Malaysia Audit Exemption for Small Private Companies: How It Works

Under Malaysia's Companies Act 2016, every private company must appoint an auditor, unless the Registrar exempts it. The exemption is set out in a practice directive from the Companies Commission of Malaysia (SSM), not in the Act's text. The directive has been replaced over time, so the criteria must be read from the current version, not from older articles.

Last reviewed: 17 October 2026. Facts checked. We ran a web search that returned SSM press releases, an MIA circular listing and professional-firm summaries. The MIA FAQ on audit exemption (2025) returned an access error when we tried to open it, so we did not read it. One firm article (dated 2017) opened and described the original 2017 directive. Search summaries indicate Practice Directive 10/2024, issued 16 December 2024 and applying to financial periods beginning on or after 1 January 2025, replaced the earlier PD 3/2017. We could not open PD 10/2024 itself, so no thresholds or test wording from it are given here. Read the directive on the SSM or MIA site before advising a client.

The legal basis

• Section 267(1) of the Companies Act 2016 requires a private company to appoint an auditor for each financial year.
• Section 267(2) allows the Registrar to exempt private companies, using criteria set in a practice directive.

So the question for any client is not "is it small?" but "does it meet the criteria in the directive that applies to this financial year?"

The categories in the original regime

The 2017 directive, as described by a firm article from that year, exempted several categories of private company:

• Companies that were dormant.
• Companies with zero revenue.
• Companies below defined size thresholds that had to be met over several years.
• It did not apply to an exempt private company that had lodged a certificate of that status under section 260 of the Act.

We have not confirmed which of these categories PD 10/2024 keeps, changes or drops, and the numbers in the 2017 article should not be applied to current periods. One search summary said that under PD 10/2024 each company is tested on its own standalone financial statements, so a subsidiary and its parent may each qualify or not independently. Confirm that point in the MIA FAQ or the directive itself.

What exemption does and does not mean

Exempt companies still have to keep proper accounting records and prepare financial statements. Exemption removes the audit requirement, not the duty to keep books and to prepare and lodge returns as the Act requires. The company's directors remain responsible for the accuracy of what they prepare. We could not confirm the lodging and filing duties from a primary source, so check these with SSM.

A practical point: the exemption status can be lost. If a company stops meeting the criteria, the next period needs an audit. Build a yearly check into the compliance calendar, using the test from the directive in force for that period.

A yearly test for a client file

1. Identify the financial year and the directive that applies to it.
2. Check whether the company is a type the directive covers, and whether any exclusion applies, such as exempt private company status.
3. Apply each quantitative test over the periods the directive requires, using the figures from the financial statements.
4. Record the conclusion and the evidence in a memo, and have a second person review it.
5. If the company is exempt, confirm who prepares the financial statements and how directors approve them.
6. If the company is not exempt, appoint an auditor in good time.

Keep the memo with the working papers. If SSM or a lender asks why no audit was done, the memo is the answer.

The MIA, in brief

The Malaysian Institute of Accountants is the statutory body for the accountancy profession in Malaysia. It is separate from the Malaysian Institute of Certified Public Accountants. Public practice in Malaysia involves an approved company auditor licence under the Companies Act, so a foreign firm should treat a Malaysian statutory audit as a matter for a locally licensed firm. We did not open the licensing rules, so confirm the requirements for approval and for use of the MIA designations with MIA directly.

For Indian firms, the realistic roles are usually:

• Referral and group support: supporting a Malaysian subsidiary of an Indian company in coordination with a licensed local auditor.
• Accounting and compliance support: preparing management accounts and reconciliations, subject to local rules on who can sign what.
• Group audit reporting: the Indian group auditor may receive reporting from a Malaysian component auditor. See SA 600 on using another auditor's work.

Comparing with Singapore

The structure resembles Singapore's: the company law sets an audit default, then lets small companies opt out against tests. Our post on Singapore's audit exemption test explains that regime. The details differ. Malaysia sets its exemption through a practice directive that has been replaced, while Singapore's tests sit in its Companies Act. Do not carry a Singapore rule over to Malaysia or the reverse.

What to tell a client

• Exemption is a status that has to be re-tested every year.
• It removes the audit, not the need for sound records.
• Lenders, investors and tax filings may still ask for audited statements.
• If the business is growing, plan for the audit before the exemption ends.

Related Articles

• Singapore audit exemption: the small company test
• Asia audit quality standards compared
• Using the work of another auditor under SA 600

Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error