Audit Exemption for Private Companies: Do You Qualify?

For years, nearly every Sdn Bhd in Malaysia was forced to appoint an auditor — regardless of whether it was a one-person retail shop or a factory. At the end of 2023, there were 666,767 active companies but only 1,919 approved auditors to sign off their accounts. SSM Practice Directive 10/2024 changes that: from financial year 2025, hundreds of thousands of small companies can skip the statutory audit entirely — if they meet the criteria.

This guide explains who qualifies, the exact threshold for each phase, the technical definitions that govern the calculation, who is excluded outright, and the duties that still apply even when you no longer need an auditor.

What is audit exemption exactly?

Under subsection 267(1) of the Companies Act 2016 (CA 2016), every private company must appoint an auditor for each financial year to audit its financial statements. Subsection 267(2) then gives the Registrar (SSM) the power to exempt any private company from that requirement in accordance with prescribed criteria and conditions.

Practice Directive 10/2024, issued on 16 December 2024 under section 20C of the Companies Commission of Malaysia Act 2001 and subsection 267(2) of CA 2016, is the document that sets those criteria. It replaces the older Practice Directive 3/2017, which was revoked with immediate effect.

An important point that is often misunderstood: audit exemption is not a filing exemption. You must still prepare financial statements and lodge them with SSM. What is removed is only the cost and process of appointing an independent auditor to verify those accounts.

Does my company qualify? The two-of-three test

A private company qualifies for audit exemption if it meets at least two (2) of the three (3) following criteria:

1. The company’s annual revenue during the current financial year and in the two preceding financial years does not exceed the threshold;
2. The company’s total assets in the current statement of financial position and in the two preceding financial years does not exceed the threshold; or
3. The number of employees at the end of the current financial year and in the two preceding financial years does not exceed the threshold.

Note two things. First, you only need to meet two of the three — so an asset-light company with low revenue and few employees but a large balance sheet can still qualify through the revenue and employee tests. Second, each criterion is tested across three years: the current year and the two preceding years. A single year that exceeds the threshold within that period will affect qualification for that criterion.

What are the thresholds? A three-year phased implementation

SSM did not raise the thresholds to their full level immediately. Instead, the thresholds rise in stages over three years so that companies can adjust progressively.

Phase	Financial period begins	Submission year	Revenue (RM)	Assets (RM)	Employees
Phase 1 (2025)	On/after 1 Jan 2025 to 31 Dec 2025	From 1 Jan 2026	1,000,000	1,000,000	10
Phase 2 (2026)	On/after 1 Jan 2026 to 31 Dec 2026	From 1 Jan 2027	2,000,000	2,000,000	20
Phase 3 (2027)	On/after 1 Jan 2027	From 1 Jan 2028	3,000,000	3,000,000	30

There is one subtle detail that is often overlooked. A note in the directive clarifies that the annual revenue, total assets, and number of employees for the two preceding financial years must also not exceed the maximum threshold set for the phase in question. This means a company assessing its eligibility for financial year 2025 (Phase 1) must ensure the figures for the two preceding years also fall within the RM1 million / 10 employees threshold — not the threshold of another phase.

What do “revenue”, “assets” and “employees” mean precisely?

The threshold figures mean nothing without clear definitions. Practice Directive 10/2024 gives specific definitions for each term, and these definitions are what determine whether you qualify.

Annual revenue includes revenue received and receivable throughout the year. But it does not include:

• credit entries for the reversal of accounting entries arising from earlier entries;
• accounting entries relating to taxation;
• reversals of provisions made earlier; and
• gains from the derecognition of property, plant and equipment and investment property in the Statement of Comprehensive Income.

Total assets means assets as defined in the applicable approved accounting standards, and this covers both current and non-current assets.

Employees means full-time employees employed by the company at the end of each relevant financial year. This includes local, foreign, and contract employees, and employees on probation — but does not include:

• directors who also work as full-time employees;
• shareholders who also work as full-time employees; or
• family members or friends who work without pay or receive irregular wages.

Excluding directors and shareholders from the employee count matters for owner-managed family companies — it means several small companies run by their own owners may record a very low employee count.

Example: assessing eligibility step by step

Consider a services company, Aman Digital Sdn Bhd, assessing the financial year ending 31 December 2025 (Phase 1, RM1 million / 10 employees threshold).

Criterion	FY 2023	FY 2024	FY 2025	Within RM1 million / 10 threshold?
Revenue	RM720,000	RM850,000	RM980,000	Yes (all three years)
Total assets	RM1,200,000	RM1,350,000	RM1,500,000	No (exceeds)
Employees	6	7	8	Yes (all three years)

Aman Digital meets the revenue and employee criteria across all three years. Even though it fails the assets test, it has met two of the three criteria — so it qualifies for audit exemption for FY 2025. It can file unaudited financial statements together with a certificate.

If its revenue in FY 2024 had jumped to RM1,100,000, the revenue test fails (because one year in the period exceeds the threshold), and the company would meet only one criterion — employees — and no longer qualify.

Who does not qualify no matter what?

Some companies are excluded from this scheme entirely, no matter how small their figures. Audit exemption under Practice Directive 10/2024 does not apply to:

• An exempt private company that has opted to lodge a certificate regarding its status with the Registrar under section 260 of CA 2016;
• Public companies, including listed companies;
• A private company that is a subsidiary of a public company; and
• Foreign companies.

Note the first carve-out carefully. An exempt private company (EPC) — defined in section 2 of CA 2016 as a private company that has no more than 20 members, none of whom is a corporation, and in which no corporation holds a beneficial interest, directly or indirectly, in its shares — is only excluded from this audit scheme if it opts to lodge an EPC certificate under section 260. An EPC that does not lodge such a certificate is not barred by this carve-out and can assess its eligibility through the two-of-three test like any other private company.

How does this differ from the old rules?

Previously, under Practice Directive 3/2017, only three narrow categories qualified, with far lower thresholds.

Item	PD 3/2017 (old)	PD 10/2024 (new, full)
Revenue threshold	RM100,000	RM3,000,000
Asset threshold	RM300,000	RM3,000,000
Employee threshold	5	30
Qualifying test	Must meet all three conditions (threshold-qualified category)	Must meet two of three
Categories	Dormant, zero-revenue, threshold-qualified	A single phased threshold test for all

The increase is significant. The revenue threshold jumps from RM100,000 to RM3 million by Phase 3, and the test becomes more relaxed — two of three, not all three. Dormant companies remain fully exempt as before.

What still needs to be filed?

This is the part most often misunderstood. A company that opts for audit exemption must still file the following set of documents with the Registrar:

• Unaudited financial statements, prepared in accordance with approved accounting standards (under subsection 244(1) of CA 2016) — for most small companies this means the Malaysian Private Entities Reporting Standard (MPERS);
• An audit exemption certificate containing the matters in Appendix 1 of the directive, signed by a director confirming that the company qualifies for exemption under section 267(2);
• The directors’ report, the statement by directors, and the statutory declaration; and
• Any other reports that must be filed, including filings under sections 251 and 252 of CA 2016.

All of this is filed in accordance with sections 258 and 259 of CA 2016. The certificate must state, among other things, that members did not request an audit for the year, that the directors acknowledge their responsibilities under CA 2016, and that the financial statements were prepared in accordance with MASB (MPERS) standards. The certificate also states the date the financial statements were circulated to members.

Can others force an audit?

Yes. Qualifying for exemption is not an absolute guarantee. Even when a company qualifies, it must audit its accounts if it receives written notice, no later than one month before the end of the financial year, from any of the following:

• Members holding in aggregate not less than 5% of the total issued shares of the company (or any class of those shares);
• Not less than 5% of the total number of members eligible to vote in the company; or
• The Registrar (SSM), which may direct the company to audit its accounts.

This protects minority shareholders and gives SSM the power to demand an audit when necessary.

In addition, if a company no longer qualifies in a given year (for example revenue exceeds the threshold), it ceases to be exempt from that year — but it remains exempt for earlier financial years in which it did qualify.

Common mistakes to avoid

• Assuming audit exemption means nothing needs to be filed. Wrong. Unaudited financial statements and a certificate must still be filed under sections 258 and 259.
• Testing only the current year. Each criterion is tested across three years — the current year and the two preceding years. A single year that exceeds the threshold affects that criterion.
• Using the wrong phase threshold for earlier years. For Phase 1 (FY 2025), the two preceding years must also fall within the RM1 million / 10 employees threshold, not the RM3 million threshold.
• Counting directors and shareholders as employees. Director-employees and shareholder-employees are excluded from the employee count, as are unpaid family members.
• Including one-off gains in revenue. Gains from asset derecognition, reversals of provisions, and tax entries are excluded from the definition of annual revenue.
• Thinking an EPC is always excluded. An EPC is only barred if it has opted to lodge a section 260 certificate; otherwise, it assesses eligibility like an ordinary private company.

Quick decision framework

To determine whether your company can skip the audit for a given financial year:

1. Does the financial period begin on/after 1 January 2025? If not, the old PD 3/2017 applies.
2. Does the company fall into any excluded category (public company, subsidiary of a public company, foreign company, or an EPC that lodges an s260 certificate)? If yes, an audit is mandatory.
3. Is the company dormant since incorporation, or dormant in the current year and the preceding year? If yes, it is exempt outright.
4. Identify the phase based on the financial period start date, and apply that phase’s threshold.
5. Test each criterion across three years. Does the company meet at least two of three? If yes, it qualifies.
6. Check for notices. Has a 5% member, or 5% of members, or the Registrar demanded an audit? If yes, an audit is mandatory even though the company qualifies.
7. If it qualifies and there is no demand, file the unaudited financial statements together with the certificate under sections 258 and 259.

Next steps

Before deciding to skip the audit, gather three years of financial statements (the current year and the two preceding years) and verify each revenue, asset, and employee figure against the correct phase threshold. The figures must be calculated according to the specific definitions in the directive — especially the exclusions in the definitions of revenue and employees.

Discuss with your company secretary or accountant whether a voluntary audit is still worthwhile: some banks, lenders, or business partners may still require audited accounts even when the law does not mandate them. Refer to the full text of Practice Directive 10/2024 on the SSM website for the exact wording of the certificate in Appendix 1 and any updates.

For more context, see our related guides on the Companies Act 2016 and the obligation to file unaudited financial statements with SSM.