Malaysia Audit Exemption for Private Companies: SSM Thresholds and Rules in 2026

Which Malaysian companies can skip the statutory audit?

Only private companies that are dormant, or that pass SSM’s two-of-three size test, can skip the audit. Section 267(1) of the Companies Act 2016 requires every private company to appoint an auditor, and section 267(2) lets the Registrar exempt private companies that meet its criteria. Practice Directive 10/2024, issued on 16 December 2024, sets those criteria for annual periods commencing on or after 1 January 2025; the revoked Practice Directive 3/2017 still governs earlier periods. No application is made: a qualifying company elects the exemption by lodging unaudited statements with a certificate, and may still appoint an auditor.

A dormant company is exempt if it has been dormant since incorporation, or during both the current and the preceding financial year. SSM treats a company as dormant if it carries on no business and has no accounting transactions, disregarding statutory payments and related compliance costs. The zero-revenue category has gone. Under Practice Directive 3/2017, a company with no revenue for three years and total assets of RM300,000 or less was exempt, as was one with revenue up to RM100,000, assets up to RM300,000 and no more than 5 employees. Both were replaced by the two-of-three test.

Audit exemption thresholds for years starting in 2025, 2026 and 2027

A private company qualifies if at least two of three limits, on revenue, total assets and full-time employees, hold in the current financial year and each of the two preceding years. The phase is fixed by the date the financial year begins, not when it ends or when the accounts are lodged. SSM’s FAQ confirms that the earlier years are measured against the current phase: for a 2026 year, the 2024 and 2025 figures must also sit within the RM2 million limits. The Phase 3 limits remain unless the Registrar reviews them.

Revenue means amounts received and receivable, excluding reversals of earlier entries, tax entries, reversed provisions and gains on derecognising property, plant and equipment or investment property. Total assets are all current and non-current assets. Employees are full-time staff at each year end, meaning paid workers on at least 6 hours a day for 20 days a month or 120 hours a month, including foreign, contract and probationary workers but not working directors or shareholders, or unpaid family members. Each company is tested on its own figures, not its group’s.

A year from 1 July 2025 to 30 June 2026 is a Phase 1 year; a year from 1 April 2026 to 31 March 2027 is a Phase 2 year.

Who cannot use audit exemption, even below the limits?

Public companies, their subsidiaries, foreign companies and any company whose members or the Registrar call for an audit must be audited regardless of size. SSM treats subsidiaries and jointly controlled companies of a public company as carrying greater public interest, although an associate of a public company can qualify, as can a company with corporate shareholders. Where another law, licence or guideline requires an audit, it prevails. The member override is the rule most often missed.

• Public companies, including listed companies.
• Private companies that are subsidiaries of, or jointly controlled by, a public company.
• Foreign companies registered in Malaysia.
• An exempt private company that lodges a section 260 certificate for the year instead of financial statements.
• Companies that another written law, licence or guideline requires to be audited.
• Companies that receive written notice, no later than one month before year end, from members holding at least 5% of the issued shares, at least 5% of the voting members, or the Registrar.

For a 31 December 2026 year end, a member’s notice received by 30 November 2026 makes the FY2026 audit compulsory.

Worked example: one company tested for FY2025, FY2026 and FY2027

A Sdn Bhd with a 31 December year end reports: FY2023 revenue RM1.3 million, total assets RM1.1 million, 12 employees; FY2024 RM1.5 million, RM950,000, 9; FY2025 RM1.6 million, RM900,000, 8; FY2026 RM2.4 million, RM1.5 million, 14; FY2027 RM2.9 million, RM3.3 million, 18. Each year is tested on three years of figures against the limits of the phase in which that year begins.

On its FY2025 figures alone the company passes the assets and employee limbs, but FY2023 breaks both (RM1.1 million and 12 staff), so it fails all three limbs and FY2025 must be audited. For FY2026, assets stay within RM2 million and staff within 20 across 2024–2026, so two limbs hold despite FY2026 revenue of RM2.4 million. For FY2027, revenue stays within RM3 million and staff within 30, so the company remains exempt even though FY2027 assets of RM3.3 million exceed the cap.

If members holding 5% of the shares give written notice by 30 November 2027, FY2027 must be audited regardless of the test.

What changed in audit exemption in 2025–2026?

The limits, the categories and the guidance all changed. PD 10/2024 replaced the 2017 criteria for years starting from 1 January 2025, and SSM’s FAQ has been updated on 19 March 2025, 6 November 2025 and 19 May 2026. Separately, MASB revised MPERS, the standard most audit-exempt companies use, from 1 January 2027. As at October 2026, SSM has announced no change to the Phase 3 limits.

How to elect audit exemption for a financial year, step by step

The election is made at each year end, by testing, preparing and lodging, with no application to SSM. The company makes its own assessment and must confirm it has no liabilities or third-party obligations that require audited statements; SSM’s May 2026 FAQ update asks directors to weigh risk profile, governance and controls, and encourages professional advice. Work forward from the date the year began.

1. Identify the phase from the date the financial year began.
2. Confirm the company is not excluded, and that no lender, licence, grant or parent group requires audited statements.
3. Collect revenue, total assets and year-end full-time headcount for the current and two preceding years, and test each limb against the current phase’s limits.
4. Check that no notice from 5% of members or the Registrar arrived by one month before year end.
5. Prepare unaudited financial statements under MPERS, or MFRS if fully adopted, with the directors’ report, statement by directors and statutory declaration.
6. Have a director sign the audit exemption certificate, recording the date the statements were circulated.
7. Circulate the statements to members within 6 months of year end, or apply for an extension at least 7 days before the deadline (RM100).
8. Lodge the statements and certificate on MBRS 2.0 within 30 days after circulation (RM20).
9. File Form e-C, upload the statements and tax computation through MITRS, and repeat the test next year.

What an audit-exempt company must still prepare and file

An audit-exempt company keeps every preparation and lodgement duty except the auditor’s report. Its financial statements must comply with approved accounting standards: MPERS, or MFRS if the company has fully adopted it. They are circulated to members within 6 months of year end and lodged within 30 days after circulation, and the annual return is due within 30 days of each incorporation anniversary whatever the audit position. Dates for a 31 December year end are set out in our Sdn Bhd annual compliance calendar.

LHDN still requires a full tax return. Form e-C is due within 7 months of the end of the accounting period, and under section 82B of the Income Tax Act 1967 the financial statements and tax computation are uploaded through MITRS within 30 days after the return deadline. LHDN accepts unaudited statements where a written law grants audit exemption and refers companies to PD 10/2024. Audit status does not change e-CP204, which is still due 30 days before each basis period.

• Unaudited financial statements under MPERS or MFRS
• Directors’ report, statement by directors and statutory declaration
• Audit exemption certificate signed by a director
• Working papers for three years of revenue, total assets and year-end headcount
• Record of the circulation date
• MBRS 2.0 lodgement (RM20) and annual return (RM150)
• Form e-C, tax computation and MITRS upload

Audit-exempt vs audited: cost, documents, lodgement and expectations

The exemption removes the auditor, not the accounts. Both routes prepare full financial statements to the same deadlines; the differences are the auditor’s report, the certificate, the SSM fee and how third parties react. SSM acknowledges that some agencies still require audited statements for licensing, grants, loans and monitoring of government-linked companies, and where another law or guideline requires an audit, that requirement prevails over PD 10/2024.

Before electing, check loan covenants, licence conditions, grant agreements and whether a parent group needs audited figures for consolidation. MIA notes that a holding company may still have to prepare consolidated statements even when they are not audited, and that a compilation engagement under ISRS 4410 (Revised) must be performed by a professional accountant in public practice, not merely a qualified accountant.

Penalties for wrongly claiming audit exemption or lodging late

Wrongly claiming the exemption leaves the company without compliant accounts and the signing director personally exposed. A company that does not qualify must be audited, so an unaudited lodgement lacks the auditor’s report the Act requires: the company must appoint an auditor, complete the audit, then circulate and lodge again, paying late fees if the deadline has passed. LHDN accepts unaudited statements only where an audit exemption applies, so the MITRS upload falls short too.

• False certificate: section 593 of the Companies Act 2016 makes a false report or statement to the Registrar an offence, so a director who knowingly signs a false certificate risks prosecution.
• Not sending financial statements to members: a fine of up to RM50,000 for the company and every officer in breach (section 257(4)).
• Late lodgement, private company: RM50 if more than 7 days and up to 3 months late, RM100 up to 6 months, RM150 up to 12 months and RM200 beyond.
• Waivers: SSM’s extension to 31 December 2026, announced on 29 September 2026, is framed around Corporate Registry System lodgements; financial statements go through MBRS 2.0.
• Tax: failing to submit section 82B documents through MITRS is an offence under paragraph 120(1)(d) of the Income Tax Act 1967, with a fine of RM200–RM20,000, up to six months’ imprisonment, or both.
• Ceasing to qualify is not penalised: the company is audited from that year; earlier exempt years stand.

Common audit exemption mistakes

Most errors come from testing the wrong years, the wrong phase or the wrong headcount. Because the company assesses itself and SSM does not approve the election in advance, a mistake usually surfaces later, at a bank review, a tax audit, a due diligence exercise or a dispute with a minority shareholder, when several years of lodgements may need to be redone.

• Testing only the current year: the two preceding years must also pass, at the current phase’s limits.
• Picking the phase by year end: the start date decides it, so a July 2025 start uses Phase 1.
• Switching limbs between years: PD 10/2024 frames each limb as a three-year test, so keep the same two limbs throughout.
• Mixing group and company figures: SSM tests each company alone, but a subsidiary of a public company is excluded at any size.
• Miscounting staff: include foreign, contract and probationary full-time workers at each year end, but not working directors or shareholders.
• Forgetting the member override: a 5% shareholder or joint venture partner can require an audit by notice up to one month before year end.
• Assuming a new company qualifies: a non-dormant company needs two prior years of figures, so its first two years are audited.

Audit exemption terms explained

Several terms in SSM and LHDN guidance look familiar but carry specific meanings for this test. Dormant, employee and revenue are defined in PD 10/2024 itself, and those definitions, rather than general accounting or payroll usage, decide eligibility. The short definitions below follow the wording of SSM, MASB and LHDN as at October 2026 and apply only to Malaysian private companies.

• Audit exemption certificate: the Appendix 1 certificate in PD 10/2024, signed by a director and lodged with the unaudited statements.
• Dormant company: a company that carries on no business and has no accounting transactions, ignoring statutory payments.
• Exempt private company (EPC): a private company with no corporate beneficial shareholder and no more than 20 members, none of them a corporation.
• MPERS: the Malaysian Private Entities Reporting Standard; MPERS (2025) applies to annual periods beginning on or after 1 January 2027.
• MBRS 2.0: SSM’s Malaysian Business Reporting System, used to lodge annual returns and financial statements.
• MITRS: LHDN’s Malaysian Income Tax Reporting System for section 82B documents.
• Phase: the threshold step that applies, fixed by when the financial year begins.