Audit and Oversight Regulation Update 2026: Summary of 2025-2026 Changes

Photo by Scott Graham on Unsplash

Since 2025, audit and oversight rules in Indonesia have changed considerably. The new Criminal Code (KUHP) is in force, the Audit Board of Indonesia (BPK) has issued new audit standards that take effect around 2028, the Finance and Development Supervisory Agency (BPKP) and the Ministry of Home Affairs have issued new rules for the Government Internal Supervisory Apparatus (APIP), OJK has updated its anti-fraud and BPR internal audit rules, and state-owned enterprise (BUMN) governance has been restructured. This article serves as the summary hub, with links to our detailed articles.

All references were checked against the regulatory texts as of 23 October 2026. This article is a summary for orientation, not legal advice. For formal decisions, read the official texts and consult legal counsel. We have flagged the sections whose status is still uncertain.

What Changed in Criminal and Fraud Rules?

The new Criminal Code (KUHP) (Law 1/2023) took effect on 2 January 2026. Law 1/2026 on Criminal Penalty Adjustments amended it on the same day. For auditors, what matters most are the corruption articles and who declares state financial losses. The texts are available at Law 1/2023 and Law 1/2026.

• Article 603 (unlawfully enriching oneself) and Article 604 (abusing authority) carry life imprisonment or 2 to 20 years, with fines of category II to VI. Under Article 79, those categories are worth Rp10 million to Rp2 billion. Article 605 regulates bribery of civil servants or state administrators.
• Article 622 paragraph (1) letter l of Law 1/2026 repeals Article 2 paragraph (1) and Articles 3, 5, 11, and 13 of the Anti-Corruption Law. References to old articles in fraud policies need to be updated.
• The Elucidation of Article 603 states that state losses are assessed from the audit results of the state financial audit institution. Constitutional Court Decision 28/PUU-XXIV/2026 (2 March 2026) rejected the judicial review and interpreted that institution as the Audit Board of Indonesia (BPK).
• Supreme Court Circular (SEMA) 2/2024 (17 December 2024): it is BPK that declares whether state losses exist, but the audit results of the Finance and Development Supervisory Agency (BPKP), the Inspectorate, or a certified public accountant can still serve as a basis. Judges may also assess it from the facts established at trial.

What the Internal Audit Unit (SPI) or auditors need to do:

• Update the article references in fraud policies, investigation procedures, and report templates.
• Write findings as indications backed by evidence. Declaring state losses is not the task of internal auditors.
• Keep working papers, chronologies, and approval trails so that other examiners can use them. The basics are covered in the article fraud audit.

What Has Changed in State Financial and Regional Government Regulations?

Four new regulations affect government financial audits: one Minister of Finance Regulation (PMK) for the central government, two Minister of Home Affairs Regulations for regions, and the new State Financial Audit Standards (SPKN) from the Audit Board of Indonesia (BPK).

• Minister of Finance Regulation (PMK) 100/2025 (issued 23 December 2025) revokes PMK 231/PMK.05/2022 and applies to financial statements for fiscal year 2025. Work units conduct an inventory stock opname at least at the end of each semester. If it is not conducted for interim reports, this is disclosed in the notes to the financial statements (CaLK).
• Minister of Home Affairs Regulation 3/2026 revokes Minister of Home Affairs Regulation 4/2018, 9/2018, and 10/2018. The review of the draft Regional Government Financial Statements (LKPD) takes 7 working days after the draft is submitted, at the latest by the fourth week of February.
• Minister of Home Affairs Regulation 4/2026 (State Gazette 2026 Number 74) requires oversight targets and focus to be based on priority and risk (Article 4), and the Annual Oversight Work Program (PKPT) to take into account the number of functional auditors (Article 6). This edition is titled Year 2026, so watch for the next edition.
• Audit Board of Indonesia (BPK) Regulation 1/2026 issued 10 April 2026 and revokes BPK Regulation 1/2017. Article 9 states that it takes effect only 2 years after promulgation, around April 2028. Until then, SPKN 2017 remains the reference.

What the Internal Audit Unit (SPI) or auditors need to do:

• Central work units: match the stock opname policy and CaLK disclosures with PMK 100/2025. The practice is discussed in the article stocktaking.
• Inspectorate: replace the 2018 references with Minister of Home Affairs Regulation 3/2026 and prepare the PKPT from risk scores. See LKPD review and Inspectorate PKPT.
• Study SPKN 2026 now so the team is ready before it takes effect.

What Has Changed for the Government Internal Supervisory Apparatus (APIP)?

APIP faces changes on three layers: capability, peer review, and performance evaluation.

• BPKP Regulation 6/2025 (BN 2025 Number 995, effective 28 November 2025) replaces BPKP Regulation 8/2021. Five levels: Initiating, Structured, Adequate, Integrated, Optimal. Five elements weighted 40, 20, 20, 10, and 10 percent.
• The AAIPI external peer review guideline KEP-06/AAIPI/DPN/2024 (4 June 2024) revokes the 2019 guideline and requires an external peer review at least once every three years. Standard 1312 of SAIPI 2021 still states five years.
• AKIP evaluation still uses Minister of Administrative and Bureaucratic Reform Regulation 88/2021: agency heads evaluate AKIP every year through an evaluator team (Article 5). We found no replacement as of 23 October 2026. It is discussed in the article SAKIP evaluation.

What the Internal Audit Unit (SPI) or auditors need to do:

• Map the current state of APIP against Appendix I of BPKP Regulation 6/2025, starting with the element weighted 40 percent. See APIP capability.
• Schedule the external peer review and prepare quality assurance evidence. The guide is in APIP peer review.
• Make sure the PKPT, work programs, working papers, and follow-up status can be traced one by one. For the Government Internal Control System (SPIP), see SPIP maturity.

What Has Changed in the Financial Services Sector?

OJK has updated the anti-fraud rules for all financial services institutions and the internal audit rules for BPR and BPRS (rural banks).

• OJK Regulation (POJK) 12/2024 effective 31 October 2024, according to the OJK FAQ. The article states three months from promulgation on 31 July 2024. The anti-fraud strategy has four pillars: prevention; detection; investigation, reporting, and sanctions; and monitoring, evaluation, and follow-up. The anti-fraud unit is accountable to a member of the Board of Directors (Article 8). Fraud with significant impact must be reported within 3 working days at most for banks, BPR, securities companies, insurers, and financing companies, or 6 working days for other groups (Article 15).
• OJK Regulation (POJK) 9/2024 (effective 1 July 2024): BPR and BPRS with core capital of at least Rp50 billion must establish an internal audit work unit (SKAI). Below that, there must be one Executive Officer for internal audit (Article 79). This threshold already existed in the old regulation, POJK 4/POJK.03/2015. An audit committee is mandatory for BPR with core capital of Rp50 billion or more, with a deadline of 31 December 2025 (Articles 59 and 110).
• OJK Circular Letter (SEOJK) 9/SEOJK.03/2025 (26 May 2025) revokes SEOJK 7/2016 and 12/2019. The audit charter must be accessible on the BPR website and evaluated at least once every three years. The main audit results report is submitted semiannually (31 January and 31 July). Findings that endanger business continuity are reported within 10 working days at most.
• The rules on audit committees and internal audit units of issuers (POJK 55 and 56/POJK.04/2015) remain in force. We found no replacement. The comparison is in the article komite audit.

What the Internal Audit Unit (SPI) or auditors need to do:

• BPR: check core capital against the Rp50 billion threshold, then make sure the audit charter complies with the SEOJK and is published on the website. See internal audit of BPR and SKAI.
• Put the 31 January and 31 July deadlines and the 10 working days into the work calendar.
• Map the four anti-fraud pillars to existing policies and safeguard the independence of internal audit. See anti-fraud strategy under OJK Regulation 12/2024.

What Has Changed for State-Owned Enterprises (BUMN) and Danantara?

State-owned enterprise (BUMN) governance has changed since Law 16/2025, and the implementing regulations are still evolving. The details are in the article SOE internal oversight units after Law 16/2025.

• Law 16/2025 (6 October 2025) established BP BUMN (SOE Regulatory Agency). Article 70 requires an audit committee and leaves the details to BP BUMN regulations. Article 71 paragraph (2) states that the Audit Board of Indonesia (BPK) has the authority to audit BUMN.
• The Internal Audit Unit (SPI) obligations in Articles 67 to 69 come from Law 1/2025 and are unchanged. An SPI is established in every BUMN, and its head is accountable to the president director.
• Government Regulation 38/2026 (21 August 2026) regulates audit committees in Article 58 (Persero) and Article 90 (Perum). BP BUMN supervises compliance in an integrated, risk-based manner (Article 15). This Government Regulation contains no article on the SPI.
• BP BUMN Regulation 1/2026 revokes only Articles 162 to 197 of PER-2/MBU/03/2023. Article 29 (SPI) and Article 51 (three lines) are not revoked.
• At Danantara, Government Regulation 10/2025 Article 9 states that the supervisory board is assisted by an audit committee. Government Regulation 19/2026 does not change that article.

What the Internal Audit Unit (SPI) or auditors need to do:

• Match the SPI charter and reporting lines with Article 67 of the Law and Article 29 of PER-2.
• Document the role of the SPI as the third line and monitor follow-up until completion.
• Check the BUMN legal documentation and information network (JDIH) regularly before updating charters or audit committee governance.

What Has Changed in Internal Audit Professional Standards?

The IIA published the Global Internal Audit Standards in January 2024. The standards took effect on 9 January 2025 and replace the 2017 IPPF, according to the IIA press release.

• The structure consists of five domains and 15 principles, according to the IIA standards page.
• Topical Requirements are added as a new component. The IIA page lists Cybersecurity (effective 5 February 2026), Third-Party (15 September 2026), Organizational Behavior (15 December 2026), and Organizational Resilience (30 April 2027).
• For the Government Internal Supervisory Apparatus (APIP), the official AAIPI standard is still SAIPI 2021. We found no new SAIPI based on the GIAS.

What the Internal Audit Unit (SPI) or auditors need to do:

• Conduct a gap analysis against the five domains. The Indonesian context is in the article internal audit standards in Indonesia.
• Check whether the Topical Requirements are relevant to next year's audit plan, for example cybersecurity and third-party risk.

What Remains Uncertain as of 23 October 2026?

• The judicial review of the Elucidation of Article 603 of the Criminal Code (KUHP) on the phrase state financial audit institution is still ongoing at the Constitutional Court, so check its latest status. Articles 603 and 604 themselves were already rejected on judicial review through Constitutional Court Decision 28/PUU-XXIV/2026.
• BP BUMN Regulation on governance, SPI, and audit committees has not been found in the BUMN legal documentation and information network (JDIH). The JDIH list may be incomplete.
• An official copy of Government Regulation 38/2026 has not been found on the .go.id portal. The text was read from a State Secretariat copy on a mirror site. Verify it first before citing it in formal documents.
• The status of PER-2 and PER-3/MBU/03/2023 is a matter of interpretation. The BUMN JDIH marks all of PER-2 as no longer in force, even though the revocation article covers only Articles 162 to 197.
• Changes to POJK and SEOJK. We found no changes to POJK 12/2024, POJK 9/2024, and SEOJK 9/SEOJK.03/2025, but the OJK portal cannot be searched fully. Check ojk.go.id/regulasi.
• Other updates. The BPKP Strategic Plan 2025 to 2029 notes plans to update the SPIP maturity measurement, and Minister of Home Affairs Regulation 4/2026 is an annual edition.

How Does Internal Audit Software Help Keep Up with These Changes?

Audithink does not provide legal advice and does not assess compliance with regulations. Audithink is internal audit management software with six main features: risk assessment, audit planning, work program templates, notifications, follow-up monitoring, and automated reports. These features help prepare risk-based audit plans, standardize work programs, remind teams of reporting deadlines, and monitor follow-up of recommendations. An overview for regional APIP is in the article Audithink for Inspectorates, and for BUMN in the article Audithink for SOEs and government agencies.

FAQ on Audit Regulation Updates 2026

Conclusion

The 2025 and 2026 changes demand one habit: check the status of a regulation before citing it. Articles can be replaced, have their effective date postponed, or be challenged at the Constitutional Court.

If your team wants to tidy up audit planning and follow-up monitoring, schedule an Audithink demo.