SSM Audit Exemption 2025 to 2027: What It Means When Your Customer Stops Filing Audited Accounts

You went to buy your customer's latest accounts and found unaudited ones. Or nothing recent at all.

Nothing has gone wrong. Malaysia is partway through a three year widening of audit exemption for small private companies, and it works on a published schedule that gets more generous each phase until 2027. Your visibility into your customers' finances is degrading on a timetable, whether or not their businesses are.

Every accounting firm in the country has written about this for the company preparing the accounts. This is written for the person on the other side of the invoice, who relied on reading them.

What changed, and when

The instrument is SSM Practice Directive No. 10/2024, dated 16 December 2024, which sets the qualifying criteria for audit exemption for certain private companies in Malaysia.

It states that it applies to financial statements with annual periods commencing on or after 1 January 2025. Note the wording: it runs off the date a financial year begins. A company with a June year end sits in whichever phase its financial year start falls into, which is not always the phase you would guess from the calendar.

The thresholds, phase by phase

A private company qualifies if it meets at least two of the three criteria. Not all three, and not turnover alone.

Phase	Financial year commencing	Turnover	Total assets	Employees
Phase 1	2025	RM1,000,000	RM1,000,000	10
Phase 2	2026	RM2,000,000	RM2,000,000	20
Phase 3	2027 onward	RM3,000,000	RM3,000,000	30

Phase 3 is the steady state from 2027 onward, not a one year band. Unless the directive is revised, a company whose turnover does not exceed RM3 million and whose headcount is not more than 30 is outside audit indefinitely.

Look at what that covers in practice. A RM2.8 million turnover subcontractor with 25 people, a small parts supplier, a plant hire outfit, a specialist installer: these are exactly the counterparties whose finances you most want to see and whose accounts will stop being audited.

The part almost everyone gets wrong

The three year element is a lookback, not a test applied separately in each of three years.

The company must satisfy the qualifying criteria in the current financial year and in the two immediately preceding financial years. The test is conjunctive, so all three years have to pass.

The asymmetry runs one way only, and it is worth getting the direction right. Growing out of the thresholds ends the exemption straight away, because the current year fails and prior small years cannot rescue it.

What the lookback delays is entry into exemption. A company that has just shrunk below the thresholds still has two larger years behind it, so it keeps filing audited accounts for a while.

For you, that means a set of unaudited accounts is a reasonably current signal that the company is small, and a set of audited accounts is not a reliable signal that it still is.

What an exempt company still has to file

Here is the good news, and it is better news than most suppliers realise.

The exemption removes the audit. It does not remove the filing.

A company that elects audit exemption must still lodge its unaudited financial statements with the Registrar, accompanied by the required certificate, in compliance with sections 258 and 259 of the Companies Act 2016. The directors' report, statement by directors and statutory declaration required under sections 251 and 252 still apply, and the annual return obligation is untouched.

So the financial statements are still there, and you can still buy them through SSM e-Info. The financial information is a separate purchase from the Company Profile, sold as a Financial Comparison over a choice of periods.

They simply have not been audited, and they carry a certificate that an audited set does not.

The right adjustment is not to give up on filed accounts. It is to stop treating them as independently verified, and to weight them accordingly against the other things you can ask for.

How out of date filed accounts can legally be

This is the number almost nobody states, and it changes how you read every set of accounts you buy.

Work the statutory clock through, using SSM's Practice Note 3/2018:

Step	Provision	Time allowed	Running total from year end
Circulate financial statements to members	Section 258(1)(a)	6 months from financial year end	6 months
Lodge with the Registrar	Section 259(1)(a)	30 days from circulation	About 7 months
You buy the document some time after that	Not regulated	Whenever you happen to look	7 months at best, about 19 at worst, longer with an extension

Both bounds are worth stating properly, because the range is wide. On the day a set is lodged it describes a period that ended about seven months earlier. The day before the next set falls due, the most recent available accounts are roughly nineteen months past their year end.

An extension of time is available on application under section 259(2), which stretches the ceiling further.

Say it plainly to yourself the next time you are looking at a set of filed accounts. The most recent accounts legally available for a Malaysian private company can describe a period that ended around nineteen months ago, and the company is fully compliant.

A business can go from healthy to insolvent inside that window without a single filing changing.

That was true before audit exemption. Audit exemption does not make it worse. What it does is remove the one feature of those stale accounts that gave them independent credibility, which means the staleness now matters more than it used to.

What to ask for instead

When audited accounts are not available, you replace one strong signal with several weaker ones that are more current. That trade is usually favourable, because currency beats assurance when you are deciding whether to ship next week.

What to ask for	What it proves	How hard it is to dress up	How current it is
Management accounts	The shape of the current year	Easy	Very
3 months of bank statements	That money is actually moving	Hard	Very
Trade references you call	How they treat suppliers under pressure	Hard, if you ask the right question	Current
A director's guarantee	That somebody will stand behind the account, to whatever extent its own wording allows	Not applicable	Current when signed. The exposure it covers is not
A deposit or security	Nothing, and that is the point	Not applicable	Immediate

Management accounts

Unaudited and unverified, but recent. Ask for the last two quarters and compare them against the filed set. Divergence you cannot explain is the finding, not the numbers themselves.

Three months of bank statements

Harder to dress up than a management pack, and they show you whether money is actually moving. Look at the pattern of receipts rather than the closing balance.

Trade references you actually call

The single highest yield item on this list, and the one most often collected and never used. Ask the referee how long the account has run, what the terms are, and whether they have ever been paid late. The third question is the one that produces the useful answer.

A director's guarantee

Worth having, and worth understanding before you rely on it. Under the Contracts Act 1950 a guarantee can be given orally, which surprises people, and the sections dealing with variance and with giving time to the principal debtor mean that a guarantee is not automatically unaffected by what you later agree with the customer. Read the document you are holding before you agree a payment plan on the strength of it.

A deposit, or security

The most honest answer when nothing else is verifiable. It reprices the risk instead of pretending to assess it.

Reading a set you cannot rely on

Unaudited accounts still tell you things, as long as you read them as a management representation rather than a verified statement. Look for the movements, not the levels.

What you see in the filed accounts	Possible innocent explanation	What to ask
Turnover fell sharply	One large contract completed and was not replaced yet	What is in the order book now
Trade payables grew faster than turnover	Stretching suppliers to fund growth	Who is being paid late, and by how long
Directors' loans moved significantly	Tax planning, or funding the business personally	Whether the loan is repayable on demand
Cash fell and borrowings rose	Equipment bought outright	What the borrowing was for and when it amortises
Accounts are unaudited for the first time	The company simply qualified for exemption	Nothing. Adjust the weight you give them instead

A published benchmark

If you want to know what a well run credit function actually demands, Kuantan Port publishes its new account application form.

It asks for a CTOS consent form, the last two years of audited accounts, the latest three months of bank statements, certified copies of the statutory filings and the directors' identification, and a RM5,000 application deposit payable by transfer or banker's cheque. Separately, it requires a security deposit sized to the expected monthly transaction value, satisfied by either cash or an acceptable banker's guarantee valid for at least a year.

Notice the tension. The audited accounts line is exactly the requirement that audit exemption is making unanswerable for the smaller customers, so that part of the form will age badly.

Two things are worth borrowing anyway. The deposit and the security are distinct requirements doing different jobs, and the security scales with exposure rather than being a flat number. Most supplier credit forms do neither.

FAQ

Does audit exemption mean my customer no longer files accounts?

No. An audit exempt company still lodges unaudited financial statements with SSM, with an additional certificate, plus the directors' report, statement by directors and statutory declaration. You can still buy them.

How do I tell whether the accounts I bought were audited?

An audited set carries an auditor's report. An exempt set carries the certificate required by the practice directive instead. If you are unsure, the presence or absence of an audit opinion is the giveaway.

My customer is above the thresholds. Why can I still not find recent accounts?

Most likely timing rather than exemption. Six months to circulate plus thirty days to lodge means the current year's figures are not due yet, and an extension under section 259(2) can push it further. Check the lodgement date on the last filed set before concluding anything.

Will the thresholds keep rising after 2027?

The directive sets Phase 3 as applying from 2027 onward, with no further step published. Anything beyond that would require SSM to issue a revised directive, so treat RM3 million and 30 employees as the standing position and re-check before relying on it in a later year.

Is an unaudited set of accounts worthless for credit purposes?

No, but it changes what the document is. It is now a management representation lodged with a regulator rather than an independently examined statement. Use it for direction of travel and for gross implausibility, and get your assurance from bank statements and trade references instead.

Foundation Conclusion

Audit exemption widens every phase to 2027 on a published schedule, so your visibility into a customer's finances degrades whether or not their business does.

Filed accounts were already up to nineteen months old. Losing the audit removes the one feature that made them independently credible, which pushes the weight onto the contract and the cover behind it.

Foundation is a specialist property and engineering insurance intermediary. We help operators insure the risks that compliance is designed to manage.

Talk to our risk specialists about contract and site risk on your next job

Reading a counterparty's accounts is one control. It sits alongside verifying who they say they are, checking whether a bank already ranks ahead of you, and structuring the contract so that a failure is survivable.

Our guide to letters of guarantee covers the instrument side, and what bond underwriters check shows you the same financial assessment run from the other direction. For contractors verifying a party downstream rather than upstream, see subcontractor insurance verification and the CIDB registration check.

Losing the audit does not change what insurance does. It changes how much weight the contract has to carry, and that weight sits in the retention, the bond and the security you agreed at the start.

The policies that answer physical loss on a live project are CAR and EAR, and professional indemnity and SPPI where design or advice is in scope. Neither responds to a customer who cannot pay, and it is worth being blunt about that before a renewal conversation rather than after a bad debt.

Disclaimer: This article provides general guidance based on SSM Practice Directive 10/2024, the Companies Act 2016, the Contracts Act 1950 and insurance coverage available in the Malaysian market as of September 2026. Regulations may be amended and policy terms vary by insurer. Always verify requirements with SSM, or consult qualified professionals, before making decisions.