Key Takeaways
- A tax audit is a records check to confirm your reported tax matches your documents. Being selected does not mean you committed an offence.
- The Tax Audit Framework on Income Tax and Employer, effective 15 March 2025, governs desk audits, field audits and employer audits in one document.
- You typically have 14 calendar days to submit requested documents, and most audits conclude within about three months.
- LHDN usually reviews up to 3 years of assessment, can extend to 5, and faces no time limit where fraud, wilful default or negligence is involved.
- Audit penalties run at 15%, 30% or 45% of undercharged tax by offence count, and 100% for intentionally incorrect returns.
A tax audit in Malaysia starts the same way for almost everyone: an official letter, a tight deadline and a knot in the stomach. The letter feels like an accusation. It is not. An audit is a structured records check with published rules, fixed timelines and clearly defined rights on both sides. This guide walks you through the entire process under LHDN's current framework, from the first letter to settlement, so you know exactly what happens next and what to prepare. And if you would rather have specialists manage it from day one, SSAM's tax audit services in Kuala Lumpur exist for exactly this situation.
What Is a Tax Audit in Malaysia?
A tax audit in Malaysia is an examination of your business accounts and financial records by LHDN to confirm that the tax you reported and paid is correct under the law. Under the self-assessment system, audits are LHDN's main compliance activity, and being selected does not mean you have committed an offence.
That last point comes straight from LHDN's own framework and deserves repeating, because the fear of the letter causes more damage than the audit itself. Panic leads to missed deadlines, incomplete submissions and avoidable penalties. Understanding the process removes most of that fear.
Desk Audit vs Field Audit: The Two Formats
LHDN runs audits in two formats under the Tax Audit Framework on Income Tax and Employer, effective 15 March 2025, which consolidated the previous separate frameworks into a single document:
- Desk audit. Conducted at LHDN's office. You submit documents by the deadline and the officer reviews them remotely. Most straightforward cases take this route, described in the framework as a General Review.
- Field audit. Conducted at your business premises, typically lasting one to three days. The officer examines records, verifies assets and interviews relevant staff. Complex cases receive this Comprehensive Review treatment.
Employer obligations such as Form E, PCB deductions and employee records fall under the same framework through the employer audit stream.
How Does LHDN Pick Businesses for Audit?
Selection is data-driven, not random. Under section 5.0 of the framework, cases are chosen through computerised risk analysis based on criteria including:
- Information received from third parties such as banks, suppliers and other government agencies.
- Risk profile analysis of your returns over time.
- Focus on specific industries, taxpayer groups or locations.
- e-Invoice data matching, which now cross-checks what you report against what your customers and suppliers report.
The old belief that a small company flies under the radar no longer holds. e-Invoice data gives LHDN transaction-level visibility across businesses of every size, and mismatches surface automatically. The full list of warning signs is covered in our breakdown of LHDN tax audit triggers.
The Tax Audit Timeline From Letter to Settlement
A typical audit follows five stages:
- Notification. LHDN issues an audit letter stating the years under review and the documents required.
- Document submission. You generally have 14 calendar days to submit the requested records.
- Review. The officer examines your submission. The whole review can take up to about three months, and LHDN notifies you if a complex case needs longer. Field visits, where required, usually last one to three days.
- Findings. LHDN issues its audit findings. If you disagree, you can respond with supporting evidence within the window stated in the letter, typically 18 days.
- Settlement. Additional assessments and penalties are finalised, with payment arrangements available. If you still disagree, a formal appeal route exists, explained in our guide on how to appeal an LHDN tax assessment.
If a letter has already arrived and you want a response plan for it, our companion piece on the LHDN tax audit process covers your rights and how to respond step by step.
How Far Back Can LHDN Go?
Most audits cover up to three years of assessment. The law allows LHDN to extend coverage to five years under subsection 91(1) of the Income Tax Act 1967, and there is no time limit at all where fraud, wilful default or negligence is involved. Employer audits typically cover up to two years of remuneration, though offences under Section 83 can be pursued up to twelve years from the year they were committed.
This is why record keeping matters more than any other habit. Section 82A requires business records to be kept for seven years, and our guide to LHDN's 7-year lookback shows a simple retention system that keeps you covered.
Genuine Audit Letter or Scam? Verify First
Before responding to anything, confirm the letter is real. Scammers imitate LHDN letters and phone calls precisely because audit fear makes people act quickly. Genuine correspondence can be verified through official channels: your MyTax account, the LHDN hotline and branch offices. Never pay anyone based on a phone call, and never share banking credentials to "cancel" an audit.
Our dedicated guide on how to tell whether an LHDN letter is genuine or a scam walks through the verification steps and the tell-tale signs of fraud before you respond to any deadline.
Can LHDN See Your Bank Account?
A persistent myth deserves a straight answer. LHDN does not have standing, unrestricted access to your bank account. Direct access to bank information under Section 106A of the Income Tax Act applies to garnishee proceedings, which are debt-recovery situations after tax is already owed. What auditors can do is request your bank statements as part of the documents you must submit, and they can obtain third-party information from financial institutions through lawful channels.
The practical conclusion is the same either way. Keep business banking clean and separate from personal accounts, because mixed accounts are one of the fastest ways to turn a routine review into a long one.
Penalties When an Audit Finds Errors
Where an audit uncovers understated income or overclaimed expenses, penalties apply under subsection 113(2) of the Income Tax Act:
| Finding | Penalty rate |
|---|---|
| First offence | 15% of undercharged tax |
| Second offence | 30% of undercharged tax |
| Third and subsequent offences | 45% of undercharged tax |
| Intentionally incorrect return | 100% of undercharged tax |
| Technical adjustment | 0% |
The Director General may reduce or eliminate penalties under subsection 124(3), and cooperation matters to that discretion. Record-keeping failures carry their own consequences: a fine of RM300 to RM10,000, imprisonment of up to one year, or both, under Section 119A. For the full breakdown of rates and reduction strategies, read our guide to LHDN tax audit penalties.
How to Be Audit-Ready All Year Round
Audit readiness is cheaper than audit response. Five habits cover most of the ground:
- Keep seven years of records, organised. Financial statements, ledgers, invoices, agreements and bank statements, retrievable within days rather than weeks.
- Keep e-Invoice data consistent. What you issue, what you receive and what you file must tell one story.
- Separate business and personal banking. Every business ringgit should flow through a business account.
- Fix known problems before LHDN finds them. A voluntary disclosure to LHDN before an audit starts attracts materially lower penalties than an audit finding.
- Know when to bring in a professional. A licensed tax agent can manage correspondence, deadlines and negotiations, and understanding the difference between a tax audit and a tax investigation tells you when the stakes have changed.
If you would rather have specialists watching this for you, SSAM handles tax audits for individuals and companies as a MOF licensed tax agent with 40 years of experience and more than 1,000 clients. Speak to SSAM or WhatsApp the team before the next deadline on your letter.
Frequently Asked Questions About Tax Audits in Malaysia
Does being selected for a tax audit mean I did something wrong?
No. LHDN's own framework states that selection does not mean an offence was committed. Audits are the routine compliance mechanism of the self-assessment system, and many end with no adjustment at all.
How long does a tax audit take in Malaysia?
Most audits conclude within about three months of the document submission. Field visits usually last one to three days, and LHDN notifies you if a complex case needs more time.
How many years can LHDN audit?
Usually up to three years of assessment, extendable to five under subsection 91(1). There is no time limit where fraud, wilful default or negligence is involved, which is why the seven-year record-keeping duty matters.
What documents does LHDN usually request?
Financial statements, general ledgers, bank statements, sales and purchase invoices, agreements and supporting schedules for the years under review. Submissions are generally due within 14 calendar days of the request.
Can I negotiate audit penalties?
Penalty rates follow the published tiers, but the Director General has discretion under subsection 124(3) to reduce or eliminate penalties. Cooperation, complete records and early disclosure all strengthen your position.
Data Sources / References
- LHDN, Tax Audit Framework on Income Tax and Employer (15 March 2025): https://www.hasil.gov.my/media/wgpombsp/20250315_tax-audit-framework-on-income-tax-and-employer.pdf
- LHDN, Tax Audit Frameworks: https://www.hasil.gov.my/en/legislation/framework/
- PwC, Stay audit-ready: A guide to tax audits in Malaysia: https://www.pwc.com/my/en/perspective/tax/231027-stay-audit-ready-tax-guide.html
The information in this article is provided for general informational purposes only and does not constitute tax, accounting, financial or legal advice. Tax laws change frequently and may not apply to your situation. Always consult a qualified professional before acting on any information here.
