Compliance Audit Malaysia: How to Check Your Sdn Bhd Before SSM Does

Most SME owners only discover a compliance problem when a letter arrives. A compound notice from SSM. A query from LHDN. A bank asking why your company details do not match the register.

By then, the fix is usually slower and more expensive than it needed to be.

A compliance audit is how you find those gaps first. It is a structured review of whether your Sdn Bhd is meeting its obligations under the Companies Act 2016, tax law and related regulations. It is not about catching anyone out. It is about knowing where you stand.

This matters more than ever. SSM’s own figures for 2025 show it ran beneficial ownership data checks on 691,690 companies and issued 4,078 notices involving 46,016 companies. Regulators are actively looking. This guide shows you what a compliance audit in Malaysia covers, how to run a basic one yourself, and where SMEs most often fall short.

What Is a Compliance Audit (and What It Is Not)?

The word “audit” confuses many business owners, so let us clear it up.

Statutory (financial) auditCompliance audit
PurposeGives an opinion on whether your financial statements are true and fairChecks whether your company is meeting its legal and regulatory obligations
Who does itA licensed external auditorYour company secretary, compliance adviser or internal team
Required by law?Yes, unless your company qualifies for audit exemptionNot a legal requirement in itself, but it protects you from breaches that are
FocusNumbersFilings, records, registers, deadlines and governance

In short, a statutory audit looks at your accounts. A compliance audit looks at everything around them: whether your annual return was lodged on time, whether your registers are up to date, whether your beneficial owners are declared correctly, and whether your tax filings are in order.

A quick note on audit exemption

Under SSM’s Practice Directive No. 10/2024, the audit exemption thresholds for private companies are being raised in phases. For financial periods starting in 2026, a company qualifies if it meets any two of these: revenue not exceeding RM2 million, total assets not exceeding RM2 million, and no more than 20 full-time employees. The threshold rises to RM3 million, RM3 million and 30 employees for periods starting on or after 1 January 2027, and the criteria must be met for the current and two preceding financial years.

Audit exemption reduces your cost, but it does not reduce your compliance obligations. You still need to prepare financial statements, file your annual return and keep your records in order. That is exactly why a compliance audit is useful for exempt companies too.

Why a Compliance Audit Matters for SMEs

Here is what is at stake if obligations slip:

  • Annual return: Must be lodged within 30 days of your company’s incorporation anniversary. Failure is an offence for the company and every officer in default, with a fine of up to RM50,000 and a further RM1,000 for each day the offence continues after conviction.
  • Strike-off risk: SSM may strike off a company that fails to lodge annual returns for three or more consecutive years.
  • False information: Knowingly lodging false or misleading information can lead to up to 10 years’ imprisonment, a fine of up to RM3 million, or both under Section 591 of the Companies Act 2016.
  • Banking and business impact: Outdated records can delay bank account reviews, loan applications, licence renewals and tender submissions.

The financial penalty is often the smaller problem. The bigger cost is the disruption when something you thought was handled turns out not to be.

Your Compliance Audit Checklist for a Malaysian Sdn Bhd

Use this checklist as a starting point. If you cannot confidently tick an item, mark it for follow-up.

1. Company officers and structure

  • At least one director ordinarily resides in Malaysia
  • A company secretary is appointed, licensed by or registered with SSM, and holds a valid practising certificate
  • Director and secretary details lodged with SSM match reality (addresses, IC or passport details, appointment dates)
  • Every director genuinely knows and participates in the business

SSM is paying closer attention to “paper directors” as part of its push against corporate mules. Read more in our guide on why a licensed company secretary is your first defence against corporate mule risk.

2. Statutory registers and records

  • Register of members is up to date, including every share transfer and allotment
  • Register of directors, managers and secretaries is current
  • Register of beneficial owners is maintained and matches what has been lodged with SSM
  • Minutes of directors’ and members’ meetings, and written resolutions, are properly kept
  • Records are kept at the registered office or another place notified to SSM

3. Beneficial ownership

Since 1 April 2024, companies must identify their beneficial owners, keep a register and lodge the information with SSM. Any change must be lodged within 14 days of the change.

  • Beneficial owners are correctly identified, not just the shareholders on paper
  • Information has been lodged with SSM through the e-BOS system
  • Changes (for example, after a share transfer) were lodged on time

Our beneficial ownership reporting guide explains how to identify who counts as a beneficial owner.

4. SSM annual filings

  • Annual return lodged within 30 days of each incorporation anniversary
  • Financial statements circulated to members within six months of the financial year end
  • Financial statements lodged with SSM within 30 days of circulation, in the correct MBRS format
  • No outstanding compounds or notices

Not sure of the difference between these filings? See annual return vs annual report and our SSM annual return guide.

5. Tax and LHDN obligations

  • Form C submitted within seven months of the financial year end
  • CP204 tax estimates submitted and instalments paid on time
  • Form E submitted by 31 March each year if you have employees
  • e-Invoice obligations understood and implemented for your company’s phase
  • Payroll deductions (PCB, EPF, SOCSO, EIS) paid on time

The tax side usually sits with your accountant or tax agent, not your company secretary. Our guide on who does what between a company secretary, accountant and tax agent helps you check nothing falls between the cracks.

6. Business activity and licences

  • MSIC code and business nature registered with SSM reflect what the company actually does
  • Required business licences (local council, industry-specific) are valid and renewed
  • Signboard and company documents display the correct company name and registration number

Common Mistakes SMEs Make

Assuming the accountant handles everything.
Your accountant prepares the accounts and tax filings. Your company secretary handles SSM records and filings. When nobody owns the full picture, gaps appear.

Forgetting to update SSM after internal changes.
A director resigns, shares are transferred or the office moves, but SSM is never told. Your public record is now wrong, and so may be your beneficial ownership information.

Treating a dormant company as “nothing to do”.
Dormant companies still need to lodge annual returns and financial statements. Read our guide on dormant company obligations.

Signing forms without checking the details.
Directors are responsible for what is lodged under their name. “My secretary prepared it” is not a defence for inaccurate information.

Reviewing compliance only when something goes wrong.
By the time a notice arrives, you are reacting on SSM’s timeline instead of your own.

How Often Should You Run a Compliance Audit?

A practical rhythm for most SMEs:

  • Annually: A full review, ideally a few months before your financial year end, so there is time to fix issues before filing season
  • After any major change: New directors or shareholders, share transfers, a change of business activity, or a new investor coming in
  • Before key events: A bank loan application, a government tender, due diligence by a buyer or investor, or a change of company secretary

If you are switching providers, a compliance review at handover is essential. See our guide on changing company secretary in Malaysia.

DIY or Professional Compliance Audit?

You can work through the checklist above yourself, and it is a good habit. But a professional review adds what a self-check usually cannot:

  • Access to your SSM records to compare what was actually lodged against what you think was lodged
  • Knowledge of current SSM practice directives and enforcement priorities
  • Proper rectification if something is missing, including late filings and register updates
  • A clear action list with deadlines, so issues do not drift

This is where a company secretary earns their place. At iComSec, a compliance review is part of how we onboard and support clients, so problems are found and fixed before regulators find them.

Frequently Asked Questions

Is a compliance audit mandatory in Malaysia?

No law requires a standalone “compliance audit” for private companies. However, the obligations it checks, such as annual returns, financial statements, beneficial ownership and tax filings, are all mandatory. A compliance audit is the practical way to confirm you are meeting them.

What is the difference between a compliance audit and a statutory audit?

A statutory audit is an independent opinion on your financial statements by a licensed auditor. A compliance audit reviews whether your company is meeting its legal filing, record-keeping and governance obligations.

What happens if my company misses the annual return deadline?

The company and its officers commit an offence and can be fined up to RM50,000, plus up to RM1,000 per day if the offence continues after conviction. Repeated failure over three or more years can lead to the company being struck off.

Does an audit-exempt company still need a compliance review?

Yes. Audit exemption only removes the need for audited financial statements. You still need to prepare and lodge financial statements, file annual returns and keep statutory registers and beneficial ownership information up to date.

How long does a compliance audit take?

For a typical SME with organised records, a review can be completed within a few working days. It takes longer if records are incomplete or filings need to be rectified.

Conclusion: Find the Gaps Before SSM Does

A compliance audit in Malaysia is one of the simplest ways to protect your Sdn Bhd from fines, strike-off risk and awkward questions from banks or investors. With SSM actively checking company records and beneficial ownership information, waiting for a notice is no longer a sensible strategy.

You do not need to become a compliance expert. You need a clear picture of where your company stands and someone accountable for keeping it that way.

iComSec’s licensed company secretaries review your SSM records, registers and filing history, flag what needs attention and handle the rectification for you.

Want to know if your Sdn Bhd is fully compliant? Contact iComSec for a compliance review, or explore our company secretary services and accounting services.

Related Reading