The Audit Oversight Board and Registration of Auditors for Public Interest Entities

Passing the Minister of Finance’s audit licence and joining the MIA still does not let you sign off on a Bursa-listed company’s accounts. For a capital-market audit there is a further requirement — registration with the Audit Oversight Board — which only auditors of public interest entities and schedule funds need to meet.

What is the Audit Oversight Board?

The Audit Oversight Board (AOB) was set up on 1 April 2010 as a function of the Securities Commission Malaysia (SC), established pursuant to the Securities Commission Malaysia Act 1993 (SCMA). It regulates auditors of public interest entities (PIEs) and schedule funds — companies and funds whose accounts matter to the wider investing public — under Part IIIA of the SCMA.

The AOB’s stated purpose is to foster high-quality, independent auditing so investors can rely on the audited financial statements of PIEs and schedule funds. In practice it does three things: it registers the auditors allowed to do this work, inspects their engagements and workpapers, and takes enforcement action when auditing or ethical standards are breached.

How is the AOB different from the MIA or the s.263 licence?

Malaysia’s audit gatekeeping runs in layers, and it is easy to conflate them. The AOB is the additional, capital-market-specific layer, and it only applies to auditors of PIEs and schedule funds.

Gate	Who runs it	What it authorises
Chartered accountant	Malaysian Institute of Accountants (MIA), under the Accountants Act 1967	Membership as a professional accountant
Company auditor licence (s.263, Companies Act 2016)	Minister of Finance	Auditing companies generally
AOB registration / recognition (Part IIIA, SCMA 1993)	Audit Oversight Board (Securities Commission)	Auditing public interest entities and schedule funds

Under section 263 of the Companies Act 2016, a person may apply to the Minister charged with responsibility for finance to be approved as a company auditor, and that section defines “person” as a chartered accountant under the Accountants Act 1967. An auditor who only serves private companies with no PIE clients never needs the AOB. The moment a firm wants to audit a listed corporation, a bond issuer, a licensed capital-market intermediary or a schedule fund, AOB registration becomes mandatory — it sits on top of, not instead of, the MIA and MOF requirements.

Who must register, and who is “recognised”?

The AOB draws a line between local and foreign auditors:

• Registration is for local audit firms and individual audit partners who audit PIEs or schedule funds.
• Recognition is for foreign auditors and foreign audit firms that audit the financial statements of foreign corporations listed on Bursa Malaysia. Recognition uses its own forms — Form 3 for individual auditors and Form 4 for audit firms — and a separate AOB Handbook for Recognition of Foreign Auditors.

Either way, the rule is the same: no person may prepare an audit report on a PIE or schedule fund’s financial information unless they hold the relevant AOB status.

What are the registration criteria?

The AOB tightened its criteria in 2018, and these are the conditions firms and partners must meet today.

Criterion	Requirement
Minimum partners	The audit firm must have at least three audit partners to be registered for PIE and schedule-fund audits
Engagement quality control review (EQCR)	Must be carried out by an AOB-registered partner of the same firm appointed as the auditor
Single-firm attachment	An applicant partner must be attached to only one audit firm, unless exempted
Continuing registration	The firm must have at least one PIE or schedule-fund audit client within the last 24 months

The three-partner floor and the EQCR-by-a-registered-partner rule came into effect on 16 August 2018, with existing registrants given until 1 January 2020 to comply. The EQCR condition has a particular effect on smaller firms: the second-partner review of a listed-company audit must be performed by another partner in the same firm who is themselves AOB-registered, rather than by an external reviewer or a non-partner.

The 24-month rule and annual obligations

Registration is not a permanent badge. Two mechanisms keep the register current.

The 24-month client rule. Continuing registration depends on the firm actually doing this work. Where an AOB-registered firm is not involved in the audit of any PIE or schedule fund for 24 consecutive months, it must withdraw its registration immediately. The register is intended to reflect firms that are genuinely active in the capital market.

Annual declaration and fee. Following amendments to Part IIIA that took effect on 15 September 2015, auditors no longer renew their registration. Instead, registered auditors submit an annual declaration as at 30 June each year, and pay a fee of RM5,000 per individual auditor by the anniversary of their respective registration dates. The detailed procedures live in the AOB Handbook for Registration (last revised 13 June 2024).

How big is the AOB’s remit?

The oversight covers a small population of auditors watching over a very large slice of the market. As at 31 December 2023, the AOB reported:

• 374 registered individual auditors and 13 recognised individual auditors
• 41 registered and recognised audit firms
• 1,256 PIEs audited, with combined market capitalisation of RM1,744 billion
• 1,399 schedule funds, with net asset value of RM696 billion

On the enforcement side in 2023, the AOB inspected 15 audit firms, 50 partners and 50 audit engagements, closed 22 referral cases, and reprimanded three audit partners — prohibiting them from accepting PIE audits — with a total of RM75,000 in monetary penalties imposed. Taken together, the reported market capitalisation and net asset value covered by the register come to roughly RM2.4 trillion in listed and fund assets, overseen by a concentrated group of firms whose audit quality the AOB polices.

What’s next

If you are a partner or firm moving into capital-market audits, start with the two AOB handbooks (Registration, and Recognition of Foreign Auditors) on the Securities Commission’s website, and check whether your firm clears the three-partner and in-house EQCR tests before pitching for a PIE engagement. Directors and audit committees appointing an auditor for a listed company should verify AOB registration alongside the MIA and s.263 checks — see Appointing an Auditor for a Malaysian Company for how those layers fit together, and Types of Audit Opinion for what the resulting report can say.