LHDN tax audit in Malaysia: how it works, and how to be ready

Few letters unsettle a Malaysian business owner like one from Lembaga Hasil Dalam Negeri (LHDN) opening an audit. The good news is that an audit is a routine, rules-based process — not an accusation — and the businesses that come through it cleanly are simply the ones that prepared. This guide explains how an LHDN tax audit and a tax investigation actually work in Malaysia, the exact penalty bands under the Income Tax Act 1967, and a concrete readiness checklist, all verified against the Inland Revenue Board's own published frameworks. Carriera is a compliance-focused organisation — our recruitment practice screens for tax and finance literacy, and Carriera Academy runs HRD Corp-claimable training on exactly this subject.

What is the difference between an LHDN tax audit and a tax investigation?

They are two different processes with very different stakes. A tax audit is a civil compliance check — LHDN verifies that the income and deductions in your return are accurate. A tax investigation is an enforcement action to gather evidence of deliberate evasion or fraud, and it can be criminal. The two run under separate published frameworks, confirmed on LHDN's own framework legislation page: the Tax Audit Framework on Income Tax and Employer (effective 15 March 2025) and the Tax Investigation Framework 2024.

The practical signals are different too. An audit is announced in writing and, where a site visit happens, it is by appointment. An investigation may arrive without notice and can involve coercive powers. As Grant Thornton Malaysia sets out, investigation officers can be empowered to freeze, seize or forfeit assets linked to suspected evasion, and there is no time limit on assessments in fraud cases. Knowing which one you are facing — from the letter's wording and the framework cited — is the first move.

What are the stages of an LHDN tax audit?

An LHDN tax audit follows a defined sequence under the Tax Audit Framework: selection, notification, examination (desk or field), findings, and then settlement or appeal. Understanding each stage tells you what is happening and what is expected of you at every point.

For most well-run SMEs the whole process is documentary. Where it goes wrong is almost never the rate of tax — it is the inability to evidence a number on the return. A deduction you genuinely incurred but cannot support with a contemporaneous record can still be disallowed. That is why our guides on deductible business expenses under the ITA 1967 and on the LHDN capital statement matter: they are the two areas auditors probe hardest.

What penalties can LHDN impose under the Income Tax Act 1967?

Penalties depend on what is found and whether it was deliberate. Where an audit shows income was understated, LHDN imposes a penalty under section 113(2) on the additional tax; under the Tax Audit Framework that rate is graduated by your offence history. Outright evasion is punished far more severely under section 114. The bands below are taken directly from LHDN's official offences and penalties page.

Two points are worth internalising. First, voluntary disclosure before an audit begins is almost always treated more leniently than an adjustment forced out of you during one — coming forward early reduces the penalty exposure. Second, a section 113(2) penalty is generally not imposed for a genuine technical adjustment — a defensible difference of legal interpretation — as opposed to an understatement. The line between the two is exactly where good records and good advice pay for themselves.

How many years can LHDN audit, and how long must I keep records?

These are two different clocks, and confusing them is a common and costly mistake. The time bar on assessments and the record-keeping period are not the same length.

• The audit time bar is five years. Under section 91 of the Income Tax Act 1967, LHDN generally must raise an assessment or additional assessment within five years from the end of the relevant year of assessment, as confirmed in Malaysian tax-litigation guidance from Lexology.
• That limit falls away for fraud, wilful default or negligence. In those cases LHDN may raise an assessment at any time — which is one reason an investigation has no real time horizon.
• You must keep records for seven years. Sections 82 and 82A require a taxpayer carrying on a business to retain sufficient records for at least seven years from the end of the year of assessment, per Malaysian accounting guidance citing the ITA at ANC Group. Records may be physical or electronic.

The two-year gap between the five-year time bar and the seven-year retention rule is deliberate: it gives LHDN room to look at older years where fraud is suspected. So “the audit window has closed” is never a reason to shred anything early.

How do I prepare my records for an LHDN audit?

Readiness is not about predicting the audit — it is about being able to evidence every figure on your return on demand. Work through these twelve items now, not when the letter arrives.

What rights do I have during an LHDN tax audit?

The Tax Audit Framework is not one-directional — it commits LHDN to fair, courteous and confidential conduct, and it gives you clear entitlements. Knowing them keeps an audit professional and bounded.

• To written notification stating the years of assessment and the scope under audit.
• To be represented by a licensed tax agent or appointed representative throughout the process.
• To confidentiality — your information is handled under statutory secrecy obligations.
• To have findings explained and to receive the basis for any proposed adjustment.
• To a reasonable time to gather documents and respond to queries.
• To courteous, professional conduct by audit officers, as the framework requires.
• To appeal an assessment you disagree with by filing Form Q to the Special Commissioners of Income Tax within 30 days of the assessment.

An audit handled with prepared records and a competent agent is, in the overwhelming majority of cases, a manageable administrative exercise. The fear comes from not knowing the rules — which is precisely what this guide, and the right training for your finance team, are designed to remove.

This guide is general information, not tax or legal advice. For the binding position, refer to the Income Tax Act 1967, LHDN's Tax Audit Framework on Income Tax and Employer (effective 15 March 2025) and the Tax Investigation Framework 2024 at hasil.gov.my, and engage a licensed tax agent. Updated 18 June 2026.