# Anatomy of a Statutory Audit in Malaysia

> What actually happens in a Malaysian statutory audit, from acceptance and professional clearance through planning, stocktake attendance, fieldwork, confirmations, the representation letter and the clearance meeting to the signed report and MBRS lodgement.

- Category: audit
- Language: en
- Status: published
- Updated: 2026-07-20
- Canonical: https://negaraku.md/en/audit/statutory-audit-process

---

Every audit firm in Malaysia publishes a page about why you need an audit. Almost
none publishes what happens during one. That is not an oversight. A finance
manager who understands the sequence can plan against it, push back on a request
list, and stop paying for their own disorganisation.

Here is the whole engagement, in the order it runs, with the Malaysian statutory
dates it has to fit inside.

## The clock you are planning against

Three deadlines bound everything else, and they are consecutive rather than
parallel.

| Deadline | Rule | Source |
| --- | --- | --- |
| First financial statements | Within **18 months** of incorporation | s.248(1)(a) |
| Circulation to members | Within **6 months** of the financial year end | s.258(1)(a) |
| Lodgement with the Registrar | Within **30 days** of circulation | s.259(1)(a) |
| Appointment of the auditor | Board, at least 30 days before the end of the first lodgement period; thereafter members, during the 30 days before the lodgement period ends | s.267(3), s.267(6) |

For a 31 December year end, that means members must have the audited statements by
30 June and SSM by 30 July. Every stage below has to be sequenced backwards from
30 June, not forwards from whenever the trial balance is finalised.

An extension is possible — a private company applies at least **seven days** before
the last day of the circulation or lodgement period under Practice Note 3/2018 —
but it is an application, not an entitlement, and it costs RM100.

## Stage 1 — Acceptance and professional clearance

Nothing starts until the firm decides it can take the work.

Under ISQM 1 and ISA 220 (Revised), both applicable in Malaysia to engagements for
periods beginning on or after 15 December 2022, the firm has to run acceptance and
continuance as a documented process: client integrity, competence and capacity,
independence, and the ability to comply with ethical requirements.

Two Malaysian layers sit on top:

**Statutory independence.** Section 264(1) of the Companies Act 2016 disqualifies
anyone indebted to the company or a related corporation for more than RM25,000,
anyone who is or whose spouse is an officer, partners and employees of officers,
undischarged bankrupts, and anyone convicted of fraud or dishonesty punishable
with three months imprisonment or more. Section 264(2) extends the officer test
back **twelve months**.

**Professional clearance.** Under R320.4 MY of the MIA By-Laws, a member in public
practice may not accept nomination for a financial statement audit without
enquiring of the existing auditor whether there is any professional or other reason
for the change. Appendix II to the By-Laws sets the timetable: reply normally
within **14 working days**, then a reminder by registered post, then a further 14
working days, then other enquiries.

**Plan two to six weeks for a change of auditor.** This is the stage that surprises
companies switching firms in April for a December year end.

Finally, s.264(5) requires the auditor's **written consent before the appointment**
resolution, and s.269(1)(a) prevents the incoming auditor from taking office until
the outgoing one has ceased to hold it.

## Stage 2 — The engagement letter

ISA 210 governs the terms. The letter is not boilerplate; it is where the
preconditions for an audit are established and the division of responsibility is
fixed in writing.

Read three things before signing:

1. **The description of management's responsibilities** — for preparing the
   financial statements to the applicable framework, for internal control, and for
   providing the auditor with access and information. This exact wording reappears
   in the representation letter at the end, because ISA 580 paragraph 12 requires
   the representations to describe the responsibilities the same way the engagement
   terms do.
2. **The scope and what is excluded.** Preparation of the financial statements,
   XBRL conversion and MBRS lodgement are frequently separate services.
3. **The reporting framework** — MFRS or MPERS. The choice drives the disclosure
   burden and therefore the fee.

For a recurring audit the firm may not reissue the letter every year, but it has to
assess whether circumstances require it. A change in ownership, in the nature of the
business, or in the reporting framework is a trigger.

## Stage 3 — Planning and materiality

This is the stage clients never see and always underestimate.

The team obtains an understanding of the entity, its environment, and the
components of internal control, and identifies risks of material misstatement at
the financial statement level and at the assertion level. Materiality is set for
the financial statements as a whole, along with performance materiality — a lower
figure used to determine the nature, timing and extent of procedures — and a
threshold below which misstatements are considered clearly trivial.

You will not usually be told the number. You will feel it: it determines the sample
sizes and the scope of what gets tested.

Two planning outputs land on your desk:

- **The PBC list** — prepared by client. Every item on it is there to support a
  specific assertion, and the list should be negotiated at this point, not
  argued about in week three.
- **The timetable** — interim dates, stocktake dates, fieldwork dates, clearance
  meeting, target report date. Get the stocktake date on the calendar first,
  because it is the only one that cannot move.

## Stage 4 — Interim visit and controls

Not every engagement has one. Where the auditor intends to rely on controls — over
revenue, purchases, payroll or inventory movement — the testing has to happen while
the controls are operating, and the interim visit is when.

Typical interim work: walkthroughs of the main transaction cycles, tests of
controls over authorisation and segregation of duties, IT general controls covering
access and change management, and early substantive testing of transactions for the
first part of the year.

The commercial argument for an interim visit is that it moves hours out of the
post-year-end crunch. The audit argument is that some evidence only exists while the
process is running.

## Stage 5 — Stocktake attendance

If inventory is material, the auditor attends the physical count. This is the
single most time-critical event in the engagement, because it happens **on the
count date and cannot be recreated**.

What attendance actually involves: evaluating the count instructions, observing
their performance, inspecting the inventory, and performing test counts in both
directions — from the count sheet to the floor, and from the floor to the count
sheet. The auditor also records cut-off information, notes the last goods received
and delivery note numbers, and looks for obsolete and damaged items.

What the company has to do: issue written count instructions, freeze movements or
document them, have the count performed by people independent of the storekeeper,
and pre-number the sheets.

Where attendance is impracticable, the auditor performs alternative procedures. If
neither attendance nor alternatives can provide sufficient evidence, the result is
a modified opinion — a qualification for inventory alone, because it is material
but not pervasive.

**A missed stocktake is the most common cause of a first-year qualification in
Malaysia.** A company that engages its auditor in March, for a 31 December year
end, has already lost that evidence.

## Stage 6 — Substantive fieldwork

The main block, usually one to two weeks on site for a small company, run cycle by
cycle. Each test exists to address an assertion.

| Cycle | Core procedures | Assertions addressed |
| --- | --- | --- |
| Revenue and receivables | Cut-off testing either side of year end, invoice-to-shipment tracing, ageing review, credit notes after year end, expected credit loss assessment | Occurrence, cut-off, valuation |
| Purchases and payables | Search for unrecorded liabilities using post-year-end payments, supplier statement reconciliations, cut-off on goods received | Completeness, cut-off |
| Inventory | Costing tests, net realisable value, roll-forward from the count date, obsolescence | Existence, valuation |
| Fixed assets | Additions vouching, disposals, depreciation recomputation, impairment indicators, physical inspection | Existence, rights, valuation |
| Cash and borrowings | Bank reconciliations, confirmations, loan agreements, covenant compliance, interest recomputation | Existence, completeness, presentation |
| Payroll and provisions | Recomputation, EPF, SOCSO and PCB reconciliation to remittances, leave and bonus accruals | Accuracy, completeness |
| Related parties and director's accounts | Identification of related parties, movement analysis, authorisation evidence, disclosure to MFRS 124 | Completeness, presentation and disclosure |
| Equity and statutory records | Return of allotment, register of members, charges register, minutes | Rights, presentation |

Section 266(4) gives the auditor a right of access at all reasonable times to the
accounting and other records including registers, and entitles the auditor to
require information and explanations from any officer. Section 266(12) makes it an
offence for an officer to refuse access, hinder or delay the auditor, punishable by
up to **three years imprisonment or a fine up to RM500,000**.

That provision almost never gets used. It exists so that nobody can argue about it.

## Stage 7 — Bank and legal confirmations

These are sent by the auditor, returned to the auditor, and never touched by the
company in between. That is the point of them.

**Bank confirmations** cover balances, facilities, charges, guarantees, security
and signatories. Malaysian banks charge for them and take time. Two to four weeks
is normal; the company's role is limited to signing the authority for the bank to
respond.

**Solicitors' confirmations** cover litigation, claims and contingencies. They are
the ones that get forgotten, and they matter most where a dispute is live.

Confirmations also commonly go to major customers and suppliers, and to related
companies to agree intercompany balances.

**Send them in week one of fieldwork.** A file waiting on a bank confirmation in
week six is a file that will miss its report date, and no amount of client effort
can accelerate it.

## Stage 8 — Subsequent events

The auditor performs procedures covering the period from the year end to the date
of the auditor's report: reading minutes of board and management meetings, reading
the latest interim management accounts, enquiring about new borrowings, disposals,
litigation and commitments.

Events that provide evidence of conditions existing at the reporting date are
adjusted. Events indicating conditions that arose after are disclosed. Getting that
distinction wrong is a frequent cause of a late adjustment.

Note the interaction with the Companies Act: paragraph 1(o) of the Fifth Schedule
requires the directors' report to deal with items of a material and unusual nature
arising after year end.

## Stage 9 — Going concern

Under ISA 570 (Revised), the auditor evaluates management's assessment of the
company's ability to continue as a going concern, covering **at least twelve months
from the date of the financial statements**, and must request management to extend
the assessment if it covers less.

Where events or conditions are identified, the auditor evaluates the plans, tests
the cash flow forecast underlying them, and asks for written representations about
those plans. The outcome shapes the report: an unmodified opinion with a **Material
Uncertainty Related to Going Concern** section where disclosure is adequate, a
qualified or adverse opinion where it is not, and an adverse opinion where the
going concern basis is inappropriate altogether.

If your company has net current liabilities, breached covenants or a funding gap,
start the board's assessment paper early. It is a document you have to produce, not
one the auditor writes for you.

## Stage 10 — The representation letter

ISA 580 requires written representations from management, on the company's
letterhead and addressed to the auditor.

Two are mandatory in every engagement: that management has fulfilled its
responsibility for the preparation of the financial statements, and that it has
provided the auditor with all relevant information and access as agreed, with all
transactions recorded and reflected. Other ISAs add specific representations —
going concern plans, related parties, litigation, fraud.

Two mechanics matter:

- **Dating.** Paragraph 14 requires the letter to be dated as near as practicable
  to, but **not after**, the date of the auditor's report. It closes the file.
- **Refusal.** Paragraph 20 requires the auditor to **disclaim an opinion** if
  management will not provide the two mandatory representations, or if there is
  sufficient doubt about management's integrity that they are not reliable.

Directors sign this letter without reading it more often than any other document in
the process. It is evidence, and it is the document a court will look at first if
something later turns out to have been withheld.

## Stage 11 — The clearance meeting

The closing meeting is where the audit becomes a negotiation, and it is the meeting
the finance manager should prepare for hardest.

On the table:

- **Adjusted misstatements** — errors already corrected in the draft.
- **Unadjusted misstatements** — the schedule of errors the auditor found and the
  company has chosen not to book, individually and in aggregate, with the effect on
  profit and net assets. Directors have to conclude, and record, that the
  uncorrected items are immaterial.
- **Significant deficiencies in internal control**, communicated in writing.
- **Significant findings and difficulties**, communicated to those charged with
  governance under ISA 260 (Revised) — for a typical Sdn Bhd, that is the same
  board that manages the company.
- The **draft opinion**, and whether anything modifies it.

Every ringgit adjusted here flows straight into the tax computation. That is the
link the next stage depends on.

## Stage 12 — Signing

The order is fixed and gets reversed all the time.

1. **Directors approve the financial statements** by board resolution, make the
   statement on whether they give a true and fair view, signed by at least two
   directors or the sole director, and a director or the person primarily
   responsible for financial management makes the statutory declaration — s.251.
2. **The auditor dates the report.** Under paragraph 48 of ISA 700 (Revised), no
   earlier than the date the auditor obtained sufficient appropriate evidence,
   including evidence that those with recognised authority have asserted
   responsibility for the financial statements.
3. The report is signed in the name of the firm **and** by the partner in his own
   name, with the firm number and the partner's approval number printed beside
   them, as s.265(5) requires, and names the location where the auditor practises
   under paragraph 47 of ISA 700 (Revised).

A report dated before the directors' approval is defective on its face.

## Stage 13 — Circulation and lodgement

The audited financial statements, directors' report, statement by directors and
statutory declaration go to every member and every person entitled to notice of
general meetings within **six months of the financial year end** under s.258, and
are lodged with the Registrar within **30 days of circulation** under s.259.

Lodgement is through **MBRS** in XBRL, prepared in mTool and submitted through
mPortal. Audited financial statements came into MBRS 2.0 in Phase 3, from 1 June
2025. Build the XBRL tagging time into the 30 days — it is not instantaneous, and
tagging errors bounce.

## A worked timeline for a 31 December year end

| Week | Stage |
| --- | --- |
| Nov (prior year) | Confirm appointment, agree timetable, fix the stocktake date |
| 31 Dec | Attend the physical inventory count |
| Weeks 1–3 Jan | Close the books, complete reconciliations, prepare the PBC pack |
| Week 4 Jan | Auditor issues bank and solicitor confirmations |
| Feb, weeks 1–2 | Substantive fieldwork on site |
| Feb, weeks 3–4 | Open items cleared, confirmations received, group consolidation |
| Mar, week 1 | Subsequent events, going concern assessment reviewed |
| Mar, week 2 | Draft financial statements circulated, clearance meeting |
| Mar, week 3 | Representation letter signed, directors approve, auditor signs |
| Mar–Apr | XBRL tagging and MBRS lodgement, well inside the 30 June and 30 July deadlines |

Companies that start in April for a June circulation deadline are not doing this
faster. They are doing it without an interim visit, without an attended stocktake,
and with the confirmations still outstanding on the day the report is due.

## What makes a Malaysian audit slip

- **Confirmations sent late.** Weeks, not days.
- **Intercompany balances that do not agree**, discovered at consolidation.
- **Director's account movements with no supporting authorisation**, which are both
  an audit issue and a tax issue.
- **Related parties identified late**, forcing MFRS 124 disclosures into the final
  draft.
- **No board paper on going concern** where the numbers clearly require one.
- **An unattended stocktake**, which cannot be fixed at any price.
- **Late instructions to the company secretary** for the resolutions, statement by
  directors and statutory declaration.

## Common mistakes

- **Treating the audit as a post-year-end event.** Half the evidence only exists
  during the year.
- **Engaging a new auditor without allowing time for professional clearance.**
- **Assuming the auditor prepares the financial statements.** Under s.244 and
  s.248 that duty sits with the directors; the auditor reports on them.
- **Signing the representation letter unread**, when refusal to give it triggers a
  disclaimer and a false statement in it is evidence against the signer.
- **Dating the auditor's report before the directors' approval**, contrary to
  paragraph 48 of ISA 700 (Revised).
- **Leaving unadjusted misstatements undocumented.** Directors have to conclude on
  them, and the schedule is the evidence they did.
- **Forgetting the 30-day lodgement clock** starts at circulation, not at signature.
- **Budgeting nothing for XBRL conversion**, then losing a fortnight to MBRS.

## What's next

The single highest-return preparation you can do is to work the request list before
the auditor asks — organised by cycle, with the assertion each item is there to
support.

## Sources

- Companies Act 2016 (Act 777), reprint as at 1 August 2022 — https://www.ssm.com.my/Pages/Legal_Framework/Document/Companies%20Act%202016_Akta%20777_BI%20(1.8.2022).pdf (SSM)
- ISA 700 (Revised), Forming an Opinion and Reporting on Financial Statements — https://mia.org.my/wp-content/uploads/2022/04/MIA_ISA_700_Revised-2.pdf (MIA)
- ISA 580, Written Representations — https://mia.org.my/box/2022/04/ISA_580.pdf (MIA)
- ISA 570 (Revised), Going Concern — https://mia.org.my/box/2022/04/ISA_570_Revised.pdf (MIA)
- AAPG 1 — Auditors report on financial statements prepared in accordance with the MFRS framework and Companies Act 2016 — https://mia.org.my/wp-content/uploads/2022/06/MIA_Audit_and_Assurance_Practice_Guide_AAPG_1-1.pdf (MIA)
- By-Laws (On Professional Ethics, Conduct and Practice) of the Malaysian Institute of Accountants, updated 5 November 2024 — https://mia.org.my/wp-content/uploads/2024/11/By-Laws-updated-Nov-2024-%E2%80%93-Effective-15-December-2024.pdf (MIA)
- Malaysian Business Reporting System (MBRS) — https://www.ssm.com.my/Pages/Services/Other-Services/MBRS.aspx (SSM)

---
Source of truth: https://github.com/negaraku-md/NegaraKu.md
License: CC BY-SA 4.0