Section 17A adequate procedures: a practical checklist for Malaysian companies

Since 1 June 2020, a commercial organisation in Malaysia can be held liable when a person associated with it gives or offers a bribe to win or keep business, or to gain an advantage, for the organisation. That is the effect of section 17A of the Malaysian Anti-Corruption Commission Act 2009. The only defence the section offers is to prove that the organisation had adequate procedures in place to prevent that conduct.

This checklist walks through what “adequate procedures” means in practice, using the structure of the government’s guidance.

Why it matters

• The penalty is significant. On conviction, an organisation faces a fine of not less than ten times the value of the gratification or RM1 million, whichever is higher, or imprisonment of up to 20 years, or both.
• Directors and management are exposed personally. Where the organisation commits the offence, its directors, controllers, officers, partners and those concerned in its management are deemed to have committed it too, unless they prove it happened without their consent and that they exercised due diligence to prevent it.
• “Associated persons” reach beyond employees. They include directors, partners and employees, and people who perform services for or on behalf of the organisation, such as agents, consultants and some contractors.

The T.R.U.S.T. principles

The Guidelines on Adequate Procedures, issued by the Prime Minister’s Department under section 17A(5), set out five principles. Use them as a checklist.

T: Top-level commitment

• The board and senior management have approved an anti-bribery and corruption policy, and say so publicly.
• Someone senior is accountable for the anti-corruption programme and reports to the board.
• Gifts, entertainment, hospitality, donations and sponsorships are covered by clear rules and limits.

R: Risk assessment

• You have identified where bribery could occur in your business: licences and permits, procurement, sales through agents, customs and logistics, dealings with public officials.
• Each risk is rated and has an owner and a treatment.
• The guidelines advise a comprehensive corruption risk assessment every three years, with interim assessments whenever something significant changes, such as a new market, a new agent model or an acquisition.

U: Undertake control measures

• Due diligence on third parties before you appoint them, proportionate to their risk.
• Anti-bribery clauses in contracts with agents, suppliers and contractors.
• Financial controls over payments, commissions, petty cash and expense claims.
• A whistleblowing channel people trust, with protection against retaliation and a protocol for investigating what comes through it.

S: Systematic review, monitoring and enforcement

• Internal audit tests the anti-corruption controls as part of its plan.
• Breaches lead to consistent disciplinary action.
• Management reviews the programme’s effectiveness and reports the results to the board.

T: Training and communication

• The policy is communicated to employees and to relevant third parties.
• Staff in higher-risk roles receive targeted training, refreshed regularly, with attendance recorded.

Where reviews usually find gaps

• A policy without a risk assessment. Procedures copied from a template, not built around the organisation’s actual exposure.
• Third parties left out. Agents and contractors acting on the company’s behalf, with no due diligence or contractual commitment.
• No evidence. Training, approvals and reviews that happen but are not recorded, so they cannot be shown when it matters.
• A whistleblowing channel nobody uses, or one that reports to the people it should be able to report on.

Does ISO 37001 certification satisfy section 17A?

Not automatically. ISO 37001 is an international anti-bribery management system standard. It aligns well with the T.R.U.S.T. principles and gives you an independent, audited framework, but it is broader than the legal defence and certification is not the same as proving adequate procedures in court. Many organisations start with an adequate procedures gap review and decide on certification afterwards.

Next step

An independent adequate procedures review compares your current framework with the guidelines, rates the gaps by risk and gives you a practical plan to close them, with the evidence trail the defence depends on.

This article is general information, not legal or professional advice. Requirements can change; check the current law and guidance, or speak to us about your circumstances.