How to Choose an Audit Firm in Malaysia: A Practical Guide for Sdn Bhd Companies

Reading time: ~12 minutes. Audience: Malaysian Sdn Bhd directors, CFOs, and finance managers who need to appoint an auditor or are considering switching firms. Skill level: beginner to intermediate.

Choosing an auditor is one of those decisions most Malaysian business owners make once and then forget about — until something goes wrong. An auditor who doesn’t understand your industry will ask irrelevant questions, blow past deadlines, and deliver a management letter full of boilerplate. A good auditor catches real problems, keeps you compliant, and finishes on time.

This guide helps you make that choice. We’ll cover who needs a statutory audit, what types of engagements exist, what auditors actually look for, how fees work, and how to tell a good firm from a mediocre one.

Part 1: Does your company need a statutory audit?

Yes, unless it qualifies for exemption. Every private company must appoint an auditor for each financial year (Companies Act 2016, s.267(1)). The Registrar can exempt private companies that meet the criteria in SSM Practice Directive 10/2024 (s.267(2)).

Audit exemption criteria (PD 10/2024)

A private company qualifies if it meets at least two of these three criteria. Each must hold for the current financial year and the two before it (PD 10/2024, para 5):

1. Annual revenue does not exceed the threshold
2. Total assets do not exceed the threshold
3. Number of full-time employees at year-end does not exceed the threshold

The thresholds rise in three phases (PD 10/2024, para 9):

Financial periods starting	Revenue	Total assets	Employees
1 Jan 2025 – 31 Dec 2025	RM1,000,000	RM1,000,000	10
1 Jan 2026 – 31 Dec 2026	RM2,000,000	RM2,000,000	20
From 1 Jan 2027	RM3,000,000	RM3,000,000	30

Some points to note:

• Who counts as an employee. Full-time staff include local, foreign, contract and probationary workers. Directors or shareholders who work full-time are excluded, as are unpaid or irregularly paid family members (PD 10/2024, para 6(c); SSM FAQ Part L, Q3).
• Dormant companies stay exempt. This covers companies dormant since incorporation and companies dormant in the current and previous financial year (para 10).
• The exemption does not apply to (para 12):
  • public companies;
  • private companies that are subsidiaries of a public company;
  • foreign companies;
  • an exempt private company that has opted to lodge a certificate under s.260.
• Shareholders or SSM can still require an audit (para 14). The notice must come from members holding at least 5% of the voting shares, from at least 5% of the voting members, or from the Registrar, no later than one month before the financial year ends.

An exempt company still prepares financial statements and lodges them unaudited, with the certificate required under ss.258 and 259 (para 15). Many companies have an accountant compile them (a compilation engagement). This costs less than an audit but gives no assurance to third parties.

When you might want an audit even if exempt

• Banks may ask for audited accounts when you apply for financing.
• Government and corporate tenders often require audited financial statements.
• Investors and acquirers usually insist on audited numbers during due diligence.
• Credibility: an auditor’s report carries weight with suppliers and partners.

If you have lenders, investors or major customers who rely on your numbers, ask them what they need before you decide to skip the audit.

Part 2: Types of audit engagements

Engagement	What it is	When to use it
Statutory audit	Full audit of financial statements under ISA standards, resulting in an independent auditor’s report filed with SSM	Required by law for non-exempt companies
Compilation engagement	Accountant compiles financial statements from management data without expressing an opinion (ISRS 4410)	For companies exempt from audit under PD 10/2024
Agreed-upon procedures (AUP)	Auditor performs specific procedures and reports factual findings — no opinion	Due diligence, grant compliance, specific account verification
Internal audit	Review of internal controls, risk management, and operational efficiency	For companies that want ongoing assurance between annual audits
Review engagement	Limited assurance — less than an audit but more than a compilation (ISRE 2400)	Rarely used in Malaysia for Sdn Bhd companies

Most Malaysian SMEs need either a statutory audit or, if exempt, unaudited financial statements, often prepared as a compilation. The audit gives you an independent opinion; a compilation presents your numbers without checking them.

Part 3: What auditors actually look for

During the audit fieldwork, the audit team focuses on areas where the risk of material misstatement is highest. For a typical Malaysian SME, these are:

Revenue recognition

• Are sales recorded in the correct period (cut-off)?
• Are credit notes and returns handled properly?
• For construction or project-based businesses: is percentage-of-completion calculated correctly?

Trade receivables

• Is the aged receivables schedule accurate?
• Are doubtful debts identified and provided for?
• Has the company impaired long-outstanding balances?

Trade payables and accruals

• Are all supplier bills recorded at year-end?
• Are accruals for EPF, SOCSO, EIS, utilities, and professional fees complete?
• Are there any unrecorded liabilities?

Bank and cash

• Do bank reconciliations agree to the bank statements and GL?
• Are there unexplained reconciling items?
• Is petty cash properly controlled and documented?

Fixed assets

• Are additions supported by purchase documentation?
• Is depreciation calculated correctly under the company’s accounting policy?
• Have disposals been properly removed from the register?

Tax

• Is the current tax provision reasonable?
• Are deferred tax balances calculated correctly?
• Is the SST position consistent with the filed SST-02 returns?

Statutory compliance

• Are the financial statements in the correct format (MFRS or MPERS)?
• Are all Companies Act 2016 disclosures present (directors’ report, statement of compliance)?
• Is the audit report correctly dated and signed?

Part 4: How audit fees work in Malaysia

Most firms quote a fixed fee for the engagement rather than billing by the hour. The fee depends on:

• Revenue and total assets. Larger companies have more transactions to test.
• Number of entities. Group audits cost more because each subsidiary needs its own work.
• Complexity. Multiple currencies, intercompany transactions and unusual transactions all add work.
• Industry. Construction, property development and financial services need specialised procedures.
• The state of your books. Clean, reconciled records with supporting documents take less time to audit than records that need fixing first.

We don’t publish fee benchmarks, because quotes vary widely by firm and by client. Ask at least three firms for a written fixed-fee quote based on your latest trial balance, and confirm what’s included (tax computation, secretarial liaison, out-of-pocket costs). If a firm quotes hourly and cannot give you a ceiling, treat that as a red flag.

Part 5: How to evaluate an audit firm

Must-haves

1. An approved company auditor: The partner who signs your report must be approved by the Minister of Finance as a company auditor (Companies Act 2016, s.263). Approval lasts two years at a time (s.263(4)), so ask to see it. Registration with the Audit Oversight Board is a separate requirement for auditors of public-interest entities and schedule funds; a firm auditing only private companies does not need it
2. Industry experience: Ask for references from clients in your sector
3. Engagement partner: Know who will sign your audit report — not just the junior who does the fieldwork
4. Timeline commitment: The firm should commit to a specific fieldwork start date and signing deadline
5. Fixed fee: No open-ended hourly billing — agree on the total fee before work begins

Nice-to-haves

• Cloud-native approach: Firms that can work directly in your accounting software (such as IntBooks) spend less time chasing printed and scanned documents
• Tax team: A firm with an in-house tax department can flag tax issues during the audit and save you a separate engagement
• Proactive management letter: The management letter should contain real, actionable recommendations — not just “we noted the following”
• Bilingual: Ability to present findings to the board in English and Bahasa Malaysia

Red flags

• “We’ll tell you the fee after the audit”: This means they’ll bill whatever they want
• No partner involvement: If the engagement partner never attends meetings or reviews the work, you’re paying premium fees for junior staff
• Missed deadlines year after year: A private company must circulate its financial statements to members within six months of the financial year end (Companies Act 2016, s.258). A firm that regularly signs so late that you’re pushed up against that deadline is overcommitted
• Boilerplate management letter: If the management letter is copy-pasted from a template and doesn’t mention your specific business, the audit was superficial

Part 6: How IntBooks helps with audit preparation

Audit preparation usually means assembling a “PBC list” (prepared by client): trial balance, bank reconciliations, aged schedules, transaction samples, the fixed asset register and supporting documents. IntBooks keeps these in one place, which makes that list quicker to produce:

• Read-only auditor access: You can give your auditor a user with the read-only auditor role, so they can look up the ledger, reports and transactions themselves instead of waiting for exports.
• Live data: The auditor sees the same books you do, not a snapshot emailed weeks earlier.
• Audit log: Changes are logged, and the auditor role can read the log.
• Standard reports: Trial balance, general ledger, aged receivables and payables, and bank reconciliation records come from the same ledger the financial statements are built on.

Your auditor still decides what evidence they need. Good records shorten the process but don’t replace it.

---

Next steps: Explore audit services · Statutory audit glossary entry · View all professional services