When a Sdn Bhd Must Be Audited: The Basics Under the Companies Act 2016

You have just registered a Sdn Bhd, the business is still small, and the company secretary has just sent over an invoice for audit fees. The question is not “how much does an audit cost” — but “am I actually required to be audited?” For most private limited companies in Malaysia, the default answer is yes, and only a small set of companies truly qualify to escape it.

This article explains the basic rule under the Companies Act 2016: who must be audited, who qualifies for exemption, and how an auditor is appointed, resigns and is removed.

What is the default rule — must every Sdn Bhd be audited?

The starting point is simple. Section 267(1) of the Companies Act 2016 requires every private company to appoint an auditor for each financial year for the purpose of auditing its financial statements. This is not optional — it is a statutory requirement that applies to every Sdn Bhd by default.

The appointed auditor is responsible under section 266 (powers and duties of auditors) for reporting to the members of the company whether the financial statements give a true and fair view in accordance with approved accounting standards, and whether proper accounting records have been kept. To carry out that duty, the auditor is given a right of access at all reasonable times to the company’s accounting records, and the right to require information from the company’s officers.

So the default rule can be summarised like this: an audit is mandatory, except where your company falls within a category the Registrar has exempted. The power to grant that exemption comes from section 267(2), which allows the Registrar to exempt any private company from the requirement to appoint an auditor, subject to the criteria and conditions prescribed.

Who qualifies for exemption from audit?

The exemption criteria are now set out in Practice Directive No. 10/2024, issued by SSM on 16 December 2024. PD 10/2024 revokes the earlier PD 3/2017 and introduces an approach based on financial thresholds.

There are two routes to exemption: dormant companies, and companies that meet the size thresholds.

Route 1: Dormant companies

A company that is dormant remains exempt from the audit requirement. A company is considered dormant in a financial year if it does not carry on business and no accounting transaction occurs. An “accounting transaction” means a transaction the record of which is required to be kept under section 245(1) of the Companies Act 2016 — but excludes transactions arising from statutory obligations the company is required to pay (for example statutory fees) and the related costs of complying with them.

Two situations qualify:

• A company that is dormant from the time of its incorporation; or
• A company that is dormant throughout the current financial year and the immediately preceding financial year.

Route 2: Size thresholds (the two-out-of-three criteria)

For active companies, exemption depends on size. A company qualifies if it meets at least two of the three following criteria, for the current financial year and the two preceding financial years:

• (a) Annual revenue does not exceed the prescribed threshold;
• (b) Total assets in the statement of financial position do not exceed the prescribed threshold; or
• (c) The number of employees at the end of the financial year does not exceed the prescribed threshold.

The key thing to understand: these thresholds are not fixed — they rise in phases over three years to help companies adjust to the new framework.

What are the phased PD 10/2024 thresholds?

This is the part most often misunderstood. The threshold depends on when the company’s financial period begins, not when the statements are lodged. The table below is the core of the Practice Directive:

Phase	Financial period begins	Submission year	Revenue (not exceeding)	Total assets (not exceeding)	Employees (not exceeding)
Phase 1	On/after 1 Jan 2025 (up to 31 Dec 2025)	From 1 Jan 2026	RM1,000,000	RM1,000,000	10
Phase 2	On/after 1 Jan 2026 (up to 31 Dec 2026)	From 1 Jan 2027	RM2,000,000	RM2,000,000	20
Phase 3	On/after 1 Jan 2027	From 1 Jan 2028	RM3,000,000	RM3,000,000	30

Remember, the revenue, total assets and number of employees for the two preceding financial years must also not exceed the maximum threshold for the relevant phase. The full RM3 million threshold only takes effect for financial periods beginning on or after 1 January 2027.

How are “revenue”, “assets” and “employees” defined?

These definitions matter because they determine whether you are truly below the threshold:

• Annual revenue includes revenue received and receivable within the year, but excludes credit entries for the reversal of earlier accounting entries, tax-related entries, reversals of earlier provisions, and gains on the derecognition of property, plant, equipment and investment property.
• Total assets means assets as defined in approved accounting standards, including current and non-current assets.
• Employees means full-time employees at the end of each financial year — including local, foreign, contract and probationary employees — but excludes directors who are also full-time employees, shareholders who are also full-time employees, or family members/associates who are unpaid or receive irregular wages.

Who CANNOT be exempt, even if small?

Some companies do not qualify at all, regardless of size or level of activity. PD 10/2024 lists the exemption as not applying to:

• An exempt private company that has elected to lodge an EPC status certificate with the Registrar under section 260;
• A public company, including a listed company;
• A private company that is a subsidiary of a public company; and
• A foreign company.

This means, for example, a Sdn Bhd wholly owned by a listed public company still must be audited even if it is dormant or micro-sized.

Decision framework: must my Sdn Bhd be audited?

Use this sequence of questions to determine your company’s position:

1. Is the company a public company, a subsidiary of a public company, a foreign company, or an EPC that has lodged a certificate? If yes → audit required. Stop here.
2. Is the company dormant from incorporation, or dormant throughout the current year and the preceding year? If yes → qualifies for exemption (Route 1).
3. Does the company meet at least two of the three thresholds (revenue, assets, employees) for the current year and the two preceding years, under the correct phase? If yes → qualifies for exemption (Route 2).
4. Has any member holding ≥5% of the shares (or ≥5% of members), or the Registrar, sent written notice requiring an audit? If yes → audit required even if otherwise eligible for exemption.
5. If none of the exemption routes apply → audit required under section 267(1).

Bear in mind: qualifying for exemption does not mean automatically exempt. The company elects not to be audited. It can always appoint an auditor voluntarily — for example if a bank or an investor demands audited statements.

Can shareholders compel an audit even if the company qualifies for exemption?

Yes — and this is an important protection for minority members. Even if a company qualifies for exemption, it still must audit its accounts if it receives written notice requiring an audit, given not later than one month before the end of the financial year, from:

• Any member holding in aggregate not less than 5% of the total issued shares (or the shares of a class);
• Not less than 5% of the total number of members eligible to vote; or
• The Registrar, who directs the company to audit its accounts.

Even if exempt — what still has to be lodged?

Audit exemption is not an exemption from lodging financial statements. This misunderstanding frequently causes compliance failures.

A company that elects for exemption must:

• Prepare financial statements that comply with approved accounting standards (section 244(1));
• Lodge those unaudited statements with the Registrar, together with the certificates required under sections 258 and 259;
• Include the directors’ report, statement by directors, and statutory declaration, along with other lodgements under sections 251 and 252; and
• Attach the audit exemption certificate (Appendix 1 of PD 10/2024) signed by a director, confirming that the company qualifies for exemption under section 267(2) and that members have not required an audit for that year.

For a private company, the financial statements must be circulated within six months of the financial year-end date (section 258(1)(a)), and the first set prepared within 18 months of the date of incorporation (section 248(1)(a)).

How is an auditor appointed?

For companies that do need to be audited, the mechanics of appointment are governed by sections 267–270:

• First appointment — the directors may appoint an auditor before the first general meeting (or, for a private company, before the first financial statements are circulated).
• Subsequent appointment — members appoint the auditor by ordinary resolution.
• Failure to appoint — if a company fails to appoint an auditor, the Registrar may appoint an auditor on the application of a member (section 268).
• Automatic reappointment — for a private company, the existing auditor is deemed to be automatically reappointed (section 269), unless members take steps to prevent this by objecting at least 30 days before the financial statements are circulated (section 270).

How does an auditor resign or get removed?

The auditor’s lifecycle does not end with appointment. Three key mechanisms:

Resignation (section 281). An auditor may resign by giving written notice to the company at its registered office. The auditor’s office ends 21 days after the notice is given, or on the later date stated in the notice, whichever is later.

Notification to the Registrar (section 282). After an auditor resigns, the company must notify SSM. The “Notification of Resignation of Auditor by Company” is submitted to SSM through the Corporate Registry System (CRS), accompanied by a copy of the resignation notice.

Removal (sections 276 and 277). Members of the company may remove an auditor at any time by ordinary resolution at a general meeting. However, special notice is required for that resolution (section 277); the company must inform the auditor and the Registrar, and the auditor is entitled to make written representations. After an auditor is removed or resigns, the directors must call a general meeting as soon as reasonably practicable to appoint a new auditor.

Common mistakes to avoid

Several recurring mistakes often undermine compliance:

• Assuming audit exemption means no lodgement. Wrong — the unaudited statements must still be lodged with the exemption certificate.
• Using the wrong phase’s threshold. The RM3 million threshold does not apply to financial periods beginning in 2025; that phase is still at RM1 million and 10 employees.
• Forgetting to check the two preceding years. Eligibility depends on the current year and the two preceding financial years — not the current year alone.
• Overlooking the category bars. A subsidiary of a public company must still be audited even if small.
• Counting directors/shareholders as employees. The definition of “employee” excludes directors and shareholders who work full-time — miscounting can cause a company to wrongly think it exceeds the threshold.
• Assuming PD 3/2017 still applies. PD 3/2017 has been revoked; it only remains applicable to statements with financial periods beginning on or before 31 December 2024.

What next

If you manage a Sdn Bhd, start by determining the financial year start date and matching it to the correct PD 10/2024 phase, then check the revenue, assets and employee figures for three financial years (the current year and the two preceding). If you meet two of the three criteria and no category bar applies, discuss with the company secretary whether to elect for exemption — and make sure the unaudited statements are still lodged with the correct certificate.

If in doubt about eligibility, dormancy, or the effect of a shareholder notice, refer to the full text of the Companies Act 2016 and Practice Directive 10/2024 on the SSM portal, or seek advice from a qualified company secretary. For detailed thresholds and definitions, see the related guide on the audit exemption qualifying criteria and on lodging Sdn Bhd financial statements.

This guide is an AI-generated draft for general information purposes, not legal or accounting advice.