Statutory Audit in Malta: The 2026 Guide for SMEs

By the EGM Assurance Editorial Team . Last reviewed April 2026 . 12 min read

A statutory audit in Malta is the formal examination of a company's financial statements by a warranted auditor, resulting in an independent opinion on whether those statements give a true and fair view of the company's financial position and performance. For many Maltese companies it is a statutory obligation; for others, exemption pathways are available.

This guide is written for directors, company secretaries and finance managers of Maltese SMEs. It sets out which companies must have their accounts audited, the exemption pathways that may apply, the size thresholds that govern both audit and disclosure, the choice between GAPSME and IFRS, and the typical timeline and preparation a Maltese SME audit involves.

1. The legal basis for statutory audit in Malta

The obligation to have financial statements audited arises from three sources under Maltese law - the Companies Act (Cap. 386), the Income Tax Management Act (Cap. 372), and sector-specific regulatory rules. Each of these imposes its own requirement. A company may be subject to one, two or all three simultaneously.

The Companies Act (Cap. 386)

Under Article 167 of the Companies Act, every company formed and registered in Malta is required to appoint an auditor and to have its annual accounts audited by a warranted auditor authorised by the Accountancy Board. Article 182 sets the approval and filing timeline: for private companies, accounts must be approved at a general meeting within 10 months of the end of the accounting period, and filed with the Malta Business Registry (MBR) within a further 42 days after approval. For a private company with a 31 December year-end, this means approval by 31 October and filing by 12 December of the following year. Public companies have a shorter window: accounts must be approved within 7 months of year-end.

The Income Tax Management Act (Cap. 372)

Article 19(4)(a) of the ITMA historically required every company registered in Malta to maintain a balance sheet and profit and loss account accompanied by an auditor's report, regardless of Companies Act size. This was the reason most Maltese SMEs could not claim genuine audit exemption in practice. Legal Notice 139 of 2025 - the Audit Exemption Rules - changed this position for companies meeting specific criteria, which we set out in detail below.

Sector-specific regulatory requirements

Companies licensed by the Malta Financial Services Authority (MFSA) or the Malta Gaming Authority (MGA) are subject to additional, sector-specific audit requirements. The MFSA requires that auditors of credit institutions, insurance undertakings and investment services licence holders are specifically approved by the Authority. Gaming licensees are subject to MGA-specific reporting obligations. These regulatory requirements run in parallel with - and are not substituted by - the Companies Act regime, and they remain unaffected by the Legal Notice 139 exemptions.

2. Company size thresholds in Malta

Maltese company law operates with two distinct size threshold regimes. Directors should understand which regime governs each question they are trying to answer, because the figures and the consequences are different.

Regime 1: Article 185(2) micro-entity thresholds - drive audit exemption

These are the thresholds that determine whether a private company is eligible for the full audit exemption or the review-report option under Legal Notice 139 of 2025. A private company is classified as a micro entity under Article 185(2) of the Companies Act where, at its balance sheet date, it does not exceed at least two of the following:

Related guides: Accounting Records in Malta: Companies Act Requirements

Regime 2: GAPSME small and medium entity thresholds

These are the size categories (small / medium / large) that determine whether a company is eligible to prepare its financial statements under GAPSME, and drive the level of disclosure required. GAPSME is available to companies that qualify as small or medium; companies that exceed the medium thresholds must use IFRS as adopted by the EU (unless otherwise required to do so for other reasons - see Section 3). The thresholds are:

How the two-year test works: for both regimes, a company qualifies for a category if, at its balance sheet date, it does not exceed two of the three criteria in two consecutive accounting periods. A single year of breach does not change the classification - this gives management a planning year before any transition takes effect.

3. Accounting framework: GAPSME or IFRS?

Before considering audit obligations, directors must first determine which accounting framework governs the financial statements. This is a separate question from audit exemption, and it is driven by the GAPSME size thresholds set out in Section 2.

Maltese law recognises two accounting frameworks: International Financial Reporting Standards (IFRS) as adopted by the EU, and the General Accounting Principles for Small and Medium-Sized Entities (GAPSME), issued by the Accountancy Board under Legal Notice 289 of 2015. The framework a company uses affects the presentation, measurement and disclosure of its financial statements, and in turn affects the complexity and cost of preparation and audit.

When GAPSME may be used

GAPSME is available to companies that qualify as either small or medium under the GAPSME thresholds (see Section 2 above). Where the thresholds are met, GAPSME may be adopted in place of IFRS. GAPSME is specifically designed for SMEs and generally requires fewer disclosures and simpler measurement rules than full IFRS, which can reduce preparation time and audit cost. Small entities under GAPSME are, for example, required to prepare only a balance sheet, income statement and notes - with no statement of cash flows and no directors' report. Medium entities must additionally prepare a statement of changes in equity and a statement of cash flows.

When IFRS is mandatory

Full IFRS as adopted by the EU must be applied where any of the following apply:

• The company exceeds the GAPSME medium thresholds for two consecutive accounting periods - that is, it is classified as large.

• The company is a public-interest entity, including entities whose securities are admitted to trading on a regulated EU market, credit institutions and insurance undertakings.

• The company holds a Malta Gaming Authority (MGA) licence - all MGA licensees must prepare accounts under IFRS regardless of size.

• The company is required to report to a parent group that consolidates under IFRS, and separate GAPSME accounts are not practicable.

• The company voluntarily elects IFRS - a valid election that may be made at board level but, once made, generally cannot be reversed without a material change in circumstances.

4. Who is exempt from audit under the 2025 Audit Exemption Rules

Legal Notice 139 of 2025 (the Audit Exemption Rules), published on 15 July 2025, created distinct exemption pathways applying to different categories of company. Which one applies depends on the company's size, age, sector and shareholder profile.

Pathway 1: newly incorporated company waiver (Rule 3)

Applies to companies incorporated on or after 1 January 2024 that meet all of the following for each of their first two accounting periods:

• The company is wholly owned by individual shareholders (no corporate shareholders).

• All shareholders hold educational qualifications at MQF Level 3 or higher recognised by the Malta Qualifications Recognition Information Centre.

• The company was incorporated within three years of the shareholders obtaining those qualifications.

• Annual turnover does not exceed EUR 80,000 (pro-rated for accounting periods shorter than 12 months).

Commercial note: even where the waiver is available, a company may elect to undergo a voluntary audit and claim a tax deduction of 120% of the audit fee, capped at EUR 700 per accounting period, against its income tax liability. Whether to claim the waiver or opt for a voluntary audit is a commercial decision. Companies seeking bank funding, investor capital or material third-party contracts during their first two years often find that audited accounts are required by those counterparties regardless of the statutory exemption. The appropriate choice depends on the company's specific stakeholder landscape.

Pathway 2: full audit exemption for micro entities (Rule 6)

Applies to companies that satisfy all three Article 185(2) micro-entity thresholds (EUR 46,600 balance sheet / EUR 93,000 turnover / 2 employees) for two consecutive accounting periods. A company meeting all three thresholds is fully exempt from the statutory audit requirement - no audit report, no review report, no alternative assurance is required.

Pathway 3: review report in place of audit (Rule 6)

Applies to companies that satisfy at least two but not all three of the micro-entity thresholds under Article 185(2). These companies may submit a review report in place of a full audit report. A review engagement under the applicable International Standard on Review Engagements (ISRE 2400 revised) provides limited assurance, is lower cost and less time-intensive than a full audit, and is acceptable under Article 19(4) of the ITMA as amended.

Pathway 4: Merchant Shipping Act companies (Rule 7)

Companies registered in Malta under the Merchant Shipping Act (Cap. 234) and benefitting from the exemption under Regulation 64 of the Merchant Shipping (Shipping Organisations - Private Companies) Regulations are, under Rule 7 of Legal Notice 139 of 2025, deemed to have satisfied their audit obligations under the Income Tax Management Act, even where no audit is carried out. This pathway operates under the Merchant Shipping Act regime rather than the Companies Act regime - shipping entities should therefore assess their position primarily against the Merchant Shipping (Shipping Organisations - Private Companies) Regulations and any thresholds prescribed under them. The pathway extends to qualifying small groups on a consolidated basis and applies to accounting periods commencing on or after 1 January 2024.

Who cannot claim any exemption

Regardless of size, the following companies must obtain a full statutory audit:

• Public companies (plc) - audit is mandatory for all public companies.

• Companies licensed by the MFSA - credit institutions, insurance undertakings, investment services providers, and other regulated entities.

• Companies licensed by the MGA - all gaming licence holders (which must also prepare accounts under IFRS, as set out in Section 3).

• Companies acting as trustees or holding assets on trust.

• Any company whose articles of association, shareholder agreement, loan covenants or other contractual obligations require a full audit.

• Companies that are subsidiaries within a group that does not qualify as a small group on a consolidated basis.

5. What Maltese auditors examine

Where a full statutory audit is required, it must be conducted in accordance with International Standards on Auditing (ISAs) as adopted for application in Malta under the Accountancy Profession Act (Cap. 281). The audit is risk-based: the auditor identifies where material misstatement is most likely and concentrates testing there. For SMEs, the following areas routinely attract the most scrutiny.

Revenue recognition and cut-off

Whether revenue has been recorded completely (all transactions captured) and in the correct period (cut-off). For service businesses, this involves examining contracts and delivery evidence. For product businesses, it involves tracing sales to despatch records and customer acceptance. Any contract liability or deferred revenue balance will be specifically tested against the underlying contract terms.

Trade receivables and their recoverability

The aged receivables schedule is one of the first documents the auditor will request. Balances overdue by more than 90 days typically attract direct enquiry. For significant balances, the auditor will circularise debtors - sending written confirmation requests directly to customers - and will assess whether the bad debt provision is adequate by reference to actual collection experience over the prior 12 to 24 months.

Bank balances and cash

Every material bank account will be confirmed directly with the bank at the year-end date. The auditor dispatches a standard bank confirmation letter; the bank responds directly to the auditor, not to the company. Bank reconciliations must agree precisely to both the ledger and the bank statement, and unreconciled differences at the year-end are a common finding that management letters are written about.

Related-party transactions

Transactions between the company and its shareholders, directors or connected entities are subject to enhanced scrutiny. The auditor will verify that all related-party transactions have been properly documented, are conducted at arm's-length terms (or, where they are not, that this fact is disclosed in the notes), and have been authorised by the board. Missing board minutes for material related-party transactions are one of the most common SME findings.

Tax positions and deferred tax

The auditor will reconcile the income tax charge in the accounts to the underlying tax computation and review the adequacy of the deferred tax provision. Any open correspondence with the Malta Tax and Customs Administration (MTCA) - VAT queries, FSS inspections, income tax assessments - must be disclosed and considered for provision.

Accounting framework compliance

The auditor verifies that the accounting framework adopted by the company (GAPSME or IFRS - see Section 3) has been applied consistently and that all required disclosures have been made. Where the company has transitioned between frameworks during the year, the auditor examines the transition disclosures and any comparative restatement required by the applicable framework.

6. Typical audit timelines for a Malta SME

For a straightforward SME with a 31 December year-end, the audit work itself can be completed in a few weeks. The timeline below reflects a well-prepared company with simple operations - larger or more complex companies take longer. It aligns with the statutory deadlines under Article 182 of the Companies Act: approval within 10 months of year-end, filing within 42 days of approval.

A small private company with clean records, few transactions and a single bank account can often complete the entire process - from planning through to signed accounts - in three to six weeks, well ahead of the statutory deadlines.

7. Penalties for late or missed filing

The MBR applies distinct penalty regimes for the Annual Return and for the audited financial statements. Penalties accrue automatically from the day after the deadline - there is no grace period and no need for the Registrar to raise a demand.

Annual Return penalty

If the Annual Return is not filed within 42 days of the made-up date, penalties begin accruing immediately. Officers of defaulting companies are advised to engage with the Registrar at the earliest opportunity to regularise the filing position.

Financial statements penalty

Where audited accounts are filed late, a default penalty applies together with a daily penalty for each day the default continues. The penalty applies per set of late accounts and runs independently of any Annual Return penalty that may also have accrued.

Persistent default and striking off

Under Article 325 of the Companies Act, the Registrar may strike a company off the register where it is persistently in default of its filing obligations or where the Registrar has reason to believe the company is not carrying on business. Where a company has been struck off, restoration procedures are available but involve additional costs and professional time.

8. Audit preparation checklist

The following items are commonly requested at the start of a statutory audit engagement. Having them in order before fieldwork begins supports an efficient audit process. This is not an exhaustive list - your auditor will issue a specific information request - but it covers the areas that most often require attention.

At least 8 weeks before fieldwork

• Confirm the engagement letter, agree fieldwork dates, and designate a single audit contact with authority to provide information and sign off on explanations.

• Produce and reconcile management accounts for the full year. Verify that the trial balance agrees to the management accounts line by line.

• Prepare a current list of all related parties, group entities, and significant contracts entered or varied during the year.

• Flag to the auditor any significant judgement areas, accounting policy changes or unusual transactions - before fieldwork, not during it.

4 to 6 weeks before fieldwork

• Reconcile all bank accounts and prepare the standard bank confirmation letters for the auditor to dispatch directly.

• Update the fixed asset register and locate purchase invoices and disposal documents for all additions and disposals during the year.

• Prepare the aged receivables and aged payables schedules with written commentary on any balance overdue by more than 60 days.

• Confirm with the MTCA that all VAT returns, FSS submissions and income tax returns are filed, and that no open queries or assessments are outstanding.

• Identify any open litigation, insurance claims or regulatory investigations and locate all relevant correspondence.

2 weeks before fieldwork

• Ensure the statutory books are current: share register, directors' register, and minutes of all board meetings and shareholder resolutions passed during the year.

• Prepare payroll reconciliations and supporting documentation for all remuneration paid, including directors' fees, bonuses and termination payments.

• Reconfirm that beneficial ownership records are current and that all required MBR notifications have been filed.

• Index and label key documents clearly. Clear referencing reduces the time auditors spend locating information during fieldwork.

9. Frequently asked questions

My company qualifies as a micro entity. Am I fully exempt from audit?

Only if you meet all three Article 185(2) thresholds - EUR 46,600 balance sheet, EUR 93,000 turnover, and 2 employees - for two consecutive accounting periods, and your company is not disqualified from exemption on other grounds (e.g. MFSA or MGA licence, trustee activities, contractual audit requirement). If you meet only two of the three thresholds, you can submit a review report instead of a full audit, but you are not fully exempt.

What is a review report and how does it differ from an audit?

A review report is issued following a review engagement conducted under the International Standard on Review Engagements (ISRE 2400 revised). It provides "limited" or "moderate" assurance, rather than the "reasonable" assurance provided by a full audit. In practical terms, the reviewer performs analytical procedures and enquiries of management, but does not perform the full substantive testing that an audit requires. Review engagements are typically 30-50% less costly than full audits and take less time to complete.

My company was incorporated in 2024 with turnover under EUR 80,000. Am I automatically exempt?

Not automatically. The Rule 3 waiver under LN 139/2025 requires all of the following: (i) the company is wholly owned by individuals (no corporate shareholders), (ii) all shareholders hold MQF Level 3 or higher qualifications, (iii) the company was incorporated within three years of those qualifications being obtained, and (iv) turnover does not exceed EUR 80,000 annually. All four conditions must be met for each of the first two accounting periods. Confirm each condition with reference to the shareholder register and qualification evidence before claiming the waiver.

What is the cost of a statutory audit for a Malta SME?

Audit fees in Malta are not regulated and vary according to the size and complexity of the company, the quality of its accounting records, the sector in which it operates and the reputation of the audit firm engaged. Key factors that influence the fee include: the number of transactions to be tested, the completeness of reconciliations at year-end, the complexity of the revenue streams, the volume of related-party transactions, and whether the company operates in a regulated sector. Where a review report is available under Pathway 3 in place of a full audit, the fee is typically lower than a full audit engagement. The most reliable approach is to obtain a written engagement proposal from one or more warranted auditors on the basis of the company's prior-year accounts.

Can the auditor also prepare the financial statements?

The Accountancy Profession (Code of Ethics for Warrant Holders) Regulations permit this arrangement only subject to specific safeguards. For most SMEs, it creates a familiarity or self-review threat that must be managed, for example by rotating the engagement partner or having an independent partner review the file. The Accountancy Board's guidance is that, where practicable, management should take ownership of the financial statement preparation process even if the accounting firm assists with technical presentation.

What happens if my auditor issues a qualified opinion?

A qualified opinion means the auditor has concluded that the financial statements are materially correct except for one or more specific matters that cannot be resolved. The qualification is visible in the audit report filed with the MBR and forms part of the public record. It will be accessible to banks, counterparties, regulators and credit agencies. Loan agreements sometimes include covenant provisions that are triggered by a qualified audit opinion, so directors should review any facility agreements before the accounts are finalised. Where the auditor has indicated a qualification is likely, the matter can often be addressed in discussion with the auditor during the reporting phase - directors should raise the issue at board level at the earliest opportunity.

Related guides from EGM Assurance

The following articles expand on specific topics referenced in this guide:

• Audit Preparation Checklist for Maltese Companies

• GAPSME vs IFRS: Choosing the Right Framework

• Corporate Filings and Beneficial Ownership: Directors' Guide

• Payroll and FSS Obligations for Maltese Employers

Authoritative references

• Companies Act (Cap. 386)

• Legal Notice 139 of 2025 (Audit Exemption Rules)

• Accountancy Board (auditor warranting and ethics)

• Malta Business Registry (annual return and accounts filing)

• Malta Institute of Accountants

• MFSA (regulated entity audit requirements)

• MGA (gaming audit requirements)

Need help? EGM Assurance provides statutory audit services in Malta - partner-led, transparent, on time. Get a quote.

This article is prepared by EGM Assurance for general informational purposes and reflects the legal and regulatory position in Malta as at April 2026. It does not constitute legal, tax or professional advice and should not be relied on as a substitute for advice specific to your company's circumstances. Legislation and regulatory guidance are subject to change - always confirm current obligations with a qualified professional before acting.