Anatomy of a Statutory Audit in Malaysia

Every audit firm in Malaysia publishes a page about why you need an audit. Almost none publishes what happens during one. That is not an oversight. A finance manager who understands the sequence can plan against it, push back on a request list, and stop paying for their own disorganisation.

Here is the whole engagement, in the order it runs, with the Malaysian statutory dates it has to fit inside.

The clock you are planning against

Three deadlines bound everything else, and they are consecutive rather than parallel.

Deadline	Rule	Source
First financial statements	Within 18 months of incorporation	s.248(1)(a)
Circulation to members	Within 6 months of the financial year end	s.258(1)(a)
Lodgement with the Registrar	Within 30 days of circulation	s.259(1)(a)
Appointment of the auditor	Board, at least 30 days before the end of the first lodgement period; thereafter members, during the 30 days before the lodgement period ends	s.267(3), s.267(6)

For a 31 December year end, that means members must have the audited statements by 30 June and SSM by 30 July. Every stage below has to be sequenced backwards from 30 June, not forwards from whenever the trial balance is finalised.

An extension is possible — a private company applies at least seven days before the last day of the circulation or lodgement period under Practice Note 3/2018 — but it is an application, not an entitlement, and it costs RM100.

Stage 1 — Acceptance and professional clearance

Nothing starts until the firm decides it can take the work.

Under ISQM 1 and ISA 220 (Revised), both applicable in Malaysia to engagements for periods beginning on or after 15 December 2022, the firm has to run acceptance and continuance as a documented process: client integrity, competence and capacity, independence, and the ability to comply with ethical requirements.

Two Malaysian layers sit on top:

Statutory independence. Section 264(1) of the Companies Act 2016 disqualifies anyone indebted to the company or a related corporation for more than RM25,000, anyone who is or whose spouse is an officer, partners and employees of officers, undischarged bankrupts, and anyone convicted of fraud or dishonesty punishable with three months imprisonment or more. Section 264(2) extends the officer test back twelve months.

Professional clearance. Under R320.4 MY of the MIA By-Laws, a member in public practice may not accept nomination for a financial statement audit without enquiring of the existing auditor whether there is any professional or other reason for the change. Appendix II to the By-Laws sets the timetable: reply normally within 14 working days, then a reminder by registered post, then a further 14 working days, then other enquiries.

Plan two to six weeks for a change of auditor. This is the stage that surprises companies switching firms in April for a December year end.

Finally, s.264(5) requires the auditor’s written consent before the appointment resolution, and s.269(1)(a) prevents the incoming auditor from taking office until the outgoing one has ceased to hold it.

Stage 2 — The engagement letter

ISA 210 governs the terms. The letter is not boilerplate; it is where the preconditions for an audit are established and the division of responsibility is fixed in writing.

Read three things before signing:

1. The description of management’s responsibilities — for preparing the financial statements to the applicable framework, for internal control, and for providing the auditor with access and information. This exact wording reappears in the representation letter at the end, because ISA 580 paragraph 12 requires the representations to describe the responsibilities the same way the engagement terms do.
2. The scope and what is excluded. Preparation of the financial statements, XBRL conversion and MBRS lodgement are frequently separate services.
3. The reporting framework — MFRS or MPERS. The choice drives the disclosure burden and therefore the fee.

For a recurring audit the firm may not reissue the letter every year, but it has to assess whether circumstances require it. A change in ownership, in the nature of the business, or in the reporting framework is a trigger.

Stage 3 — Planning and materiality

This is the stage clients never see and always underestimate.

The team obtains an understanding of the entity, its environment, and the components of internal control, and identifies risks of material misstatement at the financial statement level and at the assertion level. Materiality is set for the financial statements as a whole, along with performance materiality — a lower figure used to determine the nature, timing and extent of procedures — and a threshold below which misstatements are considered clearly trivial.

You will not usually be told the number. You will feel it: it determines the sample sizes and the scope of what gets tested.

Two planning outputs land on your desk:

• The PBC list — prepared by client. Every item on it is there to support a specific assertion, and the list should be negotiated at this point, not argued about in week three.
• The timetable — interim dates, stocktake dates, fieldwork dates, clearance meeting, target report date. Get the stocktake date on the calendar first, because it is the only one that cannot move.

Stage 4 — Interim visit and controls

Not every engagement has one. Where the auditor intends to rely on controls — over revenue, purchases, payroll or inventory movement — the testing has to happen while the controls are operating, and the interim visit is when.

Typical interim work: walkthroughs of the main transaction cycles, tests of controls over authorisation and segregation of duties, IT general controls covering access and change management, and early substantive testing of transactions for the first part of the year.

The commercial argument for an interim visit is that it moves hours out of the post-year-end crunch. The audit argument is that some evidence only exists while the process is running.

Stage 5 — Stocktake attendance

If inventory is material, the auditor attends the physical count. This is the single most time-critical event in the engagement, because it happens on the count date and cannot be recreated.

What attendance actually involves: evaluating the count instructions, observing their performance, inspecting the inventory, and performing test counts in both directions — from the count sheet to the floor, and from the floor to the count sheet. The auditor also records cut-off information, notes the last goods received and delivery note numbers, and looks for obsolete and damaged items.

What the company has to do: issue written count instructions, freeze movements or document them, have the count performed by people independent of the storekeeper, and pre-number the sheets.

Where attendance is impracticable, the auditor performs alternative procedures. If neither attendance nor alternatives can provide sufficient evidence, the result is a modified opinion — a qualification for inventory alone, because it is material but not pervasive.

A missed stocktake is the most common cause of a first-year qualification in Malaysia. A company that engages its auditor in March, for a 31 December year end, has already lost that evidence.

Stage 6 — Substantive fieldwork

The main block, usually one to two weeks on site for a small company, run cycle by cycle. Each test exists to address an assertion.

Cycle	Core procedures	Assertions addressed
Revenue and receivables	Cut-off testing either side of year end, invoice-to-shipment tracing, ageing review, credit notes after year end, expected credit loss assessment	Occurrence, cut-off, valuation
Purchases and payables	Search for unrecorded liabilities using post-year-end payments, supplier statement reconciliations, cut-off on goods received	Completeness, cut-off
Inventory	Costing tests, net realisable value, roll-forward from the count date, obsolescence	Existence, valuation
Fixed assets	Additions vouching, disposals, depreciation recomputation, impairment indicators, physical inspection	Existence, rights, valuation
Cash and borrowings	Bank reconciliations, confirmations, loan agreements, covenant compliance, interest recomputation	Existence, completeness, presentation
Payroll and provisions	Recomputation, EPF, SOCSO and PCB reconciliation to remittances, leave and bonus accruals	Accuracy, completeness
Related parties and director’s accounts	Identification of related parties, movement analysis, authorisation evidence, disclosure to MFRS 124	Completeness, presentation and disclosure
Equity and statutory records	Return of allotment, register of members, charges register, minutes	Rights, presentation

Section 266(4) gives the auditor a right of access at all reasonable times to the accounting and other records including registers, and entitles the auditor to require information and explanations from any officer. Section 266(12) makes it an offence for an officer to refuse access, hinder or delay the auditor, punishable by up to three years imprisonment or a fine up to RM500,000.

That provision almost never gets used. It exists so that nobody can argue about it.

Stage 7 — Bank and legal confirmations

These are sent by the auditor, returned to the auditor, and never touched by the company in between. That is the point of them.

Bank confirmations cover balances, facilities, charges, guarantees, security and signatories. Malaysian banks charge for them and take time. Two to four weeks is normal; the company’s role is limited to signing the authority for the bank to respond.

Solicitors’ confirmations cover litigation, claims and contingencies. They are the ones that get forgotten, and they matter most where a dispute is live.

Confirmations also commonly go to major customers and suppliers, and to related companies to agree intercompany balances.

Send them in week one of fieldwork. A file waiting on a bank confirmation in week six is a file that will miss its report date, and no amount of client effort can accelerate it.

Stage 8 — Subsequent events

The auditor performs procedures covering the period from the year end to the date of the auditor’s report: reading minutes of board and management meetings, reading the latest interim management accounts, enquiring about new borrowings, disposals, litigation and commitments.

Events that provide evidence of conditions existing at the reporting date are adjusted. Events indicating conditions that arose after are disclosed. Getting that distinction wrong is a frequent cause of a late adjustment.

Note the interaction with the Companies Act: paragraph 1(o) of the Fifth Schedule requires the directors’ report to deal with items of a material and unusual nature arising after year end.

Stage 9 — Going concern

Under ISA 570 (Revised), the auditor evaluates management’s assessment of the company’s ability to continue as a going concern, covering at least twelve months from the date of the financial statements, and must request management to extend the assessment if it covers less.

Where events or conditions are identified, the auditor evaluates the plans, tests the cash flow forecast underlying them, and asks for written representations about those plans. The outcome shapes the report: an unmodified opinion with a Material Uncertainty Related to Going Concern section where disclosure is adequate, a qualified or adverse opinion where it is not, and an adverse opinion where the going concern basis is inappropriate altogether.

If your company has net current liabilities, breached covenants or a funding gap, start the board’s assessment paper early. It is a document you have to produce, not one the auditor writes for you.

Stage 10 — The representation letter

ISA 580 requires written representations from management, on the company’s letterhead and addressed to the auditor.

Two are mandatory in every engagement: that management has fulfilled its responsibility for the preparation of the financial statements, and that it has provided the auditor with all relevant information and access as agreed, with all transactions recorded and reflected. Other ISAs add specific representations — going concern plans, related parties, litigation, fraud.

Two mechanics matter:

• Dating. Paragraph 14 requires the letter to be dated as near as practicable to, but not after, the date of the auditor’s report. It closes the file.
• Refusal. Paragraph 20 requires the auditor to disclaim an opinion if management will not provide the two mandatory representations, or if there is sufficient doubt about management’s integrity that they are not reliable.

Directors sign this letter without reading it more often than any other document in the process. It is evidence, and it is the document a court will look at first if something later turns out to have been withheld.

Stage 11 — The clearance meeting

The closing meeting is where the audit becomes a negotiation, and it is the meeting the finance manager should prepare for hardest.

On the table:

• Adjusted misstatements — errors already corrected in the draft.
• Unadjusted misstatements — the schedule of errors the auditor found and the company has chosen not to book, individually and in aggregate, with the effect on profit and net assets. Directors have to conclude, and record, that the uncorrected items are immaterial.
• Significant deficiencies in internal control, communicated in writing.
• Significant findings and difficulties, communicated to those charged with governance under ISA 260 (Revised) — for a typical Sdn Bhd, that is the same board that manages the company.
• The draft opinion, and whether anything modifies it.

Every ringgit adjusted here flows straight into the tax computation. That is the link the next stage depends on.

Stage 12 — Signing

The order is fixed and gets reversed all the time.

1. Directors approve the financial statements by board resolution, make the statement on whether they give a true and fair view, signed by at least two directors or the sole director, and a director or the person primarily responsible for financial management makes the statutory declaration — s.251.
2. The auditor dates the report. Under paragraph 48 of ISA 700 (Revised), no earlier than the date the auditor obtained sufficient appropriate evidence, including evidence that those with recognised authority have asserted responsibility for the financial statements.
3. The report is signed in the name of the firm and by the partner in his own name, with the firm number and the partner’s approval number printed beside them, as s.265(5) requires, and names the location where the auditor practises under paragraph 47 of ISA 700 (Revised).

A report dated before the directors’ approval is defective on its face.

Stage 13 — Circulation and lodgement

The audited financial statements, directors’ report, statement by directors and statutory declaration go to every member and every person entitled to notice of general meetings within six months of the financial year end under s.258, and are lodged with the Registrar within 30 days of circulation under s.259.

Lodgement is through MBRS in XBRL, prepared in mTool and submitted through mPortal. Audited financial statements came into MBRS 2.0 in Phase 3, from 1 June 2025. Build the XBRL tagging time into the 30 days — it is not instantaneous, and tagging errors bounce.

A worked timeline for a 31 December year end

Week	Stage
Nov (prior year)	Confirm appointment, agree timetable, fix the stocktake date
31 Dec	Attend the physical inventory count
Weeks 1–3 Jan	Close the books, complete reconciliations, prepare the PBC pack
Week 4 Jan	Auditor issues bank and solicitor confirmations
Feb, weeks 1–2	Substantive fieldwork on site
Feb, weeks 3–4	Open items cleared, confirmations received, group consolidation
Mar, week 1	Subsequent events, going concern assessment reviewed
Mar, week 2	Draft financial statements circulated, clearance meeting
Mar, week 3	Representation letter signed, directors approve, auditor signs
Mar–Apr	XBRL tagging and MBRS lodgement, well inside the 30 June and 30 July deadlines

Companies that start in April for a June circulation deadline are not doing this faster. They are doing it without an interim visit, without an attended stocktake, and with the confirmations still outstanding on the day the report is due.

What makes a Malaysian audit slip

• Confirmations sent late. Weeks, not days.
• Intercompany balances that do not agree, discovered at consolidation.
• Director’s account movements with no supporting authorisation, which are both an audit issue and a tax issue.
• Related parties identified late, forcing MFRS 124 disclosures into the final draft.
• No board paper on going concern where the numbers clearly require one.
• An unattended stocktake, which cannot be fixed at any price.
• Late instructions to the company secretary for the resolutions, statement by directors and statutory declaration.

Common mistakes

• Treating the audit as a post-year-end event. Half the evidence only exists during the year.
• Engaging a new auditor without allowing time for professional clearance.
• Assuming the auditor prepares the financial statements. Under s.244 and s.248 that duty sits with the directors; the auditor reports on them.
• Signing the representation letter unread, when refusal to give it triggers a disclaimer and a false statement in it is evidence against the signer.
• Dating the auditor’s report before the directors’ approval, contrary to paragraph 48 of ISA 700 (Revised).
• Leaving unadjusted misstatements undocumented. Directors have to conclude on them, and the schedule is the evidence they did.
• Forgetting the 30-day lodgement clock starts at circulation, not at signature.
• Budgeting nothing for XBRL conversion, then losing a fortnight to MBRS.

What’s next

The single highest-return preparation you can do is to work the request list before the auditor asks — organised by cycle, with the assertion each item is there to support.