Company Audit in Malaysia Explained: What It Is and Who Needs One

"Company audit" is a phrase most Malaysian business owners hear from their company secretary or banker, often without a clear explanation of what it actually involves. In Malaysia, a company audit almost always means a statutory audit — the annual, legally required examination of a company's financial statements. Here is what it is, who needs one, and what you get at the end.

What a company audit actually is

A statutory audit is an independent examination of a company's financial statements by an external, approved auditor. The auditor gathers evidence — testing transactions, verifying balances, confirming bank and debtor figures, and reviewing how the accounts were prepared — and then expresses a professional opinion on whether the financial statements give a true and fair view and comply with the approved accounting standards in Malaysia (such as MFRS or MPERS) and the Companies Act 2016.

The auditor does not prepare your accounts. That separation is deliberate: independence is what gives the audit opinion its value to outside readers like banks and investors.

Which companies need a company audit?

Under the Companies Act 2016, every company incorporated in Malaysia — including private limited (Sdn Bhd) companies — must have its financial statements audited annually by an approved auditor, unless it qualifies for an exemption. Public companies, foreign companies, and subsidiaries of listed companies must be audited regardless of size. Smaller private companies may now qualify to skip the audit under the 2025 rules — see our guide to audit exemption in Malaysia.

Who can carry out the audit

Only an approved company auditor can perform and sign a statutory audit. That auditor must be a member of the Malaysian Institute of Accountants (MIA) with a practising certificate, and must be approved under Section 263 of the Companies Act 2016. If you are curious about that pathway, read how to become an auditor in Malaysia.

What happens during the audit

A well-run audit follows a structured process: planning and risk assessment, a document request and walkthrough of your processes, fieldwork and substantive testing, a discussion of findings with management, and finally the issuance of the report. For a prepared SME this typically takes between two and six weeks. You can see the full sequence on our audit process page, and prepare ahead using our documents checklist.

What you receive at the end

• The independent auditor's report — the formal opinion on your financial statements (explained in what is an audited report);
• Audited financial statements ready for filing and for sharing with banks and stakeholders; and
• A management letter setting out any control weaknesses or recommendations the auditor noticed along the way.

Need a statutory audit for your Sdn Bhd? Explore our audit services or request a quote.