# The Audit Committee: What Malaysian Public Companies Actually Have to Do

> Who must have an audit committee in Malaysia, how it must be composed under the Bursa Listing Requirements, what it actually does, and how it deals with the external auditor.

- Category: company-secretary
- Language: en
- Status: published
- Updated: 2026-07-21
- Canonical: https://negaraku.md/en/company-secretary/audit-committee-public-companies

---

Ask most Malaysian directors where the audit committee requirement comes from and you will
be told the Companies Act. It does not. **The phrase "audit committee" appears nowhere in
the Companies Act 2016** — not once across 620 sections — and the Companies (Amendment)
Act 2024 did not add it.

That is not a drafting oversight. It is a deliberate relocation, and knowing where the duty
actually sits changes who is bound by it and who enforces it.

## Where the requirement actually comes from

Under the **Companies Act 1965, s.15A**, every company with quoted shares had to have an
audit committee. Section 620 of the Companies Act 2016 repealed the 1965 Act, and the 2016
Act provided no successor provision. The obligation migrated wholesale into the
**Bursa Malaysia Listing Requirements, Chapter 15**.

Three consequences follow, and each of them is regularly got wrong.

**The duty binds listed issuers only.** Chapter 15 speaks to a "listed issuer" on the Main
Market and a "listed corporation" on the ACE Market. **An unlisted public company — an
ordinary Berhad that has never listed — has no general legal obligation to constitute an
audit committee**, and neither does a Sdn Bhd. Sector regulators are the exception: a
licensed financial institution answers to Bank Negara's own governance requirements, which
are not covered here.

**The enforcer is Bursa, not SSM.** A composition failure is a listing-requirement breach.
The Registrar has no jurisdiction over it, because there is nothing in the Act to breach.

**Failure is not a criminal offence under the Act.** It attracts Bursa's regulatory
sanctions instead — a materially different exposure from, say, failing to appoint a company
secretary within 30 days under s.236.

## Who can sit on the committee?

Rule 15.09(1) sets four composition tests, and all must hold simultaneously.

| Test | Requirement |
| --- | --- |
| Size | Not fewer than **3 members** |
| Executive status | **All** members must be non-executive directors |
| Independence | A **majority** must be independent directors |
| Financial literacy | At least one member must satisfy the qualification limbs below |

The financial-literacy limb (rule 15.09(1)(c)) is more specific than the shorthand
"financially literate" suggests. At least one member must be either:

- a **member of the Malaysian Institute of Accountants**; or
- if not an MIA member, someone with **at least 3 years' working experience** who has either
  passed the examinations specified in **Part I of the First Schedule of the Accountants
  Act 1967**, or is a member of one of the associations of accountants specified in
  **Part II of that First Schedule**; or
- someone who fulfils such other requirements as prescribed or approved by the Exchange.

Rule 15.09(2) then bars something people try: **no alternate director may be appointed a
member of the audit committee.** You cannot solve a member's travel schedule with a stand-in.

**The chairman is elected, not appointed by the board.** Rule 15.10 requires the members to
elect a chairman from among themselves who is an independent director. The board does not
choose for them.

The **Malaysian Code on Corporate Governance (as at 28 April 2021)** layers apply-or-explain
practices on top. Practice 9.1: the chairman of the audit committee is not the chairman of
the board. Practice 1.4, new in the 2021 edition: the board chairman should not be a member
of the audit, nomination or remuneration committee at all. Step Up 9.4 invites the committee
to comprise solely independent directors. Practice 9.5 asks that all members be financially
literate and undertake continuous professional development.

> **The cooling-off rule is MCCG, not Bursa.** Practice 9.2 asks the committee to adopt a
> policy requiring a **former partner of the external audit firm to observe a cooling-off
> period of at least three years** before appointment. The 2021 update widened it from *key
> audit partner* to **any former partner** of the firm or an affiliate firm, including
> partners who only provided advisory or tax services. Guides written against the 2017
> edition still say "key audit partner" — that is the superseded wording.

## What happens when the composition breaks?

Directors resign, become executive, or lose independence through tenure. Two rules govern
the aftermath, and they are different rules doing different jobs.

**Rule 15.19 — the cure period.** Where the composition no longer complies, the vacancy or
shortfall must be filled **within three months**.

**Rule 15.18 — the quorum.** The **majority of members present** at any meeting must be
independent directors. This is a meeting-by-meeting test, not a standing-composition test.
A committee that is properly composed on paper can still hold an inquorate meeting because
the wrong two people turned up, and decisions taken there are exposed.

Rule 15.13 controls attendance from outside: other directors and employees attend **only at
the audit committee's invitation, specific to the relevant meeting**. A standing invitation
to the CFO is not what the rule contemplates.

## What does the committee actually do?

Rule 15.12 lists the functions. In practice they cluster into four jobs.

**Review the external audit.** The committee reviews with the external auditor the audit
plan, the auditor's evaluation of the system of internal controls, and the audit report.

**Review the numbers before the board sees them.** Quarterly results and the year-end
financial statements go to the audit committee **before** board approval — the committee is
upstream of the board, not a reviewer of what the board has already passed.

**Police conflicts.** Related party transactions and conflict-of-interest situations are
squarely the committee's work, and rule 15.15 requires the annual report to carry a summary
of the conflict situations reviewed.

**Own the auditor relationship.** The committee reviews the external auditor's letter of
resignation, forms a view on whether there is reason to believe the auditor is unsuitable
for re-appointment, and recommends the nomination of external auditors.

Rule 15.15 also fixes what the **Audit Committee Report** in the annual report must disclose:
composition with each member's designation and independence, the number of meetings and each
member's attendance, a summary of the committee's work, and a summary of the internal audit
work done.

And **rule 15.27** requires the listed issuer to establish an **internal audit function
independent of the activities it audits**, reporting **directly to the audit committee**.
The reporting line is the whole point of the rule; an internal audit head who reports to the
CFO does not satisfy it.

## How does it interact with the external auditor?

Chapter 15 gives the committee the machinery, and the Companies Act gives the auditor
matching rights. They are meant to lock together.

**Rule 15.17 — the committee's rights.** Authority to investigate any matter within its
terms of reference; the resources it requires; **full and unrestricted access** to
information; **direct communication channels** with the external auditors and with internal
audit; power to obtain **independent professional advice**; and the power to **convene
meetings with the external auditors excluding other directors and employees, whenever
deemed necessary**.

Note the standard: *whenever deemed necessary*. **Chapter 15 fixes no minimum number of such
private sessions per year.** The "at least twice a year" figure that circulates in Malaysian
governance content is not in the Listing Requirements — do not treat it as a Bursa rule.

**Rule 15.24** runs the channel the other way: the external auditor may request the audit
committee chairman to convene a meeting.

On the Act's side, the auditor of a public company is not a passive supplier of an opinion:

| Right or duty | Section |
| --- | --- |
| Access at all reasonable times to accounting and other records, and to require information from any officer | s.266(4) |
| Same access to a subsidiary's records where consolidated statements are prepared | s.266(5) |
| Entitled to attend any general meeting, receive notices, and be heard on audit matters | s.266(7) |
| Duty to report a breach of the Act to the Registrar where it will not otherwise be dealt with | s.266(8) |
| Remuneration fixed by members by ordinary resolution, or by the Board if Board-appointed | s.274 |
| Removal only by ordinary resolution at a general meeting, on special notice | ss.276, 277 |
| Resignation by written notice to the registered office, effective after 21 days or as specified | s.281 |
| Auditor of a public company **shall attend every AGM** at which financial statements are laid | s.285(1) |

Section 285(1) is the one to hold on to. In a listed company the external auditor is
obliged to be in the room at the AGM to answer questions relevant to the audit, and failure
is an offence subject to the s.285(3) excuses. The audit committee's private sessions and
the auditor's AGM attendance are the two structural points at which the auditor can speak
without management filtering.

> **Escalation over the board's head.** Rule 15.16 is the sharpest provision in Chapter 15
> and the least discussed: where a matter reported to the board is **not satisfactorily
> resolved, resulting in a breach of the Listing Requirements, the audit committee must
> promptly report it to the Exchange.** The committee's ultimate reporting line is Bursa,
> not the board that appointed it.

The ACE Market rules mirror all of this. ACE Chapter 15 uses the **same rule numbers** and
substantively identical wording — same three members, same non-executive and majority-
independent tests, same Accountants Act limbs, same bar on alternate directors, same
three-month cure, same quorum, same internal audit reporting line. The differences are
drafting only: "listed corporation" for "listed issuer", and a cross-reference to Guidance
Note 9 rather than Practice Note 13.

## Common mistakes

**Citing the Companies Act 2016 as the source.** There is nothing to cite. Every audit
committee obligation in this article comes from Bursa or from MCCG.

**Assuming an unlisted Berhad needs one.** It does not, as a matter of company law. Boards
often constitute one voluntarily, which is sensible — but it is a governance choice, not
compliance with a statute.

**Appointing an alternate to cover an absent member.** Rule 15.09(2) prohibits it outright.

**Treating composition and quorum as the same test.** Rule 15.09 governs who the members
are; rule 15.18 governs who is in the room. Both must hold.

**Letting the board chairman chair the committee.** Bursa permits it if he is independent;
MCCG Practices 9.1 and 1.4 say do not, and a listed issuer must disclose its application of
MCCG under rule 15.25. Departing without an explanation is the exposure.

**Running internal audit into the CFO.** Rule 15.27 requires the function to report directly
to the audit committee.

**Quoting "key audit partner" for the cooling-off policy.** The 2021 MCCG broadened it to
any former partner of the firm or an affiliate.

## What's next

Pull your committee's terms of reference and test them against rule 15.09 line by line —
size, non-executive status, majority independence, the qualification limb, and the bar on
alternates. Rule 15.11 requires the terms of reference to be **published on the listed
issuer's website**, so a stale document is publicly stale.

Then check two things that fail quietly: whether the last four meetings were quorate under
rule 15.18, and whether internal audit's reporting line runs to the committee rather than to
management.

Directors sitting on the committee remain bound by the general duties in Part III of the
Companies Act 2016 — committee membership adds obligations without displacing any. See
[directors' duties](/en/company-secretary/directors-duties/). For the appointment and removal
mechanics on the auditor's side, see
[appointing an auditor](/en/audit/appointing-an-auditor/).

## Sources

- Main Market Listing Requirements, Chapter 15 — Corporate Governance — https://www.bursamalaysia.com/sites/5bb54be15f36ca0af339077a/content_entry5ce3b50239fba2627b2864be/5ce3b5ce5b711a163beae1bd/files/MAIN_Chap15_COI_Ors_Amendments_1July2023_.pdf (Bursa Malaysia)
- ACE Market Listing Requirements, Chapter 15 — Corporate Governance — https://www.bursamalaysia.com/sites/5bb54be15f36ca0af339077a/content_entry5ce3b50239fba2627b2864be/5ce3ba6f5b711a155e950749/files/ACE_Chap15_COI_Ors_Amendments__1July2023_.pdf (Bursa Malaysia)
- Malaysian Code on Corporate Governance, as at 28 April 2021 — https://www.sc.com.my/regulation/corporate-governance (Securities Commission Malaysia)
- Companies Act 2016 (Act 777), reprint as at 1 August 2022 — https://www.ssm.com.my/Pages/Legal_Framework/Document/Companies%20Act%202016_Akta%20777_BI%20(1.8.2022).pdf (SSM)
- Companies (Amendment) Act 2024 (Act A1701) — https://www.ssm.com.my/Pages/Legal_Framework/Document/A1701%20BI.pdf (SSM)

---
Source of truth: https://github.com/negaraku-md/NegaraKu.md
License: CC BY-SA 4.0