Public Money

How to read an Auditor-General's report without getting lost in the annexes

The office's reports follow a consistent structure once a reader knows where each finding sits and what each status marker means.

By Suhaila Merican · 20 July 2026 · 7 min read

Case names, entities and officials in this report are composite and illustrative. References to public bodies describe their statutory role only.

What the report is

The mandate of the Auditor-General's office covers the accounts of the federal government, state governments, statutory bodies and government-linked companies above a defined ownership threshold. That mandate is set out in the constitutional and statutory provisions each year's report cites on its opening page, and it draws a firm line the office does not cross: financial and compliance audits of how public money was accounted for and spent, not criminal investigation and not a judgment on policy choices. A reader who expects a finding of wrongdoing from these pages is reading the wrong document; what the office produces is a structured description of whether records, controls and reported figures hold together.

Three audit types make up the bulk of the annual series: financial statement audits, which test whether an entity's accounts fairly represent its financial position; compliance audits, which test whether spending followed the procedures a budget or a contract required; and performance audits, which test whether a programme achieved what its stated objectives promised for the money committed to it. A single annual report typically bundles findings from all three types across dozens of entities, which is part of why the document runs to hundreds of pages and why most readers only ever open the summary volume.

The summary volume exists for exactly that reason. It compresses each entity's findings into a short narrative and a handful of headline figures, with a reference number pointing to the fuller finding in the detailed volume. Reading only the summary is a reasonable starting point, but it strips out the qualifying language — sample sizes, time periods, the specific control that was tested — that the detailed volume keeps, and that language is often where the real caveats on a headline figure live.

How it is organised

Each report is organised by entity first and by finding type second, not the other way around. A single ministry's chapter will typically open with a short profile of its budget for the year under review, followed by financial statement findings, then compliance findings, then any performance audit that touched that ministry during the cycle. Cross-referencing a specific concern — say, a category of procurement spending — across multiple ministries requires working through each entity's chapter individually, since the report is not indexed by topic in a way that lets a reader search across entities directly.

Findings within a chapter follow a consistent internal template: a description of what was tested, the criteria against which it was tested, what the audit found, the entity's own response where one was provided, and a status field. That template repeats regardless of the finding's size, which means a single missing signature on a claim form and a multi-million-ringgit variance in a development account can appear in structurally identical entries — a reader has to read the substance of each finding rather than relying on its position in the chapter to judge its weight.

Reports are tabled in the Dewan Rakyat during a scheduled sitting each year, and from that point they become public documents available through the office's own archive. Tabling in the Dewan Rakyat is a procedural step that makes the report public and eligible for further parliamentary scrutiny; it is not itself a decision on any finding within it, and the report's content is fixed by the time tabling happens — nothing in the document changes as a result of the sitting itself.

Reading a finding

A well-formed finding names the specific control or procedure being tested, states the criteria — typically a clause in a financial procedure act, a treasury circular, or the entity's own approved manual — against which performance is measured, and reports a gap between what the criteria required and what the sample showed. The sample size matters more than most readers initially treat it: a finding based on a full-population check of every transaction in a category carries a different evidentiary weight than one based on a sample of twenty files drawn from several thousand, and the report generally states which applies, though not always prominently.

Monetary figures attached to a finding are not always what they first appear to be. A reported variance can represent money that cannot be accounted for, money that was spent outside the approved procedure but for a documented and legitimate purpose, or money that is simply unreconciled between two internal ledgers pending a clerical correction. The report's own wording usually distinguishes between these categories, and conflating them — treating every large figure as money that has gone missing — is the single most common misreading of the document, and checking the report's own definitions against a headline figure before drawing a conclusion is the surest way to avoid it.

Entity responses, printed alongside each finding, are worth reading in full rather than skimming past. An entity that accepts a finding and describes a corrective step in progress is in a materially different position than one that disputes the criteria used or claims the finding rests on incomplete information. Both kinds of response appear in the same font and the same box, and only the text itself distinguishes them.

Follow-up status

Findings from prior cycles are not simply dropped once printed; a follow-up section, usually near the end of each entity's chapter or in a dedicated follow-up volume published separately, tracks whether an earlier finding was resolved, partially resolved, or remains open in the current cycle. This is the section most likely to be skipped by a reader working chapter by chapter in publication order, since it requires holding two years' documents side by side rather than reading one report start to finish.

A status marked 'resolved' typically means the entity implemented the specific corrective action described in its earlier response and a follow-up check confirmed the control now operates as intended; 'partially resolved' generally means some but not all of a multi-part finding was addressed; 'open' means the underlying gap persists. None of these three markers carries a penalty attached within the report itself — the document records status, and any consequence that follows sits with other mechanisms outside the audit report, including the Public Accounts Committee process described elsewhere under Institutions.

Common misreadings

The most frequent error is treating the report's total headline figure — often summed across every entity's compliance and financial findings for the year — as a single measure of loss or theft. That total mixes categories as different as an unreconciled ledger entry, a late submission of supporting documents, and a payment made without the required second approval; adding them together produces a number that is arithmetically correct and analytically almost meaningless without breaking it back down by category.

A second common error is assuming a finding's absence means a clean bill of health for an entity that was not, in fact, tested that year. The audit cycle rotates entities and topics rather than testing every entity on every dimension annually, and the report's own scope notes, usually in a short paragraph at the start of each chapter, state which categories were and were not examined for that entity in that cycle. An entity with no findings in a given year may simply not have been tested on the dimension a reader cares about.

Where to find past editions

The office maintains a public archive of past reports, organised by year and by report series — federal, state, and the separate series covering government-linked companies — going back well over a decade in digital form, with older editions available on request in physical form from the office's records desk. Each report in the archive carries the same internal structure described above, which means a reader who learns to navigate one year's document can apply the same approach to any other year without relearning the format.

The archive's search index allows filtering by entity name and by year, but not, at present, by finding type or keyword across the full text of every report, which means a reader looking for every past finding on a specific topic — a category of procurement spending, say — has to open each year's relevant chapter individually rather than running a single search across the whole series.

Readers keep asking me for the number that tells them how much was stolen. That number doesn't exist in this document, and looking for it is how most misreadings start.