# Appointing an Auditor for a Malaysian Company

> Who may be appointed as auditor of a Malaysian company, who makes the appointment and by when, and the statutory independence disqualifications in section 264 of the Companies Act 2016.

- Category: audit
- Language: en
- Status: published
- Updated: 2026-07-20
- Canonical: https://negaraku.md/en/audit/appointing-an-auditor

---

A signed engagement letter is not an appointment. Neither is an email confirming
the fee. The appointment of an auditor is a statutory act with a named organ of
the company doing the appointing, a deadline attached to it, and an offence
provision for both the company **and every director** if it is missed.

Most first-year Sdn Bhd owners find this out when the auditor asks for a copy of
the directors' resolution and there isn't one.

## Who is allowed to audit your company?

Three separate permissions stack, and satisfying one does not satisfy the others.

**Ministerial approval.** Section 263 of the Companies Act 2016 says any person
may apply to the Minister charged with responsibility for finance to be approved
as a company auditor. Approval turns on the Minister being satisfied the
applicant is of good character and competent. Three features of that approval get
missed:

- it may be granted subject to limitations or conditions, and **revoked at any
  time** by notice, under s.263(3)
- every approval, including a renewal, is **in force for two years** from issue
  under s.263(4)
- the Minister may delegate the power to a body charged with the registration or
  control of accountants in Malaysia, under s.263(5)

An applicant who is refused may appeal to the Court under s.263(6).

**Chartered accountant status.** Section 263(7) defines "person" for the whole
section as a chartered accountant as defined under the Accountants Act 1967. In
other words, the licence sits on top of MIA membership. A person who is not a
chartered accountant cannot be approved at all.

**AOB registration, for public interest entities.** If the company is a public
interest entity or a schedule fund, the auditor must additionally be registered
with the Audit Oversight Board under Part IIIA of the Securities Commission
Malaysia Act 1993. This is a separate register kept by the Securities Commission,
with its own criteria, and it does not follow from the s.263 approval.

## The firm, not only the person

Where a firm is appointed, s.264(4) requires that **all partners of the firm
resident in Malaysia** are approved company auditors, and that no partner is
disqualified under s.264(1). Where the firm is not registered under any other
law, a return of the full names and addresses of all partners must be lodged with
the Registrar.

Section 265 then requires a new firm of auditors to notify the Registrar within
**30 days** of commencing business, giving the firm name, firm number, addresses,
commencement date and the approval numbers of all partners. Any reconstitution of
the firm must be notified within **30 days** of the change.

The practical consequence appears on the signature page. Under s.265(5), a report
by a firm is not duly made unless it is signed in the name of the firm **and** in
his own name by a partner who is an approved company auditor, with the firm number
and the partner's approval number legibly written or printed beside the
signatures. That is why an audit report ends with an AF number under the firm name
and a number like 03000/09/2028 (J) under the partner's. Both are checkable.

## Consent comes before the appointment

Section 264(5) prohibits a company from appointing a person or a firm as auditor
unless, **prior to the appointment**, that person has consented in writing, or in
the case of a firm at least one partner has consented in writing.

Boards routinely pass the resolution first and collect the consent letter later.
That is the wrong order, and the file will show it.

Section 264(6) adds a point that matters on succession: appointing a firm in the
firm's name takes effect as an appointment of the persons who are partners at the
time of appointment. Section 264(7) deals with the limited liability partnership
equivalent.

## Who appoints, and by when

The two chapters of the Act split private and public companies.

**Private company — s.267.** The company must appoint an auditor for **each
financial year** unless exempted by the Registrar under s.267(2), which is the
hook Practice Directive 10/2024 hangs on.

The Board appoints under s.267(3):

- for a **newly incorporated company**, at least **30 days before the end of the
  period for the submission of the first financial statements to the Registrar**
- to fill a **casual vacancy**

The members appoint by ordinary resolution under s.267(4), in later years during
the *period for appointing auditors*, or where the Board has failed to appoint.

Section 267(6) defines that period as the **30 days before the end of the
lodgement period** for the previous year's financial statements under s.259(1) —
or, where those statements were lodged early, the 30 days before the day they were
actually lodged. Lodging early therefore pulls the appointment window forward.

Section 267(5) closes the loop: an auditor may **only** be appointed under
subsection (3) or (4). There is no third route, and s.267(7) makes the company and
every director liable for a contravention.

> **Correction worth making.** A number of guides state that the first auditor
> must be appointed 30 days before the *circulation* of the first financial
> statements. The Act says 30 days before the end of the period for their
> **submission to the Registrar**. Circulation under s.258 and lodgement under
> s.259 are different dates 30 days apart, so the two readings give different
> deadlines.

To work the date backwards for a new company: the first financial statements are
due within **18 months** of incorporation under s.248(1)(a), circulation within
**six months** of the financial year end under s.258, and lodgement within **30
days** of circulation under s.259(1).

**Public company — s.271.** The Board appoints at any time before the first annual
general meeting, or to fill a casual vacancy. Members appoint by ordinary
resolution at the AGM. Under s.273 the auditor holds office until the conclusion
of the next AGM unless re-appointed.

**If nobody appoints.** Sections 268 and 272 let the Registrar appoint an auditor
on the written application of any member. It is a remedy for deadlock, not a
convenience.

## How long the office lasts

For a private company, s.269(1)(b) is the clock: the auditor **ceases to hold
office 30 days from the circulation of the financial statements** to members,
unless re-appointed.

Where the office falls vacant that way and members have appointed nobody, s.269(3)
**deems** the outgoing auditor re-appointed — unless he was appointed by the
Board, the constitution requires an actual re-appointment, the members have
resolved that he should not be re-appointed, or the deemed re-appointment is
prevented under s.270.

Section 270 gives members holding at least **5% of the total voting rights** the
right to block a deemed re-appointment by notice, in hard copy or electronic form,
authenticated by each member giving it, and received by the company **at least 30
days before the circulation** of the financial statements.

Under s.269(1)(a) an incoming auditor does not take office until the previous
auditor ceases to hold office, unless he is the first auditor — with exceptions in
s.269(2) for joint and additional auditors. You cannot quietly run two sole
auditors in parallel.

## Independence: what section 264 actually disqualifies

Section 264(1) makes it an offence to knowingly consent to be appointed, to
knowingly act, or to prepare a report required to be prepared by an approved
company auditor, where the person:

| Disqualification | Detail |
| --- | --- |
| Not approved | Is not an approved company auditor |
| Indebtedness | Owes the company, or a corporation related to it under s.7, **more than RM25,000** |
| Officer link | Is, or whose spouse is, an officer of the company |
| Partner or employer link | Is a partner, employer or employee of an officer; or a partner or employee of an employee of an officer |
| Shareholder link | Is, or whose spouse is, a shareholder of a corporation whose employee is an officer of the company |
| Registers | Is responsible for, or is the partner, employer or employee of a person responsible for, keeping the register of members or debenture holders |
| Bankruptcy | Is an undischarged bankrupt inside or outside Malaysia, except with leave of the Court |
| Conviction | Has been convicted of an offence involving fraud or dishonesty punishable with imprisonment of three months or more |

Two qualifiers change the answer in practice. Section 264(2) treats a person as an
officer if he was an officer or promoter of the company, or of a related
corporation, **at any time in the preceding twelve months** — so a finance
director who left in March cannot audit the December accounts. Section 264(3)
confirms that being appointed auditor of a corporation does not by itself make a
person an officer of it.

Contravention of s.264(1) or (4) carries a fine up to **RM100,000** on conviction
under s.264(8).

Sitting above all of this is the MIA By-Laws (On Professional Ethics, Conduct and
Practice), which incorporate the international independence standards. Those are
stricter than s.264 and bind the auditor rather than the company — but they are
the reason a firm will decline an engagement that s.264 would technically permit.

## Fixing the fee

Section 274 assigns the power. An auditor appointed by members has remuneration
fixed by the members by ordinary resolution or as they determine; one appointed by
the Board has it fixed by the Board, and failing that by the company; one appointed
by the Registrar has it fixed by the Registrar or the Board, failing which by the
company. Remuneration includes expenses and non-cash payment.

Separately, s.275 lets 5% of members, or holders of 5% of issued share capital,
demand particulars of everything paid to the auditor for **non-audit services** —
a shareholder tool that gets almost no attention.

## Common mistakes

- **Treating the engagement letter as the appointment.** The appointment is a
  resolution of the Board or the members; the engagement letter is a contract.
- **Passing the resolution before the written consent exists**, contrary to
  s.264(5).
- **Using the circulation date to compute the first-auditor deadline.** s.267(3)(a)
  runs off the submission period, not circulation.
- **Forgetting that early lodgement moves the appointment window**, under
  s.267(6)(b).
- **Assuming a chartered accountant can sign an audit report.** Only an approved
  company auditor can, and only with the approval number printed beside the
  signature.
- **Ignoring the twelve-month officer look-back in s.264(2)** when a former finance
  officer joins the audit firm, or vice versa.
- **Overlooking the RM25,000 indebtedness limit**, which catches director loans
  routed through a related corporation.
- **Relying on deemed re-appointment** where the auditor was appointed by the
  Board, which is one of the four cases in s.269(3) where it does not apply.

## What's next

Once the auditor is appointed, the next thing worth planning is the engagement
itself — acceptance, the request list, fieldwork and the report date all sit on a
timeline that has to fit inside the six-month circulation deadline.

## Sources

- Companies Act 2016 (Act 777), reprint as at 1 August 2022 — https://www.ssm.com.my/Pages/Legal_Framework/Document/Companies%20Act%202016_Akta%20777_BI%20(1.8.2022).pdf (SSM)
- By-Laws (On Professional Ethics, Conduct and Practice) of the Malaysian Institute of Accountants, updated 5 November 2024 — https://mia.org.my/wp-content/uploads/2024/11/By-Laws-updated-Nov-2024-%E2%80%93-Effective-15-December-2024.pdf (MIA)
- Registration of Audit Firm and Individual Auditors — https://www.sc.com.my/aob/registration-of-audit-firm-and-individual-auditors (Securities Commission Malaysia)
- AAPG 2 — Auditors report on financial statements prepared in accordance with MPERS and Companies Act 2016 — https://mia.org.my/wp-content/uploads/2022/06/MIA_Audit_and_Assurance_Practice_Guide_AAPG_2.pdf (MIA)

---
Source of truth: https://github.com/negaraku-md/NegaraKu.md
License: CC BY-SA 4.0