective for audits of group financial statements for periods beginning on or after 15 December 2023.
The practical effect is more structured involvement between the group auditor and component auditors: earlier planning, a risk-based approach to identifying components and the work required at each, clearer two-way communication, and more evidence about how component work is directed, supervised and reviewed. A group audit timetable built on pre-revision assumptions will typically underestimate the lead time, particularly where a component is audited by a different firm or in a different jurisdiction. Where a group structure has changed during the period, flag it early — the consequences run to the reporting framework, the consolidation and the component scope at once.
Why the auditor's own procedures may look different
Companies sometimes notice more documentation requests, and more explicit acceptance and independence procedures, than in earlier years. This reflects the quality management standards — ISQM 1, ISQM 2 and ISA 220 (Revised) — which MIA material records as effective from 15 December 2022.
These govern the firm's own system of quality management rather than the client's records, but they affect the engagement in visible ways: independence confirmations, acceptance and continuance procedures, and documentation of review are all more explicit than they once were. Anticipating them avoids treating a routine requirement as an unexpected obstacle late in the timetable.
The same standards bear on a decision companies sometimes make without thinking about it. Asking the auditor to prepare the records or the estimates it will then audit creates a self-review threat, which is addressed under the independence requirements and may not be capable of being reduced to an acceptable level. Preparation support and audit are not interchangeable, and where preparation help is genuinely needed, it is worth establishing early who can provide it.
A preparation checklist
- Confirm whether an audit is required at all, against SSM's current directive and against the company's financing, shareholder and group arrangements.
- Fix the timetable backwards from the lodgement date, and identify who answers queries in each area.
- Complete and document all major reconciliations, including intercompany in both directions.
- Settle inventory count and cut-off arrangements before the date passes.
- Prepare a written basis for each material estimate and judgement, with the reviewer identified.
- Assemble contracts, leases, financing agreements, covenant positions, minutes and approvals for the period.
- Identify related parties and their transactions and balances before fieldwork.
- Confirm which reporting framework applies and whether group relationships have changed it.
- Where a group is involved, confirm the ISA 600 (Revised) implications for component scope and timing.
- Check the availability of the people who prepared the work, and flag departures or extended leave early.
Almost all of that is internal work. A company with disciplined monthly reconciliations, documented judgements and an organised contract file needs no external preparation support, and it is not in a company's interest to buy help it does not require. For audit engagements, we maintain independence in accordance with the MIA By-Laws (On Professional Ethics, Conduct and Practice). To discuss your circumstances, see our audit and assurance services.
This article is general information about the requirements and practices described. It is not advice for any particular entity, and it does not determine whether an audit is required, the scope or approach of any engagement, or the treatment of any balance or judgement. Confirm current requirements against the applicable standards and the current SSM and MIA material, and obtain advice on the specific facts where the matter is material.