# Auditor Independence and Partner Rotation Rules in Malaysia

> How the MIA By-Laws police auditor independence for Malaysian public interest entities — the seven-year time-on limit, role-specific cooling-off periods, the self-review ban on non-audit services, and what happens when a firm gets it wrong.

- Category: audit
- Language: en
- Status: published
- Updated: 2026-08-08
- Canonical: https://negaraku.md/en/audit/auditor-independence-rotation-rules

---

An audit partner who has signed the same listed company's accounts for a decade knows where every skeleton is buried — and that is exactly the problem. The longer the relationship, the harder it is for a reasonable outsider to believe the opinion is truly independent. Malaysia answers that risk with a hard clock and a mandatory break.

The rules live in the **MIA By-Laws (On Professional Ethics, Conduct and Practice)**, issued and maintained by the Institute's Ethics Standards Board and built on the international ethics code. Section 540 governs long association and partner rotation; Section 600 governs the services a firm may sell alongside the audit. Both bite hardest when the client is a public interest entity.

## Who counts as a public interest entity?

The rotation clock only runs at full speed for a **public interest entity (PIE)**. The By-Laws glossary defines a PIE as any of:

- a **publicly traded entity** — one that issues transferable financial instruments traded on a publicly accessible market, a listed company being the obvious example;
- an entity whose **main function is to take deposits** from the public (a bank);
- an entity whose **main function is to provide insurance** to the public; or
- any entity **specified as a PIE by law, regulation or professional standards**.

An ordinary private company is not a PIE. That single classification decides whether the fixed seven-year rule below applies, or only the softer "rotate when threats demand it" standard of paragraph R540.4.

MIA expanded this definition with effect from **15 December 2024**, aligning it with the latest IESBA code. The four categories above still frame the definition, but the revised text also asks firms to consider whether *other* entities should be treated as PIEs by weighing an entity's importance in its sector and the potential systemic impact of its financial failure. If you are classifying a borderline entity, check the current By-Laws edition rather than relying on the four categories alone.

## How long can one partner stay on the engagement?

For a PIE audit, paragraph **R540.5** sets a single ceiling. An individual may not act as the **engagement partner**, the **engagement quality reviewer (EQR)**, or **any other key audit partner** — or move between those roles — for more than **seven cumulative years**. That maximum is called the *time-on period*.

"Cumulative" matters. Under R540.6 the count does not reset just because a partner switches roles or takes a short break; the clock only restarts once the individual has been off the engagement for a full cooling-off period. So a partner who spends four years as engagement partner and then three years off may return for only three further years — seven in total — before a mandatory rotation.

There are narrow escape hatches. R540.7 allows **one additional year** in rare, unforeseen circumstances outside the firm's control (a serious illness derailing a planned handover, say) with the concurrence of those charged with governance. R540.8 sets transition maths for a client that *becomes* a PIE mid-relationship, and R540.9 recognises a regulator-granted exemption where a firm genuinely has too few qualified partners.

## How long is the cooling-off break?

Once the seven years are up, the individual must step away — but for how long depends on the seat they occupied.

| Key audit partner role | Time-on (max) | Cooling-off (min) | By-Law |
|---|---|---|---|
| Engagement partner | 7 cumulative years | 5 consecutive years | R540.11 |
| Engagement quality reviewer | 7 cumulative years | 3 consecutive years | R540.12 |
| Other key audit partner | 7 cumulative years | 2 consecutive years | R540.13 |

The engagement partner's five-year break is recent. Malaysia phased the regime in: a transitional provision (**R540.11 MY**) let the engagement partner cool off for **three years** instead of five for financial-statement periods **beginning before 15 December 2023**. For periods beginning on or after that date, the full **five-year** cooling-off applies. The Ethics Standards Board's own summary shows the journey — the older regime allowed just a five-year time-on and two-year cooling-off across the board:

| Period | Engagement partner | EQ reviewer | Other KAP |
|---|---|---|---|
| Previous regime (before 15 Dec 2018) | 5 on / 2 off | 5 on / 2 off | 5 on / 2 off |
| Transition (15 Dec 2018 – pre-15 Dec 2023) | 7 on / 3 off | 7 on / 3 off | 7 on / 2 off |
| Full provisions (from 15 Dec 2023) | 7 on / 5 off | 7 on / 3 off | 7 on / 2 off |

## What does "cooling off" actually forbid?

A break has to be a real break. Paragraph **R540.20** (amended 28 August 2023, effective 15 December 2023) says that for the duration of the cooling-off period the individual shall not:

- be an engagement team member or perform the engagement quality review for that audit;
- consult with the engagement team or the client on technical or industry-specific issues, transactions or events affecting the audit (bar limited hand-over discussions on their final year's work);
- lead or coordinate the firm's or a network firm's professional services to that client, or oversee the firm's relationship with it; or
- take any other role — including providing non-assurance services — that would give the individual significant or frequent interaction with senior management, or direct influence over the audit outcome.

The individual is not, however, barred from leading the firm itself; a rotated-off partner can still be the managing partner (paragraph 540.20 A1).

## Where does the line fall on non-audit work?

Independence is not only about time; it is also about what else the firm sells. For a PIE audit client, paragraph **R600.16** prohibits the firm — or a network firm — from providing **any non-assurance service that might create a self-review threat** to the financial statements it will audit. The By-Laws are blunt about why there is no workaround: paragraph 600.15 A2 states that where such a service creates a self-review threat, that threat *cannot* be eliminated and safeguards *cannot* reduce it to an acceptable level.

The narrow carve-out in R600.17 lets the firm offer **advice and recommendations** arising during the audit, provided it takes on **no management responsibility** and addresses any non-self-review threats through the conceptual framework. In practice, the firm can flag an issue and suggest options; it cannot make the client's decisions or build the thing it will later audit.

## What happens when a firm gets it wrong?

The rules have teeth. On **27 August 2024** the **Securities Commission Malaysia** announced enforcement action for a rotation breach: **Grant Thornton Malaysia PLT** was fined **RM150,000** and its audit partner **Mohamad Heizrin bin Sukiman** was fined **RM37,500**. The partner had audited a public interest entity from 2013 to 2017, was then required to serve a minimum cooling-off period of three consecutive years, and did not — leaving him involved for more than seven cumulative years, contrary to the MIA By-Laws and ISQM 1.

The lesson for audit committees is that rotation is not a box-ticking courtesy. It is a bright-line rule an external regulator will price in ringgit when it is missed.

## What's next

If you sit on the audit committee of a listed company, a bank or an insurer, treat partner rotation as a scheduled calendar item, not an afterthought: track each key audit partner's cumulative years, confirm the correct cooling-off length for their role, and satisfy yourself that non-audit engagements are not quietly manufacturing a self-review threat.

For the surrounding mechanics, see how the appointment itself works in [appointing an auditor](appointing-an-auditor), what to do when a rotation triggers a switch in [changing auditors](changing-auditors), and where independence fits inside the wider [statutory audit process](statutory-audit-process). The figures above should always be checked against the current MIA By-Laws before you rely on them for a specific engagement, since the Institute updates the text as the international code evolves.

## Sources

- By-Laws (On Professional Ethics, Conduct and Practice) of the Malaysian Institute of Accountants — Section 540 and Section 600 — https://mia.org.my/wp-content/uploads/2024/04/MIA-By-Laws-2024-UPDATED.pdf (Malaysian Institute of Accountants)
- Audit Firm and Audit Partner Fined for Breach of Partner Rotation Requirement — https://www.sc.com.my/resources/media/media-release/audit-firm-and-audit-partner-fined-for-breach-of-partner-rotation-requirement (Securities Commission Malaysia)
- Ethics Standards Board Annual Report 2018 — Changes in Audit Partner Rotation Requirements — https://mia.org.my/wp-content/uploads/2022/04/MIA_ESB_Annual_Report_2018.pdf (Malaysian Institute of Accountants)
- MIA Enhances its Professional Ethics Standards on Public Interest Entities, Effective 15 December 2024 — https://mia.org.my/mia-enhances-its-professional-ethics-standards-on-public-interest-entities-effective-15-december-2024/ (Malaysian Institute of Accountants)

---
Source of truth: https://github.com/negaraku-md/NegaraKu.md
License: CC BY-SA 4.0