Internal audit for Bursa Malaysia listed companies: what is required and what good looks like

Every company listed on Bursa Malaysia’s Main Market must have an internal audit function. Paragraph 15.27 of the Main Market Listing Requirements requires it to be independent of the activities it audits and to report directly to the audit committee. Bursa has publicly reprimanded listed companies for failing to meet this requirement, so it is not a formality.

Meeting the rule is the starting point. The more useful question for boards is whether internal audit is giving them real assurance on the risks that matter.

What the rules and the Code expect

• An internal audit function exists and is independent. Internal auditors should not audit work they are responsible for, and the function reports to the audit committee, not to management.
• The audit committee oversees it. Under the Malaysian Code on Corporate Governance, the audit committee should ensure that internal audit is effective and able to function independently.
• The board reports on it. The Code expects disclosure of whether internal audit staff are free from relationships or conflicts that could impair their objectivity, the number of resources, the name and qualifications of the person responsible, and whether internal audit follows a recognised framework.
• It supports the board’s statement on risk management and internal control in the annual report, together with the risk management framework.

Annual reports also show whether internal audit is carried out in-house or outsourced, and what it costs. Both models are common. Smaller listed companies often outsource the function, or co-source it with a small internal team.

In-house, outsourced or co-sourced?

In-house

Best where the business is large enough to keep a team busy all year. It builds deep knowledge of the business, but specialist skills, such as IT, fraud or ISO systems, are harder to keep in a small team.

Outsourced

A specialist firm runs the function under the audit committee’s direction. It brings independence, experience from other organisations and specialists when a review needs them, with a predictable cost.

Co-sourced

An internal head of audit keeps ownership, and an external firm supplies people or specialist skills for parts of the plan. This suits companies building their own capability.

Whatever the model, the audit committee remains responsible for the function’s independence, plan and quality.

What good internal audit looks like

• A risk-based plan. The plan follows the risk register and the board’s concerns, not last year’s list of audits. Higher-risk areas, such as procurement, revenue, IT, anti-bribery controls and major projects, are covered more often.
• A recognised framework. Most functions follow the Institute of Internal Auditors’ Global Internal Audit Standards, which took effect on 9 January 2025, and use COSO for internal control.
• Clear, rated findings. Each finding states the risk, the root cause, a rating and an agreed action with an owner and a date.
• Follow-up. Internal audit tracks agreed actions and reports overdue ones to the audit committee. A finding that is never closed has not reduced any risk.
• Regular quality review. The audit committee assesses the function’s performance each year, and an external quality assessment is carried out periodically.

Questions audit committees should ask

• Does the internal audit plan cover our principal risks, and which risks are not covered this year?
• Does internal audit have access to all records, people and sites it needs, and does the head of audit meet us without management present?
• How many agreed actions are overdue, and which ones carry high risk?
• Has internal audit reviewed our anti-bribery controls under section 17A of the MACC Act?
• Do the people doing the work have the skills the plan needs, including IT and fraud?

Common weaknesses

• A plan that repeats the same cycle every year regardless of how the risks have changed.
• Reports full of minor findings that bury the issues the board actually needs to hear.
• Internal audit doing management’s work, such as preparing procedures or approving transactions, which compromises its independence.
• Weak follow-up, so the same findings return year after year.

Next step

Whether you need a fully outsourced function, extra hands for a busy year or an independent review of your current internal audit arrangements, an experienced provider can help you meet the Listing Requirements and give the board assurance it can rely on.

This article is general information, not legal or professional advice. Requirements can change; check the current law and guidance, or speak to us about your circumstances.