Corporate Integrity System Malaysia: How to Protect Your Company from Bribery Charges

When a bribery charge lands on a Malaysian company, the question that follows is usually the same: was there a system in place to prevent it? Under Section 17A of the Malaysian Anti-Corruption Commission Act 2009, the answer to that question is the difference between conviction and acquittal. This article explains what the Corporate Integrity System Malaysia (CISM) covers, how ISO 37001:2025 goes further, and what specific procedures your company needs documented before any investigation begins.

What Is the Corporate Integrity System Malaysia and What Does It Cover?

The Corporate Integrity System Malaysia (CISM) is a voluntary anti-corruption framework developed by Transparency International Malaysia in collaboration with the Malaysian Anti-Corruption Commission (MACC). Companies that participate sign a Corporate Integrity Pledge (CIP), a public commitment to implement ethical business practices and maintain a corruption-free workplace.

CISM has three main components. The Corporate Integrity Pledge commits leadership to zero tolerance against bribery and corruption. The Integrity Pact applies to specific high-risk transactions such as procurement and contract awards, requiring all parties to commit to ethical conduct. The Integrity Assessment evaluates whether a company has the internal systems to support its stated commitments.

Participation in CISM is a positive signal to regulators, investors, and procurement committees. However, CISM is voluntary, not independently audited, and does not produce an externally verified certification. It is not, by itself, sufficient to raise the adequate procedures defence under Section 17A of the MACC Act if a prosecution proceeds.

What Is the Anti-Bribery Law in Malaysia That Creates Corporate Liability?

The anti-bribery law that creates corporate liability in Malaysia is Section 17A of the MACC Act 2009, which came into force on 1 June 2020.

Section 17A states that a commercial organisation commits an offence if a person associated with it, an employee, agent, director, or subsidiary corruptly gives, agrees to give, or offers any gratification for the benefit of the organisation. The offence is strict liability: the prosecution does not need to prove that the organisation directed or even knew of the act.

The penalty under Section 17A(2) is a fine of not less than 10 times the value of the gratification or RM1 million, whichever is higher, plus up to 20 years imprisonment for individuals found directly involved. For organisations with complex supply chains, the exposure from a single employee’s or agent’s conduct can result in penalties far exceeding the value of any contract won.

The only complete defence available is that the organisation had adequate procedures in place to prevent the conduct. The burden of proving adequate procedures falls on the organisation, not the prosecution.

Who Can Be Held Liable Under Section 17A of the MACC Act?

Any commercial organisation can be held liable under Section 17A not only the individual who committed the act. A “commercial organisation” includes companies incorporated in Malaysia, partnerships, and foreign companies carrying on business in Malaysia.

“Associated persons” include employees, agents, subsidiaries, and any person performing services on behalf of the organisation. This wide definition means a company can be held liable for the actions of a third-party vendor or a representative operating in a different country, as long as they acted for the benefit of the organisation.

Directors and senior officers face an additional presumption under Section 17A(3): if the commercial organisation is charged and convicted, every director, controller, officer, or partner is deemed guilty unless they can prove the offence was committed without their knowledge and that they took all reasonable precautions to prevent it.

In our work with Malaysian companies preparing for ISO 37001 certification, the most consistent shock is discovering how broad “associated persons” is. Companies that assumed their exposure was limited to their own staff find that it extends to their sales agents, distributors, and joint venture partners.

Are Directors and Senior Officers Automatically Deemed Guilty Under Section 17A?

Once a commercial organisation is convicted under Section 17A, directors, controllers, officers, and partners are presumed guilty. This reverse burden of proof means the director must demonstrate on the balance of probabilities that the offence occurred without their knowledge and that they exercised all reasonable precautions to prevent it.

A director who was genuinely unaware of a bribery act cannot simply plead ignorance. They must show that systems existed documented adequate procedures that should have caught or prevented the conduct. If those procedures exist only on paper without implementation records, the defence fails.

The MACC assesses adequate procedures against five TRUST principles: Top-level commitment, Risk assessment, Undertake control measures, Systematic review and monitoring, and Training and communication. ISO 37001:2025 maps directly to all five TRUST principles and produces the documentation trail to evidence them at every level of the organisation.

How Does ISO 37001 Protect Malaysian Companies More Than a Pledge or Policy Alone?

ISO 37001:2025 protects Malaysian companies by creating a documented, auditable anti-bribery management system (ABMS) that satisfies the adequate procedures requirement under Section 17A.

A Corporate Integrity Pledge demonstrates commitment. ISO 37001 demonstrates evidence. The difference matters in a courtroom. An ISO 37001-certified company can produce:

• A board-approved anti-bribery policy with documented commitment from top management
• A bribery risk assessment covering all operations, associated persons, and geographic markets
• A due diligence register for third-party agents, suppliers, and joint venture partners
• A whistleblowing mechanism with documented investigation procedures and response records
• Training records showing staff received role-appropriate anti-bribery training
• Internal and third-party audit records confirming the system operates effectively
• Management review records showing the system is monitored at board level

An external audit by an accredited certification body in Malaysia SIRIM QAS International, Bureau Veritas Malaysia, SGS Malaysia, or LRQA provides independent verification that the system exists and functions. This is documentation a company’s legal team can present if Section 17A proceedings begin.

According to the Suruhanjaya Syarikat Malaysia (SSM), 61 percent of companies in Malaysia do not have adequate procedures to combat bribery and corruption. That figure represents the share of Malaysian commercial organisations currently exposed to full corporate liability if a bribery incident occurs involving any associated person.

What Steps Should a Malaysian Company Take to Protect Itself from Bribery Charges?

A Malaysian company protects itself from bribery charges by implementing documented adequate procedures before any investigation begins not after. The following steps form the minimum baseline a company needs to raise the Section 17A defence credibly.

• Conduct a bribery risk assessment that covers all business units, associated persons, and third-party relationships including agents, distributors, and joint venture partners
• Adopt a board-approved anti-bribery policy with a written zero-tolerance commitment signed by the most senior officer in the organisation
• Appoint a compliance function or compliance officer with the authority and resources to implement and maintain the anti-bribery management system
• Implement due diligence procedures for all high-risk third parties before engaging them and at renewal documented, not verbal
• Establish a confidential whistleblowing channel with a written procedure for investigating reports and protecting reporters from retaliation
• Deliver role-appropriate anti-bribery training to all staff, with records showing who was trained, when, and on what content
• Engage an accredited certification body SIRIM QAS International, Bureau Veritas Malaysia, SGS Malaysia, or LRQA to independently audit and certify the system to ISO 37001:2025

Each step produces a document. Each document is potential evidence. Companies that complete this process before a bribery allegation arises have the foundation for an adequate procedures defence. Companies that begin only after an allegation surfaces face a much harder case.

The Company That Built Its System Before the Investigation Gets the Defence

CISM participation and an internal anti-bribery policy send the right signal. They do not produce the evidence a company needs to mount the adequate procedures defence under Section 17A if MACC investigates.

ISO 37001:2025 builds that evidence documented, audited, and externally verified. The companies that hold certification before a bribery incident occurs are the ones that can credibly rely on the Section 17A defence. Those that rush to implement a system after an allegation surfaces face a much harder argument to make in court.

Protect your business from bribery risks. Get ISO 37001 certified with Connext.

Frequently Asked Questions

What is the anti-bribery law in Malaysia?

The primary anti-bribery law in Malaysia is the Malaysian Anti-Corruption Commission Act 2009 (MACC Act). Section 17A, which came into force on 1 June 2020, creates corporate liability for bribery committed by any person associated with a commercial organisation. The penalty is a fine of at least 10 times the value of the bribe or RM1 million, whichever is higher, plus up to 20 years imprisonment for individuals directly involved.

What are the six principles of anti-bribery?

ISO 37001 and UK Bribery Act guidance reference six anti-bribery principles: proportionate procedures, top-level commitment, risk assessment, due diligence, communication and training, and monitoring and review. Malaysia’s MACC uses five TRUST principles Top-level commitment, Risk assessment, Undertake control measures, Systematic review, and Training which align with ISO 37001:2025.

Who can be held liable under Section 17A?

Any commercial organisation operating in Malaysia can be held liable under Section 17A, including locally incorporated companies, partnerships, and foreign companies doing business in Malaysia. Directors, controllers, officers, and partners are also presumed guilty if the organisation is convicted, unless they prove they were unaware of the offence and took reasonable precautions to prevent it.

Are directors and senior officers automatically deemed guilty under Section 17A of the MACC Act?

Once a commercial organisation is convicted under Section 17A, directors and senior officers are presumed guilty. The burden of proof falls on the individual to show the offence occurred without their knowledge and that they exercised all reasonable precautions to prevent it. This makes it essential for senior officers to have documented anti-bribery procedures in place before any incident occurs.

What is the Corporate Integrity System Malaysia?

The Corporate Integrity System Malaysia (CISM) is a voluntary anti-corruption framework developed by Transparency International Malaysia in collaboration with MACC. Participating companies sign a Corporate Integrity Pledge committing to ethical business practices. CISM is not independently audited and does not produce a certification, but it demonstrates intent and commitment to anti-corruption values as a starting point.