# Why Auditors Scrutinise Related Party Transactions

> A sale to a director's own company can be perfectly ordinary — or the vehicle for a fraud. ISA 550 tells the auditor how to tell the two apart, and MFRS 124 plus Bursa Chapter 10 decide what must be disclosed and approved.

- Category: audit
- Language: en
- Status: published
- Updated: 2026-08-08
- Canonical: https://negaraku.md/en/audit/related-party-transactions-audit-focus

---

A company sells crude palm oil to another company owned by its own major shareholder. Nothing on the invoice says whether that is an ordinary supply arrangement or the first step in draining value out of minority shareholders. The auditor's job is to find out which — and that is exactly what International Standard on Auditing 550, *Related Parties*, is written for.

## What counts as a related party in the first place?

ISA 550 paragraph 10 points to the definition in the applicable financial reporting framework, which in Malaysia is MFRS 124 *Related Party Disclosures* — the local equivalent of IAS 24, effective for annual periods beginning on or after 1 January 2012. Broadly, a related party is one that controls, is controlled by, or is under common control with the entity, together with key management personnel and their close family members.

The same paragraph defines the benchmark the whole exercise turns on. An **arm's length transaction** is one conducted "as between a willing buyer and a willing seller who are unrelated and are acting independently of each other and pursuing their own best interests." The worry with a related party is precisely that this independence may be missing.

## Why single these transactions out?

Because they are the classic machinery of financial statement fraud. ISA 550 paragraph 2 is candid that many related party transactions are ordinary and no riskier than dealings with strangers. But the standard also warns that related party transactions may not be conducted under normal market terms, and that the relationships can present a greater opportunity for collusion, concealment or manipulation.

That is why paragraph 18 draws a bright line: the auditor **must treat identified significant related party transactions outside the entity's normal course of business as giving rise to significant risks** — the highest tier of audit attention, requiring a specific response.

## What does the auditor actually do?

ISA 550 sets out a ladder from routine inquiry to targeted testing. The table maps the main requirements.

| Stage | What ISA 550 requires | Reference |
| --- | --- | --- |
| Inquiry | Ask management for the identity of related parties, the nature of the relationships, and whether transactions occurred | Para 13 |
| Understand controls | Understand how the entity identifies, authorises and approves related party transactions | Para 14 |
| Stay alert | While inspecting records, watch for undisclosed relationships — bank and legal confirmations, board and shareholder minutes | Para 15 |
| Assess risk | Treat significant transactions outside the normal course of business as significant risks | Para 18 |
| Test the outliers | Inspect underlying contracts, evaluate business rationale for fraud, and obtain evidence of authorisation and approval | Para 23 |
| Challenge assertions | Where management claims a transaction was at arm's length, obtain sufficient appropriate evidence for that claim | Para 24 |
| Get it in writing | Obtain written representations that all related parties and transactions have been disclosed and properly accounted for | Para 26 |
| Report up | Communicate significant related party matters to those charged with governance | Para 27 |

The pivotal step is paragraph 23. For a significant transaction outside the ordinary course of business, the auditor inspects the contract, asks whether the business rationale — or lack of one — points to fraudulent financial reporting or concealed misappropriation of assets, checks that the terms match management's story, and confirms the transaction was properly authorised.

## Where does Bursa Malaysia add another layer?

Financial reporting and auditing are only two of three layers for a listed issuer. The third is corporate governance under the Bursa Malaysia Main Market Listing Requirements.

| Layer | Instrument | What it governs |
| --- | --- | --- |
| Disclosure | MFRS 124 | What the financial statements must reveal about related parties and their transactions |
| Audit | ISA 550 | How the auditor identifies, assesses and responds to the risk of misstatement |
| Governance | Bursa Chapter 10 | When a listed issuer must announce, circularise or seek shareholder approval, with interested parties abstaining |

Under Chapter 10, recurrent related party transactions of a revenue or trading nature are typically run through a **shareholders' mandate** renewed at each annual general meeting, as paragraph 10.09 contemplates. A one-off related party transaction can, depending on its size measured by the percentage ratios in paragraph 10.02, require an immediate announcement, a circular to shareholders, and prior approval in general meeting — with the interested director or major shareholder barred from voting.

## What should an investor look for in the notes?

Read the related party note against this checklist. Are the pricing terms stated, and do they claim to be at arm's length — if so, on what basis? Are recurrent transactions covered by a current shareholders' mandate? Did any transaction sit outside the ordinary course of business, and was it independently approved? Silence, vague "market terms" language, or a large balance owed by a director-linked entity are the signals ISA 550 is designed to surface.

## What's next

If a related party transaction looks material to your decision, trace it through all three layers: the MFRS 124 disclosure note, any Chapter 10 announcement or circular on the Bursa Malaysia website, and the audit opinion itself. To see how these dealings feed into the wider audit, read the statutory audit process and how the auditor forms an opinion; where a related party propped up a struggling business, going concern is the connected risk to check next.

## Sources

- International Standard on Auditing 550, Related Parties (2013 IAASB Handbook) — https://www.ifac.org/_flysystem/azure-private/publications/files/A029%202013%20IAASB%20Handbook%20ISA%20550.pdf (International Auditing and Assurance Standards Board (IAASB) / IFAC)
- MFRS 124 Related Party Disclosures (MFRS Framework listing; issued 19 Nov 2011, effective 1 Jan 2012) — https://www.masb.org.my/pages.php?id=89 (Malaysian Accounting Standards Board (MASB))
- Main Market Listing Requirements, Chapter 10 (Transactions) — Related Party Transactions — https://www.bursamalaysia.com/sites/5bb54be15f36ca0af339077a/content_entry5ce3b50239fba2627b2864be/5ce3b5c439fba264f32eb401/files/MAIN_Chap10_RPT_31Oct2025_.pdf (Bursa Malaysia Securities Berhad)

---
Source of truth: https://github.com/negaraku-md/NegaraKu.md
License: CC BY-SA 4.0