Audit checklist: what auditors and LHDN ask for

Audit season at a Malaysian accounting firm has a familiar shape. The auditor’s request list arrives. Half the items are easy: the trial balance, the bank statements. The other half send someone into the client’s boxes looking for one supplier invoice from March, a hire purchase agreement nobody can find, and the receipts behind a string of card payments.

Then, once in a while, a letter from LHDN arrives asking for documents for a tax audit, with a deadline measured in days.

Two different audits under two different laws, but the same question: can the client produce the document behind the number? Here is who needs which audit, what each asks for, and how to be ready.

Two different audits

The statutory audit is required by the Companies Act 2016. Section 267(1) says every private company must appoint an auditor for each financial year, unless it is exempt. The auditor reports to the members on the financial statements and, under section 266, must form an opinion on whether proper accounting records have been kept. The auditor has a right of access to those records at all reasonable times.

The tax audit is done by LHDN under the self-assessment system. LHDN’s current Tax Audit Framework on Income Tax and Employer, effective 15 March 2025 (in Bahasa Malaysia, listed on LHDN’s frameworks page), describes two kinds: a desk audit done at LHDN’s office by letter and email, and a field audit that includes an interview and can include a visit to the business premises.

Which companies still need a statutory audit

Since 1 January 2025 the audit exemption for private companies follows SSM’s Practice Directive 10/2024. A private company qualifies if it meets at least two of three tests, in the current financial year and in each of the two years before it: revenue, total assets and number of full-time employees. The limits rise in three phases:

Financial period starting	Revenue up to	Total assets up to	Employees up to
1 Jan 2025 to 31 Dec 2025	RM1,000,000	RM1,000,000	10
1 Jan 2026 to 31 Dec 2026	RM2,000,000	RM2,000,000	20
On or after 1 Jan 2027	RM3,000,000	RM3,000,000	30

Dormant companies remain exempt. The exemption does not apply to public companies, subsidiaries of public companies, foreign companies, or exempt private companies that have lodged the certificate under section 260.

Points worth telling clients:

• Members can still ask for an audit. Members holding at least 5% of the voting shares, or at least 5% of the members, can require one by written notice no later than one month before the financial year ends. So can the Registrar.
• Exempt does not mean no accounts. The company still lodges unaudited financial statements prepared under MPERS, with the directors’ report and a director’s certificate.
• Some agencies still want audited accounts. SSM notes that requirements for licensing, grants and loans can still call for an audit.
• The record-keeping duty does not change, and neither does LHDN’s power to audit. See SSM’s audit exemption page for the FAQs.

Records every company must keep

Section 245 of the Companies Act 2016 applies whether a company is audited or not. The company must keep accounting and other records that sufficiently explain its transactions and financial position, kept so they can be “conveniently and properly audited”. Entries must be made within 60 days of each transaction, and the records kept for seven years after the transactions are completed. Breaking section 245 is an offence, with a fine of up to RM500,000, imprisonment of up to three years, or both.

The tax side asks for the same 7 years. See how long to keep receipts in Malaysia.

What the statutory auditor usually asks for

Every audit firm has its own list, but most requests cover these:

1. Trial balance, general ledger and draft financial statements
2. Bank statements for every account for the full year, and the year-end bank reconciliations
3. Sales invoices and credit notes, and an aged list of debtors
4. Purchase invoices, supplier statements and an aged list of creditors
5. Receipts and payment vouchers behind expense lines
6. Fixed asset register, with invoices for additions and documents for disposals
7. Stock count sheets and stock valuation at year end
8. Loan and hire purchase agreements, and the lender’s statements
9. Payroll records and proof of EPF, SOCSO, EIS and PCB payments
10. Tax computation, Form C and CP204 estimates, and SST returns if registered
11. Agreements (tenancy, major contracts), directors’ resolutions and minutes

Items 2, 4 and 5 are where the time goes: the documents behind the bank lines. Our bank reconciliation guide shows how to find the gaps before the auditor does.

What LHDN asks for in a tax audit

From the 2025 framework:

• 14 days to respond. LHDN sends a letter asking for documents and information, and the taxpayer has 14 calendar days from the date of the letter to reply. If documents are not produced in time, expense claims can be disallowed and an additional assessment raised.
• Field audit visits. A notice goes out at least 14 days before a visit, listing the records to prepare, the years of assessment covered and the officers’ names. A visit normally takes one to three days, and can run longer depending on the size of the business, the form the records are kept in, and how cooperative the taxpayer is.
• What officers can examine. Financial records; stock records; ledgers, payment vouchers and bank statements; payroll records, Form E, CP8D and PCB; business assets; and any other relevant documents. Records kept electronically can be accessed and downloaded.
• How far back. An audit usually covers up to three years of assessment, within the five-year time limit under section 91(1) of the Income Tax Act. The limit does not apply where there is fraud, wilful default or negligence.
• Sole proprietors and partnerships. If business records are incomplete, the audit can extend to personal records such as private bank statements.

Fourteen days is not long if the receipts for one year of assessment are in a carton at the client’s shop. See how to find a document when LHDN asks.

Make every client year audit-ready

1. Reconcile every bank account monthly, so a line with no document becomes a question for the client that month, not at audit time.
2. Give every document a digital copy the day it arrives, searchable by vendor, date and amount.
3. Keep the paper originals as the rules ask. See do you still need to glue receipts on A4.
4. Close each year with one file: trial balance, bank reconciliations, aged debtors and creditors, fixed asset register.
5. Diarise the Companies Act dates: financial statements circulated within six months of year end (section 258), and lodged with SSM within 30 days of circulation (section 259).

Where AccPilot fits

AccPilot takes the document half of audit preparation off your staff. Clients send receipts, invoices and bank statements by upload, phone, email or your client link. AccPilot reads each one, matches statement lines to documents, and lists the lines with no document as a chase list for the client. Your staff export one clean Excel into your accounting software, and every document stays searchable by vendor, date and amount for 7 years. When the auditor or LHDN asks for one invoice, it is a search, not a trip to the storeroom.

What stays with your firm is the judgement: what the auditor needs, how a transaction should be treated, and what to tell LHDN.

To see it on your own clients’ documents, book a free demo.