Audit Exemption 2025 and Beyond: Governance Still Matters

When the Companies Commission of Malaysia (SSM) first introduced audit exemption through Practice Directive No. 3/2017 (PD 3/2017), the objective was clear — to reduce compliance costs for small and dormant companies while maintaining the integrity of financial reporting.

Now, with the issuance of Practice Directive No. 10/2024 (PD 10/2024) on 16 December 2024, the audit exemption framework for private entities in Malaysia is being reshaped once again. Effective for financial reporting periods commencing on or after 1 January 2025, the directive updates the qualifying thresholds, reflecting a maturing business environment and Malaysia’s alignment with international practices on small-company reporting.

But amid these regulatory refinements on the requirements of statutory audit in Malaysia, one message must remain crystal clear:

Audit exemption does not mean governance exemption.

1. The New Audit Exemption Landscape (Effective 2025)

Under PD 10/2024, a private company may qualify for audit exemption if it meets at least two of the following three criteria in the current financial year and in each of the two preceding financial years. The new thresholds will be implemented in three phases to allow companies to transition smoothly:

(Sources: SSM Practice Directive No. 10/2024)

Important: The previous directive (PD 3/2017) remains applicable for financial periods beginning before 1 January 2025.

Under PD 10/2024, audit exemption does not apply to:

• Public companies (including listed entities);
• Private subsidiaries of public companies;
• Foreign companies registered in Malaysia; or
• Private companies that have elected to lodge a certificate under Section 260 (exempt private companies).

Furthermore, a company that is eligible for audit exemption shall be required to audit its accounts if it receives a notice in writing requiring the company to audit its accounts during a financial year but not later than one month before the end of the financial year from:

• Members holding at least 5% of voting rights,
• Not less than 5% of the total number of members eligible to vote in of the company, or
• The Registrar believes an audit is necessary in the public interest.

2. What Audit Exemption Really Means

A growing concern among regulators and practitioners is the misconception of “No Audit, No Accountability.”, or that audit exemption equals reduced compliance. 

In reality, while the auditor’s oversight is removed, the directors’ legal and fiduciary duties remain fully intact. The Companies Act 2016 continues to impose strong governance and financial reporting duties on company directors:

• Keep proper accounting records (Section 245 of the Companies Act 2016),
• Prepare financial statements that give a true and fair view (Section 244),
• Have those statements approved by the board (Section 248), and
• Lodge them with SSM within the prescribed timeframe (Section 259).

In summary, companies meeting these criteria may opt out of the statutory audit in Malaysia, allowing them to lodge unaudited financial statements with SSM. However, this flexibility does not diminish directors’ responsibilities under the Companies Act 2016.

3. Governance Risks Emerging from Audit Exemption

Post-implementation observations since 2017, and now leading into 2025, reveal recurring governance issues among audit-exempt entities:

3.1 Lapses in Record-Keeping and Controls

Without external review, some companies have weakened internal controls or delayed record updates — increasing the risk of misstatements, fraud, or regulatory non-compliance.

3.2 Financial Credibility Challenges

Financial statements are more than compliance documents — they are the foundation of trust between a company and its stakeholders.

Banks, investors, and grant agencies often prefer audited financial statements as proof of reliability. Many entities that initially opted out of audits have later needed retrospective audits to support financing applications — often at higher cost and administrative effort.

3.3 Misunderstanding of Directors’ Responsibilities

Some directors mistakenly believe exemption transfers responsibility away from management. If financial irregularities or errors are later discovered, directors who can demonstrate proper oversight, internal control, and documentation will be in a far stronger legal position than those who cannot.

4. Governance Reminders for Audit-Exempt Companies

Audit exemption is a privilege — but it requires discipline. Companies that intend to rely on the new PD 10/2024 criteria should strengthen governance in the following areas:

4.1 Maintain Proper Accounting Systems and Accounting Records

Implement digital accounting software or systems that ensure complete, traceable records.

Unaudited accounts must still be prepared with diligence and supported by proper documentation for at least seven years. A well-governed SME with unaudited but credible accounts will always command more trust than one with missing records or unclear transactions.

Many companies that qualify for exemption today may outgrow the thresholds in future.
Maintaining good governance now ensures a smooth transition when audits become mandatory again — or when required by investors, regulators, or financing institutions.

4.2 Establish proper internal control system

The statutory audit in Malaysia has long been a cornerstone of corporate transparency, providing assurance that financial statements are free from material misstatement and comply with applicable reporting standards. An external audit also serves as a structured audit risk assessment — auditors systematically identify, assess, and respond to areas of potential misstatement, whether due to error or fraud. When audit exemption is applied, this external layer of scrutiny is removed. However, the underlying risks that auditors would have assessed, such as weak internal controls, incomplete records, or misjudged estimates, remain very real. Without the external perspective provided by audit firms in Malaysia, company’s directors and management must actively ensure that their financial information remains accurate, reliable, and complete. A robust internal audit risk assessment framework helps achieve this. Even in audit-exempt companies, management should regularly:

• Identify key financial reporting risks (e.g. revenue recognition, inventory valuation, related-party transactions);
• Evaluate internal controls and segregation of duties;
• Review estimates and accounting judgments; and
• Implement checks and balances proportionate to company size.

This is not merely a compliance exercise — it is good governance practice. Small entities can adopt proportional controls suited to their size and complexity.

4.3 Consider Voluntary Assurance

It’s important to remember that audit exemption is optional, not automatic. The audit exemption regime is designed to ease administrative burdens, not to dilute financial accountability. Directors should therefore exercise professional judgment before opting out of audit. A voluntary audit may still be beneficial in situations such as:

• Preparing for bank financing or investor due diligence;
• Meeting shareholder expectations in multi-owner companies;
• Ensuring accurate and compliant tax submissions; or
• Strengthening internal financial management and controls.

Besides, audit firms in Malaysia are already responding by offering alternative assurance services, such as review engagements, agreed-upon procedures, and financial governance advisory to help companies maintain financial discipline even without mandatory audits. These alternatives offer limited assurance at lower cost than a full audit.

4.4 Preserve Board Accountability

Directors should continue to approve, sign, and minute financial statement discussions.
Board minutes should document the directors’ review and confirmation that the accounts are true and fair.

Audit Firm Insight

Audit exemption should not be viewed as the relaxation of governance — but rather as its redistribution. Where an auditor once provided assurance, now the board must demonstrate it through good practice. Strong governance signals to investors, bankers, and regulators that the company values transparency — regardless of its audit status.

Based on our observations on the entities across Malaysia, we’ve observed that while audit exemption reduces cost and administrative effort, the best-governed companies continue to maintain strong financial discipline. Many voluntarily retain audits or limited assurance engagements to enhance credibility with stakeholders.

As the 2025 framework takes effect, we encourage directors to treat the 2025 regime not as a relaxation, but as a reset — an opportunity to strengthen internal governance while leveraging regulatory flexibility.

Our teams in Grant Thornton Malaysia are ready to help clients navigate PD 10/2024, evaluate eligibility, and maintain compliance under the new thresholds.

Conclusion

While Practice Directive No. 10/2024 offers more flexibility to smaller entities, it simultaneously amplifies directors’ accountability for the accuracy and integrity of financial reporting. Audit exemption may relieve the need for external assurance — but it heightens the importance of internal accountability.

Sustainable trust in Malaysia’s corporate ecosystem depends not on the presence of an auditor’s signature, but on the consistency of integrity behind every financial statement. Ultimately, good governance is not mandated by regulation; it is chosen by leadership.