Last week, I had my first encounter with the Malaysian Anti-Corruption Commission (Suruhanjaya Pencegahan Rasuah Malaysia or SPRM).

A team of officers visited our office to review one of our client’s 𝗮𝘂𝗱𝗶𝘁 𝘄𝗼𝗿𝗸𝗶𝗻𝗴 𝗽𝗮𝗽𝗲𝗿𝘀. They asked questions, reviewed documents, and even requested the contact details of the person-in-charge (PIC) for potential follow-ups.

It was a professional exchange, but it got me thinking: How often do auditors get caught in the dilemma of releasing audit working papers to third parties?

As an auditor, I am extremely strict when it comes to sharing our 𝘄𝗼𝗿𝗸𝗶𝗻𝗴 𝗽𝗮𝗽𝗲𝗿𝘀. These documents are the backbone of an audit, containing confidential data, professional judgments, and evidence supporting the auditor’s opinion.

Handing them over isn’t as simple as it may seem, and auditors must tread carefully to avoid breaching confidentiality agreements or compromising their independence.

In my practice, the release of audit working papers is limited to very specific circumstances. Only four parties qualify:

1. Incoming auditors – when a company changes auditors, the incoming firm may need access for opening balance.
2. SSM (Companies Commission of Malaysia) – if requested as part of a regulatory investigation.
3. IRB (Inland Revenue Board) – when tax audits or investigations require deeper insights.
4. SPRM (Malaysian Anti-Corruption Commission) – for cases involving anti-corruption reviews or investigations.

Even with these exceptions, proper documentation is non-negotiable. I never entertain shareholder, tax agent, lawyer and etc.

I always ensure we have clear records of any request, including the purpose and scope, before releasing any working papers.

This protects both the client and our firm, ensuring we act with integrity and transparency.

The key takeaway?

Auditors aren’t gatekeepers of secrets but guardians of trust. Every working paper contains not just numbers but professional judgment and responsibility.

It’s our job to release them only when absolutely necessary and with the right safeguards in place.

It was an interesting first experience dealing with SPRM officers, and it serves as a timely reminder: while external parties may have legitimate reasons for access, the auditor’s role is to balance transparency with responsibility. #auditor #auditlife #ktp #myktp