Audit and Compliance in Indonesia

Foreign investors in Indonesia face a compliance environment that has tightened considerably. Annual reports that were once internal documents must be filed electronically with the Ministry of Law, and companies that fail to do so risk having corporate actions such as director changes and share transfers blocked.

Contributing Advisor

Duha Ziaun

Senior Associate, Corporate Accounting Services

At the same time, the tax authority's CoreTax system now matches invoicing, payroll, and financial reporting data in near real time, leaving far less room for informal record-keeping.

There is still no single unifying statute governing audit and compliance in Indonesia. Obligations are spread across the Company Law, the Investment Law, tax legislation, and sector regulations, and the triggers for a mandatory audit are broader than many investors assume. Turnover, bank lending conditions, and public-fund activities can all require an audit even where the asset threshold is not met. This article sets out who must be audited, what must be filed and where, the deadlines that apply, and the consequences of getting it wrong.

Which companies must be audited in Indonesia?

Article 68 of the Company Law (Law No. 40 of 2007) requires a limited liability company to have its financial statements audited by a public accountant where any of the following apply:

• The company's business involves collecting or managing public funds (banks, insurers, fund managers);
• The company issues debt instruments to the public;
• The company is a publicly listed company;
• The company is a state-owned enterprise;
• The company has assets and/or business turnover of at least IDR 50 billion (approx. US$3.1 million); or,
• An audit is required by legislation applicable to the company's sector.

For most PT PMA (foreign-owned) companies, the IDR 50 billion asset/turnover threshold is the trigger that applies in practice, and the turnover limb is frequently overlooked. An asset-light services or trading entity can cross IDR 50 billion in revenue well before its balance sheet looks "large." Conversely, asset-heavy sectors such as manufacturing, real estate, hospitality, and energy can cross the asset threshold before generating equivalent revenue, sometimes in their first full year of operations.

Two further triggers deserve attention. First, lenders commonly require audited financial statements as a credit condition, which makes an audit contractually mandatory regardless of size. Second, a separate obligation under Minister of Trade Regulation No. 25 of 2020 requires companies above a lower IDR 25 billion asset threshold to submit annual financial statements (LKTP) to the Ministry of Trade, a distinct filing that is often confused with the statutory audit requirement.

Once audited, financial statements must be confirmed by the Finance Professions Supervisory Centre (PPPK) through its QR-code verification mechanism, and the audited version constitutes the only legally recognized set of financial statements. For foreign groups accustomed to maintaining separate management and statutory books, this is the point at which discrepancies surface.

What changes under Permenkum 49/2025, and why does it matter now?

Minister of Law Regulation No. 49 of 2025 (Permenkum 49/2025), effective December 17, 2025, is the most significant change to Indonesian corporate reporting in years. Under the previous regime, the annual report was approved at the shareholders' meeting and kept on file. Under the new regulation, every PT, including every PT PMA, with no size-based exemption, must file its shareholder-approved annual report with the Ministry of Law through the SABH system (AHU Online).

The mechanics work as a chain of deadlines:

• Hold the AGMS within six months of the financial year-end and obtain shareholder approval of the annual report and financial statements;
• Notarize the resolutions in a notarial deed; and
• File through SABH within 30 days of the deed being signed, via the notary.

SABH filing went live on June 1, 2026, and the state fees (PNBP) currently applied ranged from IDR 250,000 – 500,000 (USD 14-28).

Administrative sanctions are expected to take effect from November 2026: a written warning first, followed, if the filing is not remedied within 30 days, by blocked access to SABH.

The blocking sanction is what makes this a board-level issue rather than a paperwork item. A company with suspended SABH access cannot register director or commissioner changes, shareholder updates, capital amendments, or restructurings. In practice, non-compliance can also complicate license renewals and bank credit assessments, and it is visible to counterparties conducting due diligence. For a foreign headquarters planning a reorganization or leadership change in its Indonesian subsidiary, an unfiled annual report becomes a hard blocker at exactly the wrong moment.

What are the annual financial reporting rules for PT PMA companies?

Financial statements must be prepared in accordance with Indonesian accounting standards (SAK), in the Indonesian language, and in rupiah, but the currency rule has a pathway that foreign investors should use rather than work around.

PT PMA companies, permanent establishments, and subsidiaries of foreign entities may apply to the Directorate General of Taxes (DGT) for approval to maintain USD bookkeeping. The application must be made at least three months before the start of the USD accounting year, and approval is deemed granted if the DGT does not respond within the statutory window, a deemed-approval mechanism that few first-time investors are aware of.

Records must be retained for ten years, the practical standard of record-keeping has risen. CoreTax links tax reporting, e-invoicing, payroll withholding, and financial accounting into a single monitored data flow, with matching performed in near real time. Inconsistencies between VAT invoices, payroll filings, and the annual financial statements are now surfaced by the system itself rather than discovered (or not) in a periodic audit. Entities that historically ran informal "dual books" face a materially higher detection risk.

What does the compliance calendar look like?

For a PT PMA with a December 31 financial year-end, the core obligations stack as follows:

Note that the tax return and the SABH annual report are separate obligations to separate authorities, filing one does not discharge the other, and each carries its own sanction regime.

What are the rules on auditor independence and rotation?

Indonesia limits how long the same individual public accountant may audit a company, currently five consecutive financial years under Government Regulation No. 20 of 2015, with no statutory limit on the audit firm itself. Stricter rotation and cooling-off rules apply to entities supervised by the Financial Services Authority (OJK), including banks, insurers, and listed companies.

Foreign groups should align the Indonesian rotation cycle with group auditor arrangements early; a forced mid-cycle rotation is disruptive and avoidable.

How do tax audits work, and what is the one-month rule?

The DGT initiates tax audits to verify compliance or in response to refund claims, overpayment positions, or loss declarations, VAT refund requests are a near-automatic trigger. Taxpayers must respond to document requests within one month; documents not provided within that window generally cannot be introduced later in the objection process. This makes audit-readiness a live concern, not a contingency: intercompany charges, transfer pricing documentation under PMK 172/2023, and reconciliations between commercial and fiscal books should be maintained continuously rather than reconstructed under deadline pressure.

What penalties apply, and what happens if you disagree with an assessment?

Since the Harmonized Tax Law (Law No. 7 of 2021), interest penalties on underpaid tax are no longer the flat 2 percent per month of the old regime. They are calculated using a monthly benchmark rate set by the Minister of Finance plus an uplift, capped at 24 months. Administrative surcharges of 50–100 percent can apply where underpayments are identified through audit or where objections and appeals are unsuccessful, which is why the decision to dispute an assessment should be made on advice, not reflex.

A taxpayer that disagrees with an assessment has a structured escalation path:

Each stage carries strict formal requirements and cost exposure if unsuccessful. For most foreign investors, the more valuable exercise is upstream: ensuring the documentation position is strong enough that assessments are either avoided or readily defended. Dezan Shira & Associates' tax advisory team supports clients through audits, objections, and appeals across Indonesia.

Indonesia's compliance environment shifted structurally in 2026, not just procedurally. The CoreTax system means the tax authority no longer has to wait for an audit to surface a discrepancy between a company's VAT invoices, payroll filings, and financial statements — those mismatches are visible in near real time. Foreign investors accustomed to reconciling that data annually are operating on a timeline that no longer matches the regulator's.

Duha Ziaun

Senior Associate, Corporate Accounting Service

Talk to an expert at duha.ziaun@dezshira.com

Or request a consultation at +62 21 5748 528