The Audit Committee: What Malaysian Public Companies Actually Have to Do

Ask most Malaysian directors where the audit committee requirement comes from and you will be told the Companies Act. It does not. The phrase “audit committee” appears nowhere in the Companies Act 2016 — not once across 620 sections — and the Companies (Amendment) Act 2024 did not add it.

That is not a drafting oversight. It is a deliberate relocation, and knowing where the duty actually sits changes who is bound by it and who enforces it.

Where the requirement actually comes from

Under the Companies Act 1965, s.15A, every company with quoted shares had to have an audit committee. Section 620 of the Companies Act 2016 repealed the 1965 Act, and the 2016 Act provided no successor provision. The obligation migrated wholesale into the Bursa Malaysia Listing Requirements, Chapter 15.

Three consequences follow, and each of them is regularly got wrong.

The duty binds listed issuers only. Chapter 15 speaks to a “listed issuer” on the Main Market and a “listed corporation” on the ACE Market. An unlisted public company — an ordinary Berhad that has never listed — has no general legal obligation to constitute an audit committee, and neither does a Sdn Bhd. Sector regulators are the exception: a licensed financial institution answers to Bank Negara’s own governance requirements, which are not covered here.

The enforcer is Bursa, not SSM. A composition failure is a listing-requirement breach. The Registrar has no jurisdiction over it, because there is nothing in the Act to breach.

Failure is not a criminal offence under the Act. It attracts Bursa’s regulatory sanctions instead — a materially different exposure from, say, failing to appoint a company secretary within 30 days under s.236.

Who can sit on the committee?

Rule 15.09(1) sets four composition tests, and all must hold simultaneously.

Test	Requirement
Size	Not fewer than 3 members
Executive status	All members must be non-executive directors
Independence	A majority must be independent directors
Financial literacy	At least one member must satisfy the qualification limbs below

The financial-literacy limb (rule 15.09(1)(c)) is more specific than the shorthand “financially literate” suggests. At least one member must be either:

• a member of the Malaysian Institute of Accountants; or
• if not an MIA member, someone with at least 3 years’ working experience who has either passed the examinations specified in Part I of the First Schedule of the Accountants Act 1967, or is a member of one of the associations of accountants specified in Part II of that First Schedule; or
• someone who fulfils such other requirements as prescribed or approved by the Exchange.

Rule 15.09(2) then bars something people try: no alternate director may be appointed a member of the audit committee. You cannot solve a member’s travel schedule with a stand-in.

The chairman is elected, not appointed by the board. Rule 15.10 requires the members to elect a chairman from among themselves who is an independent director. The board does not choose for them.

The Malaysian Code on Corporate Governance (as at 28 April 2021) layers apply-or-explain practices on top. Practice 9.1: the chairman of the audit committee is not the chairman of the board. Practice 1.4, new in the 2021 edition: the board chairman should not be a member of the audit, nomination or remuneration committee at all. Step Up 9.4 invites the committee to comprise solely independent directors. Practice 9.5 asks that all members be financially literate and undertake continuous professional development.

The cooling-off rule is MCCG, not Bursa. Practice 9.2 asks the committee to adopt a policy requiring a former partner of the external audit firm to observe a cooling-off period of at least three years before appointment. The 2021 update widened it from key audit partner to any former partner of the firm or an affiliate firm, including partners who only provided advisory or tax services. Guides written against the 2017 edition still say “key audit partner” — that is the superseded wording.

What happens when the composition breaks?

Directors resign, become executive, or lose independence through tenure. Two rules govern the aftermath, and they are different rules doing different jobs.

Rule 15.19 — the cure period. Where the composition no longer complies, the vacancy or shortfall must be filled within three months.

Rule 15.18 — the quorum. The majority of members present at any meeting must be independent directors. This is a meeting-by-meeting test, not a standing-composition test. A committee that is properly composed on paper can still hold an inquorate meeting because the wrong two people turned up, and decisions taken there are exposed.

Rule 15.13 controls attendance from outside: other directors and employees attend only at the audit committee’s invitation, specific to the relevant meeting. A standing invitation to the CFO is not what the rule contemplates.

What does the committee actually do?

Rule 15.12 lists the functions. In practice they cluster into four jobs.

Review the external audit. The committee reviews with the external auditor the audit plan, the auditor’s evaluation of the system of internal controls, and the audit report.

Review the numbers before the board sees them. Quarterly results and the year-end financial statements go to the audit committee before board approval — the committee is upstream of the board, not a reviewer of what the board has already passed.

Police conflicts. Related party transactions and conflict-of-interest situations are squarely the committee’s work, and rule 15.15 requires the annual report to carry a summary of the conflict situations reviewed.

Own the auditor relationship. The committee reviews the external auditor’s letter of resignation, forms a view on whether there is reason to believe the auditor is unsuitable for re-appointment, and recommends the nomination of external auditors.

Rule 15.15 also fixes what the Audit Committee Report in the annual report must disclose: composition with each member’s designation and independence, the number of meetings and each member’s attendance, a summary of the committee’s work, and a summary of the internal audit work done.

And rule 15.27 requires the listed issuer to establish an internal audit function independent of the activities it audits, reporting directly to the audit committee. The reporting line is the whole point of the rule; an internal audit head who reports to the CFO does not satisfy it.

How does it interact with the external auditor?

Chapter 15 gives the committee the machinery, and the Companies Act gives the auditor matching rights. They are meant to lock together.

Rule 15.17 — the committee’s rights. Authority to investigate any matter within its terms of reference; the resources it requires; full and unrestricted access to information; direct communication channels with the external auditors and with internal audit; power to obtain independent professional advice; and the power to convene meetings with the external auditors excluding other directors and employees, whenever deemed necessary.

Note the standard: whenever deemed necessary. Chapter 15 fixes no minimum number of such private sessions per year. The “at least twice a year” figure that circulates in Malaysian governance content is not in the Listing Requirements — do not treat it as a Bursa rule.

Rule 15.24 runs the channel the other way: the external auditor may request the audit committee chairman to convene a meeting.

On the Act’s side, the auditor of a public company is not a passive supplier of an opinion:

Right or duty	Section
Access at all reasonable times to accounting and other records, and to require information from any officer	s.266(4)
Same access to a subsidiary’s records where consolidated statements are prepared	s.266(5)
Entitled to attend any general meeting, receive notices, and be heard on audit matters	s.266(7)
Duty to report a breach of the Act to the Registrar where it will not otherwise be dealt with	s.266(8)
Remuneration fixed by members by ordinary resolution, or by the Board if Board-appointed	s.274
Removal only by ordinary resolution at a general meeting, on special notice	ss.276, 277
Resignation by written notice to the registered office, effective after 21 days or as specified	s.281
Auditor of a public company shall attend every AGM at which financial statements are laid	s.285(1)

Section 285(1) is the one to hold on to. In a listed company the external auditor is obliged to be in the room at the AGM to answer questions relevant to the audit, and failure is an offence subject to the s.285(3) excuses. The audit committee’s private sessions and the auditor’s AGM attendance are the two structural points at which the auditor can speak without management filtering.

Escalation over the board’s head. Rule 15.16 is the sharpest provision in Chapter 15 and the least discussed: where a matter reported to the board is not satisfactorily resolved, resulting in a breach of the Listing Requirements, the audit committee must promptly report it to the Exchange. The committee’s ultimate reporting line is Bursa, not the board that appointed it.

The ACE Market rules mirror all of this. ACE Chapter 15 uses the same rule numbers and substantively identical wording — same three members, same non-executive and majority- independent tests, same Accountants Act limbs, same bar on alternate directors, same three-month cure, same quorum, same internal audit reporting line. The differences are drafting only: “listed corporation” for “listed issuer”, and a cross-reference to Guidance Note 9 rather than Practice Note 13.

Common mistakes

Citing the Companies Act 2016 as the source. There is nothing to cite. Every audit committee obligation in this article comes from Bursa or from MCCG.

Assuming an unlisted Berhad needs one. It does not, as a matter of company law. Boards often constitute one voluntarily, which is sensible — but it is a governance choice, not compliance with a statute.

Appointing an alternate to cover an absent member. Rule 15.09(2) prohibits it outright.

Treating composition and quorum as the same test. Rule 15.09 governs who the members are; rule 15.18 governs who is in the room. Both must hold.

Letting the board chairman chair the committee. Bursa permits it if he is independent; MCCG Practices 9.1 and 1.4 say do not, and a listed issuer must disclose its application of MCCG under rule 15.25. Departing without an explanation is the exposure.

Running internal audit into the CFO. Rule 15.27 requires the function to report directly to the audit committee.

Quoting “key audit partner” for the cooling-off policy. The 2021 MCCG broadened it to any former partner of the firm or an affiliate.

What’s next

Pull your committee’s terms of reference and test them against rule 15.09 line by line — size, non-executive status, majority independence, the qualification limb, and the bar on alternates. Rule 15.11 requires the terms of reference to be published on the listed issuer’s website, so a stale document is publicly stale.

Then check two things that fail quietly: whether the last four meetings were quorate under rule 15.18, and whether internal audit’s reporting line runs to the committee rather than to management.

Directors sitting on the committee remain bound by the general duties in Part III of the Companies Act 2016 — committee membership adds obligations without displacing any. See directors’ duties. For the appointment and removal mechanics on the auditor’s side, see appointing an auditor.