The Protecon Gap Between Statutory and Internal Auditors: A Crical Analysis of Malaysian Law

I. Introduction

An auditor’s signature carries significant meaning. Auditors are expected to report financial misconduct, identify weaknesses in internal controls and expose fraudulent activity that an outsider would never uncover. With that responsibility come serious consequences. Where auditors fail to detect material misstatements, they may face legal repercussions, including potential lawsuits for breach of professional duty, because their failure can cause financial loss to stakeholders and damage the credibility of the auditing profession. A question arises, however, if we reverse the narrative: what happens when an auditor does exactly what the law expects of them?

What happens when an auditor uncovers serious financial misconduct committed by the very management or organisation that employs them? This question is particularly troubling for internal auditors. Unlike statutory auditors, who operate independently from outside the organisation, internal auditors are employees whose careers, financial security and professional future may depend on the same management they are required to report on. And if their own warnings and recommendations to prevent further misconduct are ignored, would they in fact be protected under the existing statutory framework should they decide to escalate the matter to a higher committee or to the relevant authorities, as they are obliged to do?

This article argues that Malaysian law provides protections to statutory auditors in order to secure their independence, but that internal auditors, despite their essential role in governance, remain inadequately protected. Reforms in legislation and corporate governance are therefore needed to provide stronger protection from retaliation and to ensure that internal auditors can perform their functions independently. Section II outlines the current legal framework. Section III analyses the protection gap arising from it. Section IV concludes and sets out the direction that reform should take.

II. The Current Legal Framework

A. Statutory Auditors

Statutory auditors in Malaysia are governed principally by the Companies Act 2016, which establishes the requirement for companies to appoint independent auditors to examine their financial statements. Under the Act, appointed auditors are required to provide an unbiased and impartial opinion on the company’s financial position for the benefit of shareholders, investors and regulatory authorities. The role of the statutory auditor has traditionally been understood as serving the interests of shareholders by providing an independent assessment of the company’s financial position.¹ The Act also establishes requirements relating to the appointment, removal and rights of auditors, which together operate to prevent undue influence from the company’s management.

Section 266 of the Companies Act 2016² sets out the powers and duties of auditors. Where an auditor, in the course of performing his duties as auditor of a company, discovers a breach of any provision of the Act that has not been or will not be adequately dealt with, or forms the opinion that a serious offence involving fraud or dishonesty is being committed against the company or under the Act by an officer of the company, it is the auditor’s statutory duty to report the matter to the Registrar.

Furthermore, under sections 276 to 278,³ an auditor cannot be removed at the discretion of the company’s management. Removal must instead be approved by the members through an ordinary resolution passed at a general meeting, and must comply with the special notice procedure. The auditor must be given notice of the proposed removal and is entitled to make written representations in respect of it and to communicate with the company’s members. This procedure secures auditor independence by preventing summary removal without notice, particularly where the auditor’s findings may implicate the company’s management in a manner relevant to the shareholders.

B. Internal Auditors

Unlike statutory auditors, who operate as external professionals, internal auditors in Malaysia form part of the organisation’s internal structure and are not governed by a specific statutory framework establishing their powers, duties and protections. Their role is shaped instead by corporate governance frameworks, including the Malaysian Code on Corporate Governance 2021 (“MCCG”), the Bursa Malaysia Listing Requirements and the internal policies adopted by individual companies.

The MCCG recommends that listed companies establish an internal audit function to provide independent assurance on the adequacy and effectiveness of the company’s internal control and risk management systems. The Bursa Malaysia Listing Requirements similarly require listed companies to establish an internal audit function reporting to the audit committee, which is responsible for reviewing that adequacy and effectiveness, maintaining standards of corporate governance and identifying potential risks or misconduct within the organisation.

However, unlike the independent statutory auditor, the internal auditor remains subject to the organisation’s employment structure. Appointment, remuneration, career progression and disciplinary matters all remain connected to the very organisation being audited. Although corporate governance frameworks encourage independence, they do not confer statutory rights equivalent to those enjoyed by statutory auditors, and this is felt most acutely where internal auditors are expected to report fraud, governance failures and weaknesses in internal control. Protection may instead arise through other legal avenues, such as employment law or the Whistleblower Protection Act 2010, but only where the relevant statutory requirements are satisfied. Those requirements are not trivial: protection under the Whistleblower Protection Act 2010 generally depends on the disclosure being made to an enforcement agency, which sits uneasily with a governance framework that directs internal auditors to escalate their concerns internally in the first instance.

C. The Audit Committee

Under the MCCG and the Bursa Malaysia Listing Requirements, the audit committee is responsible for reviewing audit findings, monitoring management’s responses and ensuring that appropriate action is taken. Internal auditors may communicate concerns to this committee independently, but that avenue arises from corporate governance requirements rather than from any statutory safeguard. The strength of the resulting protection therefore depends heavily on the effectiveness of the audit committee itself.

The distinction between the two roles is significant because statutory auditors are legally recognised as independent assurance providers, whereas internal auditors remain employees whose professional obligations may conflict with their employment interests. It is from this distinction that the protection gap emerges.

III. The Protection Gap Between Statutory and Internal Auditors

A. Internal Audit Responsibilities and Employment Dependence

The difficulty faced by internal auditors arises from the conflict between their professional obligations and their dependence on the organisation they work for. While their internal position gives them greater access to organisational information, it also creates a dependency that may compromise their practical independence. Auditor independence requires both independence of mind and independence in appearance, and both may be threatened by the environment in which auditors operate, by organisational structures and by the level of support provided by governance bodies.⁴ In practice, internal auditors have reported that their recommendations were ignored, that corrective action was not effectively implemented, and that audit committees failed to provide meaningful oversight, all of which create difficulties for auditors attempting to perform their assurance function independently.⁵

B. The Imbalance in Auditor Protection

The difference between statutory and internal auditors reveals a broader inconsistency within the Malaysian legal framework. It is an important fact to highlight that the statutory auditor receives greater legal protection than the internal auditor. While this undeniably confers a significant advantage on the independence of statutory auditors, the absence of a dedicated statutory protection equivalent to theirs creates uncertainty for internal auditors and weakens their practical independence. Part of the internal auditor’s job is to ensure the transparency of the organisation, particularly in relation to its financial statements. If an internal auditor discovers fraud in those statements, they are professionally expected to report the matter to the appropriate authority within the organisation and, if necessary, to escalate it further. Where the alleged misconduct involves that same management, however, the auditor may face retaliation, extending as far as dismissal, demotion or other adverse employment consequences. Ironically, the auditors whose work enables them to detect misconduct are those granted the least statutory protection, and they remain the most vulnerable when they report it.

The scarcity of litigation should not be mistaken for the absence of a problem. At the time of writing, no reported Malaysian cases involving the mistreatment of internal auditors have been identified. This absence should not be interpreted as evidence that retaliation does not occur. It may instead reflect the practical difficulty internal auditors face in seeking redress for such treatment, given the lack of adequate legal protection. Strong governance requires external as well as internal audit across all operations. Even where the internal audit function is established only for basic monitoring, it must be backed by reliable support systems so that it can exercise its functions without undue interference.

IV. Conclusion

This article has shown that Malaysian law provides stronger independence safeguards for statutory auditors, while internal auditors remain at risk precisely because they are employed by the organisations they audit. Corporate governance frameworks encourage internal auditors to report significant risks and misconduct through the audit committee, but the effectiveness of audit committees as a protective mechanism may vary, leaving internal auditors exposed to potential repercussions.

A preventive approach is therefore needed. Rather than deferring the problem until internal auditors suffer professional penalties, the legal framework should develop more robust protection mechanisms that allow them to report misconduct without fear of the consequences. Internal auditors carry a critical accountability role and should be afforded protection commensurate with that responsibility, including safeguards against retaliation, more robust audit committee oversight and enhanced independence from management influence. Such reforms would enable internal auditors to discharge their professional responsibilities properly and to participate meaningfully in corporate governance.

Notes

1. Caparo Industries plc v Dickman [1990] 2 AC 605.
2. Companies Act 2016 (Malaysia), s 266.
3. Companies Act 2016 (Malaysia), ss 276–278.
4. David Gwilliam & Oliver Marnet, Auditor Independence, Wiley Encyclopedia of Management (2014); Jimmy Walabyeki, Threatening the Accounting Gatekeeper: Environment Based Threats (2013).
5. Azham Md. Ali, Ram Al Jaffri Saad, Ahmad Zamil Abd. Khalid & Aryati Juliana Sulaiman, Internal Audit in the Statutory Bodies and Government-linked Companies of Malaysia: The Never Ending Saga!, 1 J. Pub. Admin. & Governance 256 (2011).

Reference(S):

Cases

• Caparo Industries plc v Dickman [1990] 2 AC 605.

Legislation

• Companies Act 2016 (Malaysia), s 266.
• Companies Act 2016 (Malaysia), ss 276–278.
• Whistleblower Protection Act 2010 (Malaysia).

Corporate Governance Materials

• Bursa Malaysia Main Market Listing Requirements, Chapter 15.
• Malaysian Code on Corporate Governance (2021).

Secondary Sources

• Azham Md. Ali, Ram Al Jaffri Saad, Ahmad Zamil Abd. Khalid & Aryati Juliana Sulaiman, Internal Audit in the Statutory Bodies and Government-linked Companies of Malaysia: The Never Ending Saga!, 1 J. Pub. Admin. & Governance 256 (2011).
• David Gwilliam & Oliver Marnet, Auditor Independence, Wiley Encyclopedia of Management (2014).
• Jimmy Walabyeki, Threatening the Accounting Gatekeeper: Environment Based Threats (2013).