Home / Doing Business in Malaysia / Audit & Assurance / Requirements & exemption

🧭 Practical ✓ Published: 22 Jul 2026 3 min read Next review 22 Jul 2027

Companies That Can Never Claim Audit Exemption in Malaysia

The four categories of company excluded from audit exemption under SSM Practice Directive 10/2024, and the exclusions that secondary sources routinely get wrong.

30-second answer Reviewed 22 Jul 2026

Four categories are excluded from audit exemption under Practice Directive 10/2024: an exempt private company that has opted to lodge a section 260 certificate with the Registrar, a public company including a listed company, a private company that is a subsidiary of a public company, and a foreign company. Size is irrelevant for these four. Having corporate shareholders is not an exclusion.

On this page
Full explanation ≈3 min

Passing the thresholds is not the last gate. Paragraph 12 of Practice Directive 10/2024 shuts four categories of company out of audit exemption entirely — a dormant, zero-revenue company in any of them still appoints an auditor.

Secondary sources garble this list more often than any other part of the directive. Two errors recur: describing the exclusion as subsidiaries of listed companies (it is public companies, a much wider class), and describing exempt private companies as excluded outright (only those that lodge the section 260 certificate are).

The four excluded categories

1. An exempt private company that has opted to lodge a section 260 certificate. Under s.260 of the Companies Act 2016, an EPC may lodge a certificate as to its EPC status with the Registrar in lieu of lodging financial statements. That certificate must be signed by a director, an auditor and the secretary, and must confirm that duly audited financial statements were circulated to members. An audit is structurally built into it. So the exclusion is not about being an EPC — it is about the lodgement route you choose. SSM confirms in its FAQ that an EPC is eligible for audit exemption provided it satisfies the criteria and lodges unaudited financial statements instead of the certificate. Being an EPC therefore forces a choice, not a disqualification.

2. A public company, including a listed company. This follows from where the exemption power sits. Section 267(1) requires a private company to appoint an auditor and s.267(2) lets the Registrar exempt private companies from that duty. Public company auditors are appointed under s.271, which the directive does not touch.

3. A private company that is a subsidiary of a public company. Note the word: public, not listed. Every listed company is a public company, but a great many public companies are not listed — including public companies limited by guarantee and unlisted Berhads. A small Sdn Bhd held by an unlisted Berhad is excluded. A Sdn Bhd held by another Sdn Bhd is not.

4. A foreign company. A company incorporated outside Malaysia and registered here under Division 2 of Part IV cannot use the exemption.

What is not an exclusion

  • Corporate shareholders. SSM addresses this directly: a private company with corporate shareholders that fulfils the criteria can enjoy the exemption. Only a public company parent triggers the bar.
  • Having a foreign shareholder or foreign directors. The exclusion is for foreign companies registered in Malaysia, not locally incorporated companies with foreign owners.
  • Being a holding company. Nothing in paragraph 12 excludes a company for having subsidiaries, though consolidated figures and the assets test usually end the argument on the numbers.
  • Being an EPC. See above.

Two things that override eligibility

Even a company outside all four categories can be pulled back into audit.

Under paragraph 14, a qualifying company must audit its accounts if it receives written notice during the financial year, but no later than one month before the end of that year, from members holding at least 5% of the issued shares or of any class of them, from at least 5% of the members eligible to vote, or from the Registrar directing an audit.

And under paragraph 13, a company that ceases to qualify ceases to be exempt from that point, though it stays exempt for the financial years in which it did qualify.

Common mistakes

  • Reading the subsidiary exclusion as listed. It is any public company parent, listed or not.
  • Treating all exempt private companies as excluded. Only those lodging the s.260 certificate are.
  • Confusing exclusion with failing the test. A company that misses the two-of-three threshold is not excluded — it simply does not qualify this year and may qualify later.
  • Assuming a foreign shareholder disqualifies you. It does not.
  • Forgetting the 5% notice window closes one month before the financial year end, not at year end.

What’s next

If the company is not excluded but is trading at nil, the dormancy route is a separate and simpler basis for exemption — with its own two-year test that is shorter than the threshold one.

Sources & history 3 sources
More in Requirements & exemption View all 5 →
Related knowledge