Documents required for an audit in Malta: a pack your auditor can follow

01Does your company need an audit, a review or neither?

Check this before you build anything, because it changes what you prepare. Two sets of rules apply, and they are separate. The Companies Act decides whether the annual accounts must be audited. The Income Tax Management Act decides what must support the company’s tax records.

By default, a company’s annual accounts are audited: the Companies Act requires a company to appoint auditors, who report on its annual accounts (arts. 151(1) and 179(1)). Under article 185(2), a private company that, on its balance sheet date, does not exceed at least two of three limits is exempt from audit. The limits are a balance sheet total of €46,600, net turnover of €93,000 and an average of two employees. The exemption does not apply to public companies. An exempt company still prepares its annual accounts and files them with the Malta Business Registry, with a directors’ declaration in place of an auditor’s report.

Tax law starts from an audit too: article 19(4)(a) of the Income Tax Management Act requires a company’s accounts to carry an auditor’s report, unless rules made by the Minister say otherwise. The Audit Exemption Rules, 2025 (Legal Notice 139 of 2025, published on 15 July 2025) say otherwise for accounting periods starting on or after 1 January 2025. A company exempt under article 185(2) that is within only two of the three limits needs at least a review report for its tax records; an audit also satisfies the requirement. A company within all three limits needs neither an audit nor a review for its tax records. The Commissioner for Tax and Customs added wording for these rules to the 2026 company tax return.

There are separate rules for companies whose size changes and for groups. For the tax rules, a parent that must prepare consolidated accounts keeps this treatment only while its group stays a small group (rule 6(2)). The consolidated accounts of a tax fiscal unit must still carry an auditor’s report, even where an exemption would otherwise apply (Consolidated Group (Income Tax) Rules, rule 11(2)). Companies registered under the Merchant Shipping Act follow a separate regime. A regulator, licence condition, bank, lender, investor or contract may still require audited accounts. Ask your adviser to confirm the position for the period, in writing, before you scope the work.

02What documents does an auditor usually ask for?

Every engagement has its own request list, so treat the table below as a starting point, not the final scope. An audit usually starts from the trial balance and general ledger. The auditor uses them to see which balances matter, then asks for the records that support those balances.

The size of the list depends on the business. A consultancy with one bank account and no stock needs far less than a distributor with inventory, loans and a parent company abroad. Mark an area as not applicable rather than leaving it blank, and say why.

03How do you build an evidence pack your auditor can follow?

Use an index, not one folder of attachments. Start from the trial balance. For each material balance, the pack should lead to three things: a schedule that breaks the balance down, a reconciliation that agrees it to an outside record, and the documents behind the reconciling items.

Freeze the baseline. Label each export with the company name, the period and the export date. If corrections are still being made, say so. Keep a short log of adjustments with the reason and who approved them, and note which export replaces which. A new file sent without an explanation makes everyone re-check work already done.

Name files the way the index reads, for example ‘03 Bank – main current account – December reconciliation’, and link each index line to its file. If you use a client portal, upload into the same structure rather than one shared folder.

04What does the auditor do with the pack?

The auditor decides what evidence is enough. Maltese law requires statutory audits to follow the International Standards on Auditing (ISAs) issued by the IAASB (Companies Act art. 179(2) and (12); S.L. 281.02, reg. 4). Under the ISAs, an audit aims for reasonable assurance, and some evidence never comes from your pack. Plan for the three cases listed below.

A review is lighter. Under ISRE 2400 (Revised), the IAASB’s international standard for reviews, a review is a limited assurance engagement. The practitioner mainly makes inquiries and performs analytical procedures, which are substantially less than an audit, and does not give an audit opinion. Expect fewer document requests and more questions about why figures moved. For the Audit Exemption Rules, ‘review report’ takes its meaning from guidelines published by the Commissioner for Tax and Customs (rule 2), and those guidelines refer to a review engagement carried out under ISRE 2400 (Revised). Ask your reviewer to confirm in the engagement letter that the review will follow it.

The auditors also have a legal right of access at all times to the company’s accounting records, accounts and vouchers, and can ask its officers for the information and explanations they think necessary (Companies Act art. 154(1)). Under article 179(11), auditors who cannot obtain all the information and explanations they need must say so in their report. An organised pack does not guarantee a clean opinion, but gaps the auditor cannot resolve can end up in the report.

• Confirmations: when the auditor uses them, the auditor controls the requests and the replies go straight back to the auditor (ISA 505). Expect your bank, customers or suppliers to be contacted. If management refuses a request, the auditor must ask why, weigh the risk and look for other evidence.
• Stock counts: if inventory is material, the auditor attends the physical count unless that is impracticable (ISA 501). Tell the auditor your count date early.
• Written representations: near the end, the auditor asks management to confirm certain matters in writing (ISA 580).

05When should you start, and who owns each request?

Work back from the deadlines. A private company’s annual accounts must be laid before and approved by the general meeting within ten months of the end of the accounting period, or seven months for a public company (Companies Act art. 182(2)). The directors then have 42 days from the end of that ten-month (or seven-month) period to deliver them to the Malta Business Registry (art. 183(1)). The window is shorter when the company’s first accounting period is longer than twelve months: the laying period is cut by the extra days, but not to less than three months (art. 182(3)). Because the auditor’s report is annexed to the accounts laid before the general meeting (art. 181(1)), fieldwork, review and signing have to finish within the ten-month (or seven-month) period, not in the 42 days after it.

Build the pack once the year-end close is done and the trial balance is stable. It is quicker to build if the bank, debtor, creditor and VAT reconciliations are kept up to date during the year, so that year-end is a matter of assembling the pack rather than reconstructing it. Give every request a named owner, a status and a date. Keep the stages apart: requested, received, and reviewed against the ledger. A document can arrive and still need clarification, so only the auditor can tell you an item is cleared.

Some records sit with other people: the bank, the payroll provider, a lawyer or a parent company. Ask for these first, because you cannot speed them up later.

Agree early who does what, whether one firm keeps your books and another audits them or you are considering one firm for both. Independence rules limit what an auditor can do for its own audit client. Under the IESBA Code of Ethics, providing accounting and bookkeeping services to an audit client creates a self-review threat when there is a risk that the work will affect the accounting records or the accounts on which the firm will give its opinion. At A4, audit and accounting work are kept independent, and A4 will explain how that works for your company. A4 collects the trial balance and documents through its client portal rather than by email.

06What should you do when a record is missing?

Say so. Write down what is missing, why, who is trying to get it and by when. If a balance is disputed, summarise the disagreement and attach the latest correspondence. A gap you have written down is easier to clear than a folder marked complete that hides one.

Add a short note about the year: changes in activity, new contracts, large purchases, disputes, new financing and anything after year-end that may affect the accounts. Give the facts and point to the documents. Leave accounting treatment and disclosure to your accountant and auditor.

Do not discard the pack after the audit. Keep the company’s accounting records for ten years (Companies Act, art. 163(5)). The Income Tax Management Act’s nine-year rule for tax records (art. 19(5)) does not shorten this. Next year’s audit also starts from this year’s closing balances.