What are the audit exemption criteria for Malaysian private companies under the Companies Act 2016—and how do you test eligibility year by year?

For many directors, the practical challenge with Malaysia audit exemption criteria is not understanding that exemptions exist—it’s proving (and documenting) whether the company qualifies under SSM’s framework before the audit cycle and statutory lodgement deadlines arrive. Under the Companies Act 2016, a private company generally must appoint auditors unless it falls within an audit exemption category recognised by SSM. The operational work sits in the details: which exemption category applies (dormant, zero‑revenue, or “threshold‑qualified”), how to run the multi‑year threshold test, and what obligations still remain even if you are audit‑exempt. This guide gives a step‑by‑step workflow your finance team can execute, including a year-by-year checklist you can keep on file for governance, lenders, investors, and board decision-making.

What is the default audit rule for private companies under the Companies Act 2016 (and why does it matter operationally)?

Most finance teams start in the wrong place: they begin by asking “Can we be exempt?” instead of confirming the baseline rule and then mapping to an exemption category.

Under Malaysia’s Companies Act 2016 (CA 2016), private companies are generally required to appoint auditors and have their financial statements audited—unless they qualify for an audit exemption under SSM’s audit exemption framework (implemented via SSM’s practice directives / official guidance).

From an execution standpoint, this baseline matters because it sets your default project plan:

• Default assumption: you will appoint an auditor, plan an audit timetable, and prepare audit-ready schedules.
• Exception handling: you only switch off that plan if you can show you are within an exemption category for the relevant financial year.
• Governance expectation: directors should be able to demonstrate how the exemption conclusion was reached, and that financial reporting controls remain in place.

Practical consequence for directors and finance teams

If you treat exemption as “automatic,” you can end up with:

• late realisation that you did not qualify (and then a rushed audit)
• gaps in accounting records because “no audit” was mistaken for “less discipline”
• lender/investor friction when they ask for audited accounts and you have no plan

A workable approach is to run a short eligibility assessment early in the close process and document the result as part of year-end governance.

How does SSM’s audit exemption framework split into three categories (and why should you separate them)?

SSM’s audit exemption framework is commonly described in three categories:

1. Dormant company audit exemption
2. Zero-revenue company audit exemption
3. Threshold-qualified private company exemption (the quantitative test)

Treat these as three different workflows. They are not interchangeable, and they have different evidence expectations.

Why separation matters

Teams often mix up “no sales” with “dormant,” or assume a small company automatically meets thresholds. In practice:

• A company can have no revenue but still have transactions (expenses, payroll, subscriptions), which may push it out of a “dormant” concept.
• A company can have some revenue but still qualify as threshold-qualified.
• A company can qualify in one year but not the next; exemption is not a “once and forever” status.

Your first implementation step is to classify which category you are testing—then run the appropriate checklist.

What does “dormant” mean in practice, and how do you evidence a dormant-company audit exemption?

The dormant category is operationally the most sensitive because “dormant” is often interpreted casually.

A practical way to run the assessment is to treat “dormant” as a transaction discipline test.

Dormant assessment workflow (finance team checklist)

For the relevant financial year, confirm whether the company had:

• no operating transactions (sales, purchases, payroll)
• no active bank movements other than minimal permitted items (if any are allowed under current SSM guidance)
• no contracts performed, no invoices issued, no delivery of services
• no asset acquisitions/disposals, no loans advanced/received, no director expense claims

Then validate against your accounting system and bank records:

• Export general ledger for the full year (all accounts)
• Pull 12-month bank statements for all bank accounts
• Reconcile cash/bank and confirm there are no unposted entries

What to keep on file (without over-lawyering)

To make the conclusion defensible, keep a simple “dormant pack”:

• board note/minute recording the dormancy assessment and conclusion
• GL transaction listing and bank statements index
• confirmation of any unavoidable statutory payments (if applicable) and how they were treated

The common trap

The most common failure is calling a company dormant while it still incurs:

• secretarial fees, accounting fees, software subscriptions
• payroll for a retained staff member
• bank charges, foreign exchange movements, or intercompany postings

Those transactions may be enough to disqualify dormancy depending on the latest SSM guidance and how dormancy is interpreted for exemption purposes. If there were transactions, move to testing zero-revenue or threshold-qualified instead.

How do you test a “zero-revenue” audit exemption without confusing it with dormancy?

Zero-revenue status is typically a revenue test, not a “no transactions” test.

A company can have zero revenue and still have legitimate operating activity (e.g., pre-revenue product development, market entry spend, holding costs). The implementation goal is to prove the revenue position clearly and consistently.

Zero-revenue assessment workflow

1. Define “revenue” consistently with the accounting framework you use (and with the latest SSM guidance).
2. Pull year-end reports:

• trial balance and profit & loss
• revenue account roll-forward (opening, movements, closing)

1. Tie-out checks:

• Confirm no sales invoices issued
• Confirm no receipt postings treated as revenue (e.g., grants, rebates, “other income” misclassified)
• Review bank statements for customer-like receipts and ensure they are correctly classified

Evidence pack to retain

• management revenue memo (one page) summarising why revenue is zero
• P&L and revenue ledger detail
• brief note on any receipts that look like revenue but are not (e.g., shareholder funding, refundable deposits)

Execution tip: decide early how you treat “other income”

Many businesses have items such as interest income, forex gain, or one-off rebates. Whether these count as “revenue” for the purpose of the exemption depends on how SSM defines it in the relevant directive/guidance and how your accounts are presented. Treat this as a classification control: review and document the treatment before you rely on the exemption conclusion.

What does “threshold-qualified private company” mean, and what is the “2 of 3 criteria over three years” logic?

The threshold-qualified category is the one that creates the most implementation risk because it is not a single-year snapshot.

Conceptually:

• SSM sets three quantitative criteria (for example, commonly around revenue, assets, and headcount—exact definitions and thresholds must be verified against the latest SSM practice directive / official guidance before you rely on them).
• A private company is typically treated as threshold-qualified when it meets at least 2 out of the 3 criteria.
• The assessment is applied with a multi-year logic across three consecutive financial years.

Plain-English explanation of the multi-year logic

Think of it as a “stability test,” not a “one good year” test:

• If your company is small by the thresholds in a single year, SSM generally wants to see that the size profile is consistently small, not temporarily small.
• The three-year view helps manage volatility (e.g., one large contract, one-off asset purchase, or temporary headcount change).

Why this matters to how you run close

If you wait until year-end and only look at the current year, you may:

• incorrectly assume eligibility (because prior years break the pattern)
• overlook that a year with a different financial year-end or restructuring changes the comparison set

Operationally, you should run the threshold test as a standing control: update it each year as part of the financial close calendar.

Related guidance: See our company secretary and statutory compliance services for the relevant company setup, governance or compliance considerations. Confirm current requirements against your company’s circumstances before proceeding.

How do you build a repeatable year-by-year threshold test (so your conclusion is defensible)?

A defensible conclusion comes from a repeatable worksheet that can be reviewed by directors, internal stakeholders, and (where relevant) funders.

Below is a practical workflow you can implement in a spreadsheet or close checklist.

Step 1 — Confirm the “three criteria” and the exact thresholds (verify-current)

Before you start calculations:

• Pull the latest SSM audit exemption directive / official guidance.
• Confirm:
• the three criteria and definitions (e.g., what counts as “revenue,” what assets measure is used, how headcount is defined)
• the thresholds and whether they apply to the current year, prior years, or transitional periods
• any exclusions (e.g., certain company types that cannot use the exemption)

Do not rely on old templates. Thresholds and interpretations can change.

Step 2 — Build a three-year test table

Create a table covering three consecutive financial years (e.g., FY-2, FY-1, FY0):

• Criterion A: (as defined by SSM) – result vs threshold – pass/fail
• Criterion B: – result vs threshold – pass/fail
• Criterion C: – result vs threshold – pass/fail
• Total passes for the year (0 to 3)

Then apply the rule: at least 2 passes out of 3.

Step 3 — Tie each figure to a source document

For each year and criterion, link to:

• the signed financial statements (or management accounts if year-end sign-off is pending)
• the detailed schedule supporting the number (e.g., revenue analysis, total assets reconciliation)
• HR/headcount evidence (payroll listing, HR report, or SOCSO/EPF-related summaries—use what matches your internal system)

This “tie-out” discipline is what makes your conclusion robust.

Step 4 — Apply the multi-year logic consistently

Because the test considers three consecutive years, you should document:

• which three years were used
• whether any year had an abnormal period length (e.g., 18-month accounts due to year-end change)
• whether accounting policy changes affect comparability

If your financial year-end changed, treat it as a control point: confirm how SSM expects the test to be applied in those circumstances (based on the latest official guidance) and document your approach.

A template you can use (structure, not numbers)

Use this structure and insert the verified thresholds:

• FY-2: Criterion A (value / threshold / pass?), Criterion B, Criterion C → Pass count
• FY-1: …
• FY0: …
• Summary conclusion: “Meets ≥2 of 3 criteria” for relevant years per SSM guidance (cite the directive name/date internally)

The objective is not to “win the exemption.” It is to reach a conclusion you can stand behind if questioned later.

How should you handle common real-world complications like groups, intercompany activity, and changes in financial year-end?

Most practical mistakes happen when the company is not a simple standalone trading entity.

If you are part of a group

At a high level, group structures introduce two risks:

• Data scope risk: the thresholds may apply based on the company’s own figures, or may require considering group-level realities depending on SSM’s definitions and the company’s reporting obligations.
• Expectation risk: even if you qualify legally, your group, lender, or investor may require audited numbers for consolidation or covenant compliance.

Implementation approach:

• Confirm whether the exemption test is applied on a company-only basis or has any group considerations under the current SSM guidance.
• Align early with your group finance team: if consolidation requires audited subsidiaries, plan accordingly.

If there is significant intercompany activity

Intercompany recharges can distort “revenue-like” lines.

Controls to add:

• Maintain a clear chart of accounts separating third-party revenue from intercompany recharges.
• Document transfer pricing / recharge logic (commercially and operationally), even if the audit exemption is available.

If you changed the financial year-end

A year-end change can create a short or long financial period.

Practical steps:

• Flag the change in your threshold test worksheet.
• Confirm whether you should annualise figures or use actual period figures—only according to current SSM guidance.
• Add a short memo explaining the approach and the rationale.

The goal is consistency and a clear audit trail, not complexity.

What internal documentation should directors keep to support an audit exemption decision?

Even though the point is to avoid an external audit, you still need internal discipline.

A good standard is: a third party should be able to understand your decision in 15 minutes.

Minimum “audit exemption file” (practical pack)

Keep a single folder (digital is fine) with:

1. Category determination: dormant / zero-revenue / threshold-qualified
2. SSM reference: copy or citation of the relevant SSM directive/guidance used (record the date/version)
3. Eligibility worksheet:

• dormant checklist and evidence OR
• zero-revenue memo and tie-outs OR
• three-year threshold test table with tie-outs

1. Directors’ note/minute approving the conclusion and acknowledging ongoing obligations
2. Financial reporting artefacts:

• draft/signed financial statements
• key reconciliations (bank, AR/AP, fixed assets)

Ownership and timing

Assign ownership so it doesn’t fall between functions:

• Finance manager / accountant: prepares the eligibility pack
• Company secretary / governance owner: ensures board documentation and lodgement workflow alignment
• Director: signs off the conclusion as part of year-end governance

Do this before the statutory filing cycle compresses your timeline.

If you are audit-exempt, what obligations under the Companies Act 2016 still remain (and how do you operationalise them)?

A frequent operational misconception is that audit exemption reduces the need for proper accounting and reporting. It does not.

Even when audit-exempt, companies generally still need to comply with ongoing CA 2016 obligations, including (at a practical level):

• keeping proper accounting records that explain transactions and financial position
• preparing financial statements in accordance with applicable standards
• ensuring directors’ duties around financial reporting and solvency are met
• meeting lodgement/filing requirements with SSM based on the company’s obligations and the applicable timelines

How to “run close” properly without an auditor

Without an external auditor forcing structure, build internal controls:

• Month-end closes (even a light version) to prevent year-end clean-up
• Standard reconciliations:
• bank reconciliations monthly
• AR/AP ageing review
• fixed asset register update
• tax and statutory payment tracking (where relevant)
• A year-end close checklist with sign-offs

Why this matters commercially

Audit exemption can reduce cost, but it can increase execution risk if discipline drops. Poor records can:

• slow down tax computations and submissions
• create director exposure if accounts are unreliable
• weaken your ability to respond to due diligence (buyers, investors, banks)

Treat audit exemption as a change in assurance method—not a licence to be informal.

How does the audit exemption decision affect cost, timelines, and external stakeholder expectations?

The exemption decision is not purely compliance-driven; it changes planning assumptions.

Cost and capacity planning

If exempt, you may save audit fees—but you may need to reallocate effort into:

• better bookkeeping and close processes
• internal review and governance documentation
• periodic advisory reviews (optional) to maintain reporting quality

If not exempt (or uncertain), you must plan:

• auditor appointment lead time
• audit fieldwork window
• readiness schedules and management responses

Timeline impacts

An audit often becomes the “critical path” for finalising financial statements. If exempt:

• you may close faster if your internal process is strong
• or you may close slower if there is no structured review discipline

Lenders, investors, and counterparties

Even if SSM exemption applies, external parties may still request audited financial statements:

• banks for facilities or covenant monitoring
• investors as part of reporting packs
• larger customers in onboarding or tender processes

A practical approach is to map stakeholders and requirements once a year:

• Who needs audited accounts?
• By when?
• Is a review engagement or agreed-upon procedures acceptable, or must it be a full audit?

This prevents a late-stage scramble when a financing opportunity appears.

Conclusion

Start from the statutory baseline: under the Companies Act 2016, a Malaysian private company generally must appoint auditors unless it qualifies under SSM’s audit exemption framework. Then run the workflow in order: (1) classify the exemption category—dormant, zero-revenue, or threshold-qualified, (2) if threshold-qualified, execute a three-year worksheet applying the “at least 2 of 3 criteria” logic using definitions and thresholds verified from the latest SSM practice directive/guidance, and (3) document the conclusion with clear tie-outs and a directors’ note. Finally, treat audit exemption as a planning choice, not a relaxation of discipline: proper records, financial statements, directors’ duties, and lodgement obligations still apply. If your team wants an implementation-ready template and a clean governance file, Paul Hype Page & Co. can support the eligibility testing workflow and year-end readiness without turning it into an over-legalised exercise.