What is Section 17A?
Section 17A of the MACC Act introduced corporate liability for corruption: a commercial organisation can be held liable if a person associated with it commits bribery for the organisation's benefit. Crucially, the organisation has a defence if it can show it had "adequate procedures" in place to prevent bribery. This shifted anti-corruption from a "nice to have" to a governance priority for directors.
How ISO 37001 helps
ISO 37001 provides a structured way to design, implement and demonstrate anti-bribery controls — the very kind of procedures Section 17A expects. While certification is not a legal guarantee, an ISO 37001-based ABMS gives you a recognised, independently audited framework that evidences your commitment and your controls. It aligns closely with the principles behind Malaysia's adequate-procedures guidance (often summarised as the "T.R.U.S.T." principles: Top-level commitment, Risk assessment, Undertake controls, Systematic review, and Training).
What an ISO 37001 system includes
- Top-level commitment and an anti-bribery policy.
- Bribery risk assessment across your operations and relationships.
- Due diligence on business associates, agents and personnel.
- Controls on gifts, hospitality, donations and third parties.
- A whistleblowing / reporting channel and investigation process.
- Training and awareness for staff and relevant associates.
- Monitoring, internal audit and review to keep it effective.
Who should consider ISO 37001?
- Government-linked companies and their suppliers.
- Contractors and vendors bidding for public or large-enterprise work.
- Organisations with agents, intermediaries or high-value procurement.
- Any business that wants to protect its directors and demonstrate integrity to partners.
Is certification mandatory?
No — ISO 37001 certification is voluntary, and having it is not an automatic legal shield. But it is one of the clearest, most recognised ways to build and evidence the adequate procedures Section 17A expects, and it is increasingly requested in tenders and due diligence. For many organisations, that combination of governance protection and commercial credibility makes it well worth doing.
Wondering if ISO 37001 is right for your organisation? See Irvin's ISO 37001 training and consulting or book a free consultation.
Frequently asked questions
No. ISO 37001 is not an automatic legal defence, but it provides a recognised, auditable framework of anti-bribery controls that strongly supports the 'adequate procedures' a commercial organisation is expected to have under Section 17A.
No, it is voluntary. However, it is increasingly requested in tenders and vendor due diligence, particularly for government-linked companies and their suppliers.
For most organisations, three to six months depending on size, bribery risk exposure and existing governance. Irvin gives you a realistic plan at the consultation.