- A corporate compliance audit is a systematic examination of whether all the company’s legal and regulatory obligations have been fulfilled before problems emerge on their own.
- Many compliance risks are invisible in everyday operations and only emerge during corporate changes, due diligence, or inspections by authorities.
- A proactive audit is far less costly and more efficient than addressing compliance problems that have already become serious obstacles.
- For PT PMA companies, a compliance audit needs to cover corporate matters, business licensing, investment reporting, and immigration simultaneously.
- A good audit result is more than a list of problems: it is a roadmap for improvements that can be acted on immediately.
A corporate compliance audit is one of the most strategic steps a company can take, yet also one most frequently postponed until external pressure forces it. Many companies only examine their compliance position once a problem has emerged: when a permit is rejected, corporate changes are obstructed, or a potential investor discovers irregularities during due diligence. All these scenarios could be avoided if an audit were conducted earlier, before problems became real and corrective costs substantially higher.
This article explains what is actually examined in a corporate compliance audit, the right time to conduct one, and how its results can provide the basis for concrete actions that strengthen the company’s legal position.
What Is Actually Examined in a Compliance Audit?
A corporate compliance audit goes beyond checking whether documents exist. It examines whether the company’s actual position, from its ownership structure and data registered in various government systems to reporting obligations and existing permit status, is internally consistent and conforms to applicable law.
For companies operating in Indonesia, particularly PT PMA companies, several layers must be examined simultaneously.
Consistency of Corporate Documents
Is the data in the deed of establishment and latest amendment deed consistent with that registered with the Ministry of Law and Human Rights through AHU Online? Have changes to management or capital been approved by the ministry but not yet updated in OSS? Discrepancies between these two systems are among the most common problems identified in audits.
Business Licensing Status in OSS
Do the registered KBLI codes still reflect actual business activities? Are new business activities already being conducted without registration? Are the Standard Certificates associated with particular KBLI codes still valid? For PT PMA companies, does the recorded foreign ownership composition still comply with the currently applicable DPI provisions?
BKPM Reporting Compliance
PT PMA companies must periodically report investment realization to BKPM. An audit needs to check whether all required reports have been submitted on time and, if any were missed, the extent of the backlog and what must be done to clear it.
Expatriates’ Immigration Status
For companies with foreign directors or specialists, an audit needs to examine their KITAS or KITAP status: whether it remains valid, whether its type still matches the person’s actual role in the company, and whether structural changes in the company require corresponding updates to immigration documents.
When Should a Compliance Audit Be Conducted?
Certain moments naturally create a need for a compliance audit. Recognizing them early helps companies prepare appropriately.
The following situations most commonly require a corporate compliance audit:
- Before major corporate changes, such as a new investor joining, director changes, or adding business sectors, to ensure no inconsistencies will complicate the process.
- Before due diligence by a potential investor or buyer, so findings that could affect negotiations are already known and addressed.
- When the company will apply for a new sectoral permit requiring a clean compliance record.
- After several years of operating without a comprehensive compliance review, because obligations may have been overlooked unknowingly over time.
- When significant regulatory changes occur, such as a KBLI system update or changes to DPI provisions, that may affect the company’s compliance position.
- Before the overseas parent company conducts a consolidation or group audit covering the Indonesian entity.
What a Good Audit Produces
A properly conducted compliance audit produces more than a list of problems. Equally important is a clear roadmap setting out what needs correcting, in what order of priority, and through which mechanisms. Without that roadmap, audit findings become a document that generates anxiety without direction.
A good audit also distinguishes between issues needing immediate attention and those manageable over a more flexible timeframe. Findings do not all carry the same urgency, and understanding this hierarchy matters for allocating company resources appropriately.
JHY Legal prepares audit results as an actionable compliance roadmap as well as an inventory of issues, with time estimates and the steps needed for each item requiring attention.
The Difference Between Internal and External Audits
Companies of sufficient size often have an internal compliance function. This is beneficial, but internal audits have limitations that need to be understood.
Internal teams managing day-to-day compliance tend to be accustomed to the company’s conditions, making it easier to overlook matters considered “normal” even when they need reconsideration. They may also not always track the latest relevant regulatory changes, such as the KBLI 2025 system update or changes to BKPM reporting requirements.
An external audit by a party with in-depth regulatory understanding offers a fresh and more objective perspective. It complements the internal function by independently validating the existing compliance position, rather than replacing it.
JHY Legal’s Experience in Corporate Compliance Audits
JHY Legal is a legal advisory firm focused on immigration, corporate actions, and regulatory licensing in Indonesia, founded by legal practitioners with litigation and corporate backgrounds. In our corporate compliance audit service, we comprehensively examine the company’s compliance position, from corporate document consistency, OSS licensing status, and BKPM reporting compliance to the immigration status of expatriates connected to the corporate structure. Every audit we undertake produces a concrete compliance roadmap: what is wrong and how to correct it, in a priority order that considers urgency and the impact on the client’s business operations.
Begin with the Simplest Questions
The first step toward a compliance audit need not be comprehensive immediately. Begin with the simplest questions: does the company’s OSS data still reflect its actual position? Have all BKPM reports been submitted? Will any expatriate KITAS expire within the next six months? These three questions are enough to establish whether anything needs immediate follow-up.
Companies managing compliance proactively, rather than waiting for external pressure, have a real advantage: they can move faster when opportunities require corporate changes, and enter due diligence without uncertainty that weakens their negotiating position.
If a more comprehensive compliance review is needed, particularly before a major planned change, JHY Legal is ready to help design and conduct an audit whose results can actually be acted upon.