Adequate Procedures Defence

Adequate Procedures: The Only Defence Your Company Has Under Section 17A

A practical, plain-English guide to the T.R.U.S.T. principles, what the courts expect, and how Malaysian businesses of every size can protect themselves

“But We Have an Anti-Corruption Policy”

Many business owners believe they are safe because their company has a code of conduct, an anti-bribery clause in its contracts, or a policy document sitting in a shared folder. Unfortunately, if one of their staff or agents pays a bribe to win business, that belief may not survive a day in court.

Since 1 June 2020, Section 17A of the Malaysian Anti-Corruption Commission Act 2009 (“MACC Act”) has made companies and partnerships criminally liable for bribes paid by people associated with them. The law gives the company only one way out: proving that it had adequate procedures to prevent the bribery from happening.

This article explains what “adequate procedures” means, how the five T.R.U.S.T. principles work in practice, what lessons can be learned from real cases, and what even the smallest business can do today.

Section 17A in a Nutshell

Under Section 17A, a “commercial organisation” commits an offence if a person associated with it, such as a director, employee, agent or contractor, corruptly gives or offers a bribe to obtain or retain business, or a business advantage, for the organisation. In brief:

• It is a strict liability offence. The company can be liable whether or not its top management knew about the bribe.
• The penalty is a fine of at least ten times the value of the bribe or RM1 million, whichever is higher, or imprisonment of up to 20 years, or both.
• Directors, officers and managers can be deemed personally guilty of the same offence under Section 17A(3).

With liability this strict, the adequate procedures defence becomes the single most important protection a business has.

What Is the Adequate Procedures Defence?

Section 17A(4) provides that it is a defence for the company to prove that it had adequate procedures in place to prevent persons associated with it from committing bribery. This is sometimes called a regulatory due diligence defence.

Two points are worth stressing:

• The burden is on the company. Once the prosecution establishes the offence, it is the company that must prove its procedures were adequate.
• It is the only defence. There is no other statutory escape route for the company under Section 17A.

To help businesses understand what is expected, the Prime Minister’s Department issued the Guidelines on Adequate Procedures under Section 17A(5). The aim is to encourage every business to take reasonable and proportionate steps so that it does not take part in corruption for its own advantage. In other words, the law deliberately shifts part of the burden of fighting corruption onto businesses themselves.

The Five T.R.U.S.T. Principles Explained

The Guidelines are built around five principles that apply to every commercial organisation, whatever its size or industry:

Principle 1: Top Level Commitment

An anti-bribery programme is only as strong as the culture behind it. If staff do not genuinely believe that the company has zero tolerance for bribery, the policies become boxes to tick on a checklist. That culture is set from the top, and management is expected to lead by example.

The Guidelines suggest that top-level management should, among other things:

• establish, maintain and regularly review an anti-corruption compliance programme with clear policies and objectives,
• promote a culture of integrity within the organisation,
• encourage the use of reporting channels for suspected corruption,
• appoint a competent person or function, with adequate resources, to handle anti-corruption compliance, and
• make sure the results of audits and risk reviews are reported to the full board and acted upon.

The Transparency International Malaysia (TI-M) Guidance adds a powerful message: management should make it clear that the organisation would rather lose a business opportunity than pay a bribe to win it.

Principle 2: Risk Assessment

You cannot manage a risk you have not identified. The Guidelines recommend a corruption risk assessment every three years, with further assessments whenever the law or the business changes. The assessment should consider, among other things:

• weaknesses in governance or internal systems that create opportunities for corruption,
• financial transactions that may disguise corrupt payments,
• business activities in countries or sectors with a higher corruption risk,
• external parties acting on the company’s behalf who may not comply with anti-corruption rules, and
• relationships with third parties in the supply chain.

Why does corruption happen? Understanding the causes helps a business find its weak spots. Common drivers include unchecked decision-making power, agents who are pressured to “get things done” without proper oversight, inherited corrupt practices that new staff simply continue, personal financial gain, and pressure to improve the company’s own results. Risk exists at every level, from the boardroom to the procurement officer, the accounts clerk and even the security guard.

A simple and cost-effective way to carry out a risk assessment is risk mapping, which can usually be done internally without expensive consultants or new systems:

Principle 3: Undertake Control Measures

A risk assessment is pointless if nothing is done about what it finds. The Guidelines suggest control measures such as:

• due diligence on business partners and staff before entering into a relationship, including background checks, document verification and interviews,
• reporting channels, such as a dedicated email address for smaller businesses, with the whistleblower’s identity kept confidential,
• policies on conflicts of interest, gifts, entertainment, hospitality, travel, donations, sponsorships and facilitation payments,
• financial controls, such as separate approving powers and multiple signatories, and non-financial controls, such as separation of duties and a pre-tendering process, and
• proper record keeping of everything the company does under its adequate procedures.

Third parties deserve special attention. Larger organisations should look beyond the parent company to risks in their subsidiaries, joint ventures, agents, intermediaries, service providers and vendors.

Principle 4: Systematic Review, Monitoring and Enforcement

Many companies have well-written policies that are never checked or enforced. New risks also emerge all the time, so yesterday’s policy may already be out of date. The Guidelines recommend that businesses:

• plan and maintain a monitoring programme that sets out the scope, frequency and methods of review,
• appoint a competent person or compliance function to carry out internal audits,
• consider an external audit by a qualified and independent party at least once every three years,
• monitor staff performance against the anti-corruption policies, and
• take disciplinary action against staff who do not comply.

Two other UK cases make the same point. In the Amec Foster Wheeler case, the policies that should have prevented bribery were simply not followed, and were circumvented and breached on many occasions. In Serious Fraud Office v Petrofac Ltd, which involved 11 bribery offences relating to contracts in Iraq and Saudi Arabia, senior officers were able to bypass the compliance function and overrule its objections to appointing an agent.

Principle 5: Training and Communication

Even the best policy is useless if nobody knows about it. The Guidelines recommend that the anti-corruption policy be publicly available and communicated to all staff and business associates. Communication can take many forms, including the company website, emails, newsletters, posters, the code of conduct, employee handbooks, seminars and town-hall sessions.

Businesses should plan their training as an ongoing process, including:

• induction programmes for new staff,
• regular training for employees and third parties who act on the company’s behalf, and
• proper records of the training carried out.

Training does not have to be expensive. Companies with tight budgets can include anti-corruption material in induction programmes, focus training on staff in high-risk units, and run refresher sessions online.

The First Contested Case: Why Skansen Lost

Big Companies: Much More Is Expected

For large organisations, the bar is considerably higher. Two well-known UK cases show that impressive-looking systems can still fail:

• Rolls-Royce plc had written policies on intermediaries, a ban on bribes, extra approval for commissions above 5 per cent, a cap on commissions of 10 per cent, a review by a major accountancy firm, and committees to review contracts and ethics. None of this prevented bribery across several countries, including Malaysia and China. The total financial sanction exceeded £510 million. The court later commended the company’s overhaul, which included an independent expert acting as a monitor, compulsory training, the review of 250 intermediaries (88 of whom were suspended) and disciplinary action against 38 employees.
• Airbus SE had written third-party policies and committees to review the use of agents. It later emerged that some committee members were themselves aware of or involved in the wrongdoing, and that the committees had been given incomplete or misleading information. Airbus then overhauled its systems, which included parting ways with 63 senior managers, commissioning an independent review, recruiting experienced compliance professionals and significantly reducing its use of external consultants.

The message is clear. The larger the business, the more regular and extensive its compliance reviews, risk assessments and training are expected to be.

What About Small and Medium Businesses?

According to the book, 97.4 per cent of businesses in Malaysia in 2021 were small and medium enterprises (SMEs), and 78.6 per cent of these were micro enterprises with sales below RM300,000 or no more than five employees. For them, a full-scale compliance department is simply not realistic.

The good news is that the Guidelines are not one-size-fits-all. They are meant to be applied in proportion to the size, nature, industry, risk and complexity of each business, and not every recommendation must be adopted. However, as Skansen shows, a small business still needs genuine measures. The National Centre for Governance, Integrity and Anti-Corruption (GIACC) suggests these basic steps for a small supplier company:

1. Adopt a zero-tolerance policy on corruption and express it through the company motto or code of conduct.
2. Regularly check financial documents for transactions that may hide corrupt payments.
3. Refer to published country assessments before doing business in higher-risk countries or sectors.
4. Seek advice from government agencies or private organisations on risk assessment and compliance.
5. Keep proper records of the anti-corruption policy, efforts and procedures.
6. Set up an easily accessible reporting channel, such as a dedicated email address.
7. Monitor staff and business associates to make sure they follow the zero-corruption stance.
8. Report irregularities involving real or suspected corruption.
9. Publish the anti-corruption policy on the company website, newsletters or emails.

The TI-M Guidance offers further cost-saving ideas for SMEs. Instead of hiring a consultant, a manager can be trained in basic risk assessment. Due diligence can involve a simple background or reference check, a request to see the other party’s anti-corruption policy and an internet search. Training can be done in-house, and a single session for all staff can replace multiple sessions.

Research by the OECD on large multinational companies also shows that many of the most popular anti-corruption tools cost little, such as a whistleblowing facility, accurate record keeping, a clear threat of disciplinary action, whistleblower protection and a top executive’s ethics statement. Other inexpensive options include imposing a duty on staff to report bribery, raising awareness of criminal penalties and asking staff to sign anti-corruption pledges.

Free Tools and Frameworks You Can Use

Businesses do not have to start from scratch. Several local and international bodies have published practical guidance:

Contract Clauses Help, but They Are Not Enough

Sample documents such as anti-corruption clauses in employment and commercial contracts, conflict of interest declarations, criminal record declarations, integrity pacts and an anti-corruption policy statement are useful. They tell everyone dealing with the business that it does not tolerate corruption, and they help show top-level commitment.

However, such clauses do not by themselves satisfy the adequate procedures defence. The book warns businesses against a false sense of security. Measures must be real, not merely perceived, and they must be implemented and continuously monitored.

Adequate Procedures Also Protect Directors

Under Section 17A(3), directors and managers can be deemed personally guilty when the company commits an offence. To escape liability, a director must prove that the offence happened without his consent or connivance and that he exercised proper due diligence to prevent it.

In practice, taking real steps to put the Guidelines into effect is the most practical way for top management to show that due diligence. If the company’s own defence fails, a director may still need to show the concrete steps he personally took to push for the procedures to be implemented. In short, adequate procedures protect not only the company but also the people who run it.

Criticisms and Open Questions

Section 17A has been criticised. Some argue that its heavy-handed nature adds to the cost of doing business and may discourage entrepreneurs from taking risks, which could have a chilling effect on growth. The Guidelines are also fairly high level, and because they are expressly not one-size-fits-all, businesses may be uncertain about exactly what is required. At the time the book was written, there was also little Malaysian case law to guide businesses.

The book suggests that the MACC must exercise its wide powers to charge companies and individuals responsibly, and that the courts should take into account the scale, nature, industry, risk and complexity of each business when assessing the defence.

Quick Self-Check: Is Your Business Ready?

Based on the adequate procedures checklist in the book, ask yourself the following questions. Every “No” is a gap worth closing:

• Does the company have a written anti-corruption policy?
• Is there a specific person or department responsible for anti-corruption matters?
• Are the directors and top management familiar with the MACC Act and the Guidelines on Adequate Procedures?
• Do payments need approval from sufficiently senior staff, with duties separated between different approvers?
• Does top management approve transactions that carry a high corruption risk?
• Must every payment request come with proper supporting documents and a clear description?
• Are staff required to declare conflicts of interest, and is there a procedure for doing so?
• Does the company carry out due diligence before engaging agents, consultants or contractors?
• Are there safeguards to stop improper payments being channelled through third parties, and are third parties paid only through proper channels?
• Has a corruption risk assessment been carried out in the last three years?
• Is there a confidential channel for reporting suspected corruption?
• Are staff and business partners trained, and are records of the training kept?
• Are the anti-corruption measures reviewed and audited regularly, and are breaches disciplined?

Conclusion

Under Section 17A, a business cannot rely on ignorance or good intentions. If a bribe is paid for its benefit, the company is liable unless it can prove that it had adequate procedures in place. The cases show that courts look beyond the paperwork. They ask whether the procedures were current, enforced, properly resourced and taken seriously from the top.

The encouraging news is that adequate procedures do not have to be expensive. What matters is that they are genuine, proportionate to the business and actively maintained. A business that builds its compliance programme around the T.R.U.S.T. principles today is not only protecting itself from prosecution but also building a cleaner, stronger and more trusted business for the future.

Cases Referred To

• R v Skansen Interiors Ltd, Case No T20172024 (Southwark Crown Court, 2018)
• Serious Fraud Office v Glencore Energy UK Ltd [2022] Lexis Citation 1463 and [2022] Lexis Citation 1464
• Director of the Serious Fraud Office v Amec Foster Wheeler Energy Ltd [2021] Lexis Citation 110
• Serious Fraud Office v Petrofac Ltd (Southwark Crown Court, 2021, unreported)
• R v Sweett Group plc (Southwark Crown Court, 2016, unreported)
• Serious Fraud Office v Standard Bank plc (now known as ICBC Standard Bank plc) [2015] Lexis Citation 567
• Serious Fraud Office v Rolls-Royce plc and another [2017] Lexis Citation 3
• Director of the Serious Fraud Office v Airbus SE [2020] Lexis Citation 56