Audit Preparation Checklist for Malta Companies 2026

By the EGM Assurance Editorial Team · Last reviewed June 2026 · 15 min read

A statutory audit runs far more smoothly (faster, cheaper and with fewer surprises) when the company is properly prepared. The single biggest factor that determines how long an audit takes, and how much it costs, is not the auditor’s speed but the quality and completeness of what the company hands over at the start. A director who understands what the auditor needs, prepares it in advance, and keeps the lines of communication open will get a quicker audit, a lower fee, and a cleaner outcome. A director who treats the audit as something that happens to the company, rather than something the company actively supports, gets the opposite.

This guide is a practical, director-focused preparation checklist for a Maltese company’s statutory audit. It explains who is actually required to be audited under the current rules, the difference between an audit and a review engagement, the filing timeline you are working towards, the accounting records and documents the auditor will request, the corporate and governance documents that are easy to overlook, the going concern assessment that is the directors’ responsibility, how to work effectively with your auditor, and the common issues that slow audits down. It reflects the position in Malta as at June 2026, including the Audit Exemption Rules introduced by Legal Notice 139 of 2025.

It sits alongside our companion guides on what the audit produces, the audit report and the types of audit opinion, and on the private findings the auditor reports to the board. The aim here is everything that happens before the audit, so that what comes out of it is as clean as possible.

1. First question: does your company actually need an audit?

Before preparing for an audit, confirm whether one is required at all. The position changed materially with the Audit Exemption Rules (Legal Notice 139 of 2025), which removed the long-standing tax requirement that forced almost every Maltese company to obtain an auditor’s report regardless of size. The current position is tiered, based on the size thresholds in Article 185(2) of the Companies Act.

A company is assessed against three criteria. For a private company to fall within the micro-entity thresholds, it must not exceed two of the three. The thresholds are:

The outcome then follows three tiers. A company that does not exceed any of the three thresholds is fully exempt, no audit and no review report is required for tax purposes. A company that exceeds exactly one threshold (i.e. does not exceed two of the three) can satisfy the requirement with a review engagement under ISRE 2400 (Revised) instead of a full audit. A company that exceeds two or three of the thresholds requires a full statutory audit. Eligibility is assessed at the balance sheet date and, under the two-year stability rule in Article 185(3), a change of category only takes effect once the position is sustained for two consecutive years.

Entities that must always be audited

Some companies cannot claim any exemption regardless of size. These include public companies, entities regulated by the Malta Financial Services Authority, companies whose securities are admitted to trading on a regulated market, and parent companies of groups that do not qualify as small. Companies in regulated sectors (financial services, gaming and similar) will also typically be required to be audited (and often to report under IFRS) as a condition of their licence. If your company is in any of these categories, the exemption analysis does not apply and you should prepare for a full audit.

Confirm your audit status before anything else, but do not assume exemption means do nothing. An exempt company still prepares financial statements, files with the Registrar and submits a tax return; it simply may not need an auditor’s report. And the moment the company grows past the thresholds for two consecutive years, the audit returns, with the first resumption audit typically more involved because the auditor must get comfort on the unaudited comparatives. Our audit exemption guide works through the full eligibility analysis.

2. Audit or review engagement: prepare for the right one

If your company falls into the middle tier, exceeding one threshold but not two, you have a choice between a full audit and a review engagement, and the preparation differs. A full statutory audit provides reasonable assurance: the auditor performs detailed testing of balances and transactions, evaluates internal controls, and expresses a positive opinion that the financial statements give a true and fair view. A review engagement, conducted under ISRE 2400 (Revised), provides limited assurance: the practitioner performs primarily inquiry and analytical procedures and concludes that nothing has come to their attention to suggest the statements are materially misstated.

A review is faster and less costly than a full audit, but it carries less weight with banks, investors and counterparties, who may specifically require a full audit opinion. The practical preparation point is the same in both cases (complete, reconciled records and supporting documentation) but a full audit will involve deeper substantive testing and more extensive evidence requests, so the document pack needs to be correspondingly thorough. Confirm with your auditor which engagement applies before you begin preparing, and check whether any lender or stakeholder requires a full audit even where a review would satisfy the tax rules.

3. The timeline you are working towards

Audit preparation is governed by deadlines, and working backwards from them is the key to a calm process. For a Maltese company, the statutory cycle is anchored to the financial year-end (the accounting reference date, commonly 31 December).

• The directors must lay the audited financial statements before the company in general meeting for approval within ten months of the year-end for a private company (seven months for a public company).

• Following approval, a copy of the financial statements (with the auditor’s and directors’ reports where applicable) must be filed with the Malta Business Registry within 42 days.

• The corporate income tax return must be filed with the Malta Tax and Customs Administration within the applicable deadline (commonly nine months after year-end for a manual return, with an electronic extension).

For a 31 December year-end private company, that means approval by 31 October and MBR filing by mid-December, the familiar “ten months plus 42 days” rhythm. Because the audit must be substantially complete before the accounts can be approved, the fieldwork needs to happen well before the ten-month mark. The practical implication: do not wait until the deadline approaches. Agree a timetable with your auditor early, ideally beginning preparation within a couple of months of year-end while the year is fresh and staff remember the transactions.

Work backwards from the filing deadline, not forwards from when you happen to be ready. Late filing with the Registrar attracts penalties that accrue over time, and a rushed audit is a more expensive and more error-prone audit. Booking the audit early and preparing the document pack in advance is the cheapest way to keep both fees and stress down.

4. Accounting records: the foundation

The audit is built on the company’s accounting records, so the first preparation task is ensuring those records are complete, accurate and reconciled. Under Article 163 of the Companies Act, the company must in any case keep proper accounting records that show and explain its transactions; the audit is where the quality of those records is tested. Before fieldwork begins, the following should be in order:

• A complete general ledger and trial balance for the year, agreed to the draft financial statements.

• Bank reconciliations for every bank account as at the year-end, with reconciling items explained and supported.

• Reconciled control accounts (trade debtors, trade creditors, VAT, payroll and intercompany balances) agreed to supporting ledgers and statements.

• A fixed asset register reconciled to the general ledger, with additions and disposals supported by invoices and agreements.

• Inventory records and a year-end stock count, where the company holds stock, with the valuation basis documented.

• Cut-off support around the year-end (the last and first invoices, goods received notes and dispatch records) so income and expenses fall in the correct period.

Records that are incomplete or unreconciled are the single most common reason audits run over time and over budget, because the auditor cannot test figures that do not yet agree to the underlying ledgers. Time spent reconciling before the auditor arrives is repaid several times over in a shorter, cheaper audit. Our accounting records guide sets out the full statutory requirements.

5. The document checklist: what the auditor will request

Auditors typically issue a “prepared-by-client” list (often called a PBC list), the schedule of documents and information they need from the company. Preparing these in advance, organised and labelled, is the heart of good audit preparation. The exact list varies with the business, but the core items are consistent. The table below groups the most commonly requested items by area.

The single most useful habit is to maintain a year-end audit file as the year closes, dropping supporting documents into it as reconciliations are completed, rather than assembling everything reactively when the PBC list arrives. Where documents are requested as samples (invoices, contracts), responding quickly and completely keeps the audit moving; slow or partial responses to sample requests are a frequent cause of delay.

Ask your auditor for the prepared-by-client list as early as possible, ideally before year-end, so you can assemble the pack while the information is fresh. A complete, well-organised PBC pack delivered at the start of fieldwork is the most effective single thing a director can do to shorten the audit and contain the fee.

6. Corporate and governance documents

One area directors routinely under-prepare is the corporate and governance documentation, because it sits outside the day-to-day accounting and is often assumed to be the company secretary’s concern alone. The auditor needs it to confirm the company’s structure, authority for transactions, and compliance with company law. Have the following ready:

• The current memorandum and articles of association, including any amendments made during the year.

• The statutory registers (register of members, register of directors and company secretary, register of debentures and register of beneficial owners) up to date.

• Minutes of board meetings and general meetings held during the year, evidencing approval of significant transactions, dividends and key decisions.

• Filings made with the Malta Business Registry during the year, including the annual return and any changes notified.

• Evidence of beneficial ownership filings and any changes notified within the required timeframe.

Where significant transactions occurred during the year (a share issue, a capitalisation of shareholder loans, a dividend, a major acquisition or disposal) the supporting board and shareholder resolutions and any related MBR filings should be gathered with the relevant accounting records, so the auditor can trace the transaction from authorisation through to its treatment in the accounts.

7. Going concern: a director’s responsibility

Assessing whether the company is a going concern, able to continue in operation for the foreseeable future, is the directors’ responsibility, not the auditor’s. The auditor evaluates the directors’ assessment, but the assessment itself must be made and documented by the board. Preparing this in advance avoids a common late-stage scramble.

For most companies the assessment is straightforward, but it should still be evidenced. Where there are indicators of possible difficulty (recurring losses, net liabilities, tight cash flow, loan covenants under pressure, or significant uncertainty in the business) the directors should prepare a more thorough assessment supported by cash flow forecasts, budgets, and evidence of available financing or facilities. Where a material uncertainty exists but the going concern basis remains appropriate, the financial statements should disclose it clearly; with adequate disclosure, the auditor can still issue an unmodified opinion while drawing attention to the uncertainty. Our going concern guide covers the director’s assessment in detail.

Prepare the going concern assessment before the auditor asks for it, and support it with forecasts where there is any indicator of difficulty. A documented, reasoned assessment, not a last-minute assertion, is what allows the audit to conclude smoothly on this point, and it is also evidence that the directors discharged their responsibility.

8. Working effectively with your auditor

Preparation is not only about documents; it is also about how the company engages with the audit team. A few practices make a substantial difference to the speed and tone of the audit.

• Agree the timetable and the PBC list up front, with clear dates for delivery of information and for fieldwork, and a single point of contact in the company to coordinate responses.

• Respond to queries promptly and completely. The audit progresses in waves of questions; fast, full answers keep momentum, while slow or partial responses stall it.

• Flag significant or unusual transactions early (a major contract, a restructuring, a change in accounting treatment) so the auditor can plan for them rather than encountering them mid-fieldwork.

• Make the right people available. Some questions can only be answered by the person who handled the transaction; ensure finance staff and relevant managers are on hand during fieldwork.

• Prepare the written representations the auditor will request near the end, and understand that the auditor cannot simply accept assertions without supporting evidence where evidence should exist.

Remember that the auditor must remain independent and cannot prepare the company’s records or design its controls. The company is responsible for the financial statements; the auditor expresses an opinion on them. A cooperative, well-organised relationship within those boundaries produces the best outcome for both sides.

9. Common issues that slow audits down

Most audit delays trace back to a short list of avoidable problems. Knowing them in advance is the best way to prevent them.

• Records not reconciled: control accounts, bank accounts or intercompany balances that do not agree to supporting ledgers, forcing the auditor to wait while the company reconciles.

• Missing supporting documentation: transactions recorded without the underlying invoices, contracts or agreements to evidence them.

• Late or partial responses to the PBC list and to sample requests, breaking the audit’s momentum.

• Unprepared going concern assessment, requiring a late scramble for forecasts and evidence.

• Unexplained significant or unusual transactions discovered during fieldwork rather than flagged in advance.

• Cut-off errors around the year-end, with income or expenses recorded in the wrong period.

• Untracked director and shareholder balances and related-party transactions, which require disclosure and evidence.

• Key staff unavailable during fieldwork, so questions that only they can answer go unanswered.

• Prior-year comparatives that were never audited (on resumption after exemption), requiring additional procedures the company has not anticipated.

Almost every item on this list is addressable before the audit begins. The companies that have the smoothest, cheapest audits are not the simplest ones, they are the best prepared ones.

10. A practical pre-audit checklist

Pulling the above together, the following is a condensed checklist a director can work through before the audit begins:

• Confirmed whether a full audit, a review engagement, or neither is required.

• Agreed the audit timetable and obtained the prepared-by-client list from the auditor.

• General ledger and trial balance complete and agreed to the draft financial statements.

• All bank accounts reconciled at year-end, reconciling items explained.

• Debtors, creditors, VAT, payroll and intercompany control accounts reconciled.

• Fixed asset register reconciled; additions and disposals supported.

• Inventory counted and valued, where applicable.

• Cut-off documentation gathered around the year-end.

• Corporate and governance documents and statutory registers up to date.

• Board and shareholder minutes and MBR filings for the year collected.

• Going concern assessment prepared and, where needed, supported by forecasts.

• Significant and unusual transactions identified and supporting documents gathered.

• A single internal coordinator and the right staff available for fieldwork.

11. Frequently asked questions

How do I know if my company needs an audit in Malta?

Assess the company against the three micro-entity thresholds in Article 185(2) of the Companies Act: turnover €93,000, balance sheet total €46,600, and two employees. If the company does not exceed any of the three, it is fully exempt; if it exceeds exactly one (does not exceed two of three), a review engagement satisfies the requirement; if it exceeds two or three, a full audit is required. Public companies, MFSA-regulated entities, listed companies and parents of non-small groups must always be audited regardless of size.

What is the difference between an audit and a review engagement?

A full audit provides reasonable (high) assurance through detailed testing and results in a positive opinion that the financial statements give a true and fair view. A review engagement, under ISRE 2400 (Revised), provides limited assurance through mainly inquiry and analytical procedures, and concludes that nothing has come to the practitioner’s attention to suggest the statements are materially misstated. A review is faster and cheaper but carries less weight with banks and investors, who may still require a full audit.

What documents will the auditor ask for?

The auditor issues a prepared-by-client (PBC) list. It typically covers the draft financial statements and trial balance; bank statements and reconciliations; aged debtors and creditors listings; sales, purchase and expense records with sample invoices; the fixed asset register; inventory records; payroll, VAT and tax workings; related-party and director balances; and the corporate and governance documents. Preparing these in advance, organised and labelled, is the most effective way to keep the audit on schedule.

When does the audit need to be finished?

Work back from the filing deadlines. A private company must approve its financial statements within ten months of year-end (seven for a public company) and file with the Malta Business Registry within a further 42 days. Because the audit must be substantially complete before approval, fieldwork should happen well before the ten-month point. For a 31 December year-end, that means aiming to approve by 31 October and file by mid-December.

How can I reduce my audit fee?

The most reliable way is to be well prepared. Reconciled records, a complete and well-organised PBC pack delivered at the start of fieldwork, prompt and full responses to queries, and the right staff available all shorten the time the audit takes, and audit effort is the main driver of the fee. Disorganised or incomplete records have the opposite effect. Booking the audit early and preparing in advance is the practical route to a proportionate fee.

Who is responsible for the going concern assessment?

The directors. Assessing whether the company can continue as a going concern is a director responsibility; the auditor evaluates that assessment but does not make it. For most companies it is straightforward, but it should be documented, and where there are indicators of difficulty it should be supported by cash flow forecasts and evidence of available financing. Preparing it before the auditor asks avoids a late-stage scramble.

Can the auditor prepare my accounts or fix my records?

No, not without impairing independence. The company is responsible for keeping its accounting records and preparing its financial statements; the auditor independently expresses an opinion on them. An auditor who prepared the records and then audited them would be auditing their own work. The auditor can point out issues, but the company must maintain the records and make the corrections. Separate, permitted advisory support can sometimes be arranged within the ethics rules.

What happens if my records are not ready when the audit starts?

The audit stalls. The auditor cannot test figures that do not yet agree to the underlying ledgers, so unreconciled or incomplete records push the timeline out and increase the fee, because the team spends time waiting or re-performing work. If records are seriously deficient, the auditor may be unable to obtain sufficient evidence, which can affect the opinion. The remedy is to reconcile and assemble the records before fieldwork begins.

We were exempt last year but have grown, what should we expect?

On resumption of audit after a period of exemption, expect a more involved first audit. The auditor must obtain comfort not only on the current year but on the opening balances and prior-year comparatives that were never audited, which usually requires additional procedures. This makes the resumption audit more time-consuming and more costly than a continuing audit, so plan for it, and keep good records during the exempt years precisely to make this transition easier.

Do we still need to do anything if we are exempt from audit?

Yes. Audit exemption removes the requirement for an auditor’s report; it does not remove the other obligations. The company must still prepare financial statements (under GAPSME or IFRS), have them approved, file them with the Malta Business Registry, and submit a corporate tax return. Proper accounting records must still be kept. Exemption reduces the assurance requirement, not the underlying compliance.

Should I choose a review engagement instead of a full audit if I qualify?

It depends on your stakeholders. A review is faster and less costly, which suits a company with no external parties relying on its accounts. But banks, lenders, investors and some counterparties may specifically require a full audit, and a review will not satisfy them. Confirm what your stakeholders need before opting for a review on the basis that the tax rules permit it, switching back to a full audit later can cost more than maintaining it would have.

Related guides from EGM Assurance

• Statutory Audit in Malta: 2026 Guide for SMEs

• Audit Exemption in Malta 2026: LN 139/2025 Complete Guide

• Accounting Records in Malta 2026: Companies Act Requirements and Common Pitfalls

• The Audit Report Explained: What Every Section Means

• Types of Audit Opinion in Malta 2026: A Director’s Guide

• Going Concern in Malta: A Director’s Guide

• Internal Controls for Maltese SMEs 2026

• Company Year-End in Malta 2026: The Full Cycle

Authoritative references

• Companies Act (Cap. 386) - Articles 163, 167, 182, 185 (records, accounts, audit and size thresholds)

• Audit Exemption Rules (S.L. 372.33) - Legal Notice 139 of 2025

• MTCA Guidelines in relation to the Audit Exemption Rules

• ISRE 2400 (Revised), Engagements to Review Historical Financial Statements - IAASB

• Malta Business Registry - annual submissions and filing deadlines

• Accountancy Profession Act (Cap. 281) - regulation of auditors in Malta

Getting ready for your audit? EGM Assurance helps directors prepare for a smooth, efficient statutory audit, from confirming whether an audit or review is required, to organising the records and document pack, to working through going concern and governance. Good preparation means a faster audit and a cleaner result. Get in touch →

This article is prepared by EGM Assurance for general informational purposes and reflects the legal and regulatory position in Malta as at June 2026, including the Companies Act (Cap. 386) and the Audit Exemption Rules (Legal Notice 139 of 2025). It does not constitute legal, tax or accounting advice. Audit requirements depend on the specific facts of each company. Always confirm your obligations with your auditor and a qualified professional.