When a director asks whether the company needs an audit, the question is usually framed as a company law question. It rarely has a company law answer on its own. Company law sets the statutory starting point. Lenders, shareholders, grant providers, group parents and counterparties each set their own requirements, and any one of them can make an audit necessary for a company that is not statutorily required to have one.
Start with the statutory position, and take it from SSM
Under subsection 267(1) of the Companies Act 2016, a private company shall appoint an auditor for each financial year. Subsection 267(2) then gives the Registrar power to exempt a private company from that requirement, according to conditions determined by the Registrar. The conditions currently in force are set out by the Companies Commission of Malaysia (SSM) in its practice directive on audit exemption.
Those qualifying conditions are deliberately not reproduced here. Eligibility is assessed against a company’s own figures across more than one financial year, the conditions have been revised before, and a table on a website is a poor place to make that assessment. Read the current directive on SSM’s audit exemption page and apply it to your own financial statements.
What follows assumes the statutory question has been answered. It deals with everything the statutory answer does not settle.
Exemption from audit is not exemption from financial statements
This is the most common misreading. Under subsection 248(1) of the Companies Act 2016, the directors of every company shall prepare financial statements within eighteen months from incorporation and, subsequently, within six months of each financial year end. An audit exemption does not touch that duty.
SSM’s practice directive is explicit that a company electing exemption must still lodge unaudited financial statements with the Registrar in compliance with sections 258 and 259, together with the directors’ report, statement by directors, statutory declaration and any other reports required to be lodged, and accompanied by a certificate signed by a director confirming the company’s entitlement to the exemption. The unaudited financial statements must still comply with the applicable approved accounting standards under subsection 244(1).
The dates are unchanged too. For a private company, paragraph 258(1)(a) requires circulation within six months of financial year end, and paragraph 259(1)(a) requires lodgement within thirty days from circulation. Removing the audit removes a procedure, not a deadline.
Your own shareholders can require an audit
A company that qualifies for exemption can be put back into audit by the people inside it. Under the practice directive, a company eligible for audit exemption shall be required to audit its accounts if it receives written notice requiring it to do so from members eligible to vote holding in aggregate not less than 5% of the total number of issued shares or of any class of those shares, from not less than 5% of the members eligible to vote, or from the Registrar directing the company to have its accounts audited.
The timing is specific. The notice must be received during the financial year and not later than one month before the end of that financial year. A minority shareholder who becomes uneasy in month eleven of a twelve-month year can still require an audit for that year. One who waits until after year end cannot. Where a company has shareholders who are not involved in day-to-day management, this is worth understanding before the year closes rather than after.
Financing agreements usually decide it
Banking facility agreements commonly require audited financial statements within a stated period after financial year end, and commonly measure financial covenants on audited figures. Term loans, revolving facilities, trade lines, receivables financing and corporate guarantees may each carry their own reporting schedule.
Two points are worth separating. First, the obligation sits in the facility documentation rather than in company law, so it is unaffected by any change in the statutory audit position. A company that becomes exempt does not thereby stop owing audited accounts to its bank. Second, late delivery of audited accounts is frequently drafted as an event of default in its own right, independent of any financial covenant. The information undertakings clause is the place to check, and it should be checked before the exemption is relied upon rather than after the reporting date has passed.
Shareholder, joint venture and transaction agreements
Shareholders’ agreements, joint venture agreements and investment agreements often require audited accounts, and frequently use audited figures to calculate something: a dividend entitlement, an earn-out, a put or call price, a management incentive, or a valuation on deadlock or exit. Where a price is defined by reference to audited figures, an unaudited set does not satisfy the clause, and one party cannot substitute it unilaterally.
A planned sale raises the same issue in a different form. A buyer will normally examine several years of financial information, and a company that ceased to be audited part-way through that period leaves the earlier and later years resting on different evidence. That is not fatal, but it tends to become a diligence point and occasionally a price point.
Group reporting obligations
A Malaysian company inside a group has two further considerations. Subsection 247(1) of the Companies Act 2016 requires the directors of a holding company that is not a foreign company to take the steps necessary to ensure that, within two years after a corporation becomes its subsidiary, the subsidiary’s financial year coincides with the holding company’s.
Separately, where a parent’s consolidated financial statements are audited, the group auditor will normally need assurance over the amounts the Malaysian entity contributes to the group. Depending on the group auditor’s assessment of that entity’s significance, this may mean a full audit of the subsidiary or work performed to a group instruction. Where the parent is outside Malaysia, this requirement comes from the parent’s own reporting framework and is not affected by what the Malaysian company qualifies for locally.
Grants, tenders, licences and counterparties
Grant agreements, incentive conditions, procurement registrations, tender submissions, franchise agreements and licence conditions may each call for financial information, and what they ask for differs. Some require audited financial statements. Some require statements prepared to a stated framework without requiring an audit. Some require only a return of specified figures.
Generalising here is unhelpful and often wrong. The reliable method is to identify each arrangement the company is party to or is applying for, locate the reporting clause, and record what it requires and by when. That exercise takes an afternoon and settles the question more accurately than any general guidance.
What this means in practice
A company that concludes it does not require an audit has usually answered only the company law question. Before treating that as the decision, it is worth working through the following:
- Confirm the statutory position against SSM’s current directive, applied to the company’s own financial statements over the periods the directive requires.
- Confirm that financial statements will still be prepared, circulated and lodged on time, with the certificate and supporting reports the directive requires.
- Read the information undertakings in every financing agreement, including facilities that are undrawn.
- Read the reporting and valuation clauses in any shareholders’, joint venture, investment or franchise agreement.
- Ask whether any group parent, grant provider, licensor, regulator or significant customer expects audited figures.
- Consider whether shareholders outside management may serve a notice, and note that the cut-off is one month before financial year end.
If none of these applies, a company that qualifies may reasonably decide not to be audited, and there is no professional basis for suggesting otherwise. If any of them applies, the audit is required by that arrangement, and the statutory position does not displace it. The distinction matters because the two questions are often answered together when only one of them has actually been considered.
Where a company decides that independent assurance is needed, whether by requirement or by choice, the scope and timetable should be agreed early enough to fit the reporting deadlines above. To discuss how that would work for your company’s circumstances, see our audit and assurance services.
This article is general information about the requirements described. It is not advice on any particular company’s position, and it does not take account of the facts, agreements or reporting obligations of any specific company. Whether an audit is required for a given financial year depends on that company’s own figures, agreements and circumstances, which should be assessed directly against the current requirements.