Spotting Corruption Before the MACC Does: Risk Mapping and Data Analytics for Companies

Spotting Corruption Before the MACC Does: Risk Mapping and Data Analytics for Companies

Why corruption happens inside organisations, where to look for it, and simple, low-cost tools every Malaysian business can use to catch it early

Why “We Have a Policy” Is Not Enough

Corruption can happen in any organisation, big or small, and it is practically impossible to eliminate it completely. In a large company, decisions made by management are carried out by a long chain of employees. In a small company, decisions often rest with just one or two people. Either way, there are plenty of opportunities for bribery, whether sanctioned from the top or carried out on the ground to push decisions through.

Two well-known UK cases show how easily corruption can go unnoticed:

• In R v Skansen Interiors Ltd, the first contested case under the UK’s “failure to prevent bribery” offence (the model for Malaysia’s Section 17A), the bribery was carried out by the company’s own managing director. It was only discovered when a new managing director came on board.
• In Serious Fraud Office v Rolls-Royce plc and another, Rolls-Royce had anti-bribery policies, a compliance team, a contract review sub-committee and an ethics committee for years. None of this stopped corruption across the globe. The company ended up paying about £510 million, made up of about £258 million in profits given up, about £239 million in financial penalties and about £13 million in the Serious Fraud Office’s costs.

The lesson is clear. A “by the book” compliance programme is not enough. Ideally, companies should aim to detect potential corruption before it happens, have a way to identify corruption that is already taking place, and be able to reduce the consequences.

What Corruption Really Costs a Business

Since 1 June 2020, Section 17A of the Malaysian Anti-Corruption Commission Act 2009 (“MACC Act”) has made companies liable for bribes paid by their employees and associates to benefit the business. The company’s only defence is to prove that it had adequate procedures to prevent bribery. Beyond the legal risk, corruption hurts a business in several ways:

• Heavy penalties and lasting damage to reputation. A company involved in corruption faces large fines and reputational harm that may never fully heal.
• Personal risk for directors and staff. The individuals involved, including directors, face criminal prosecution.
• Poor-quality suppliers. When service providers are chosen because of kickbacks rather than their skills and ability to deliver, the work suffers.
• Higher costs and weaker products. Money spent on bribes is money that cannot be spent on training, new programmes or research and development to improve the company’s goods and services.

Why Do People Do It? The Five Drivers of Corruption

Corruption does not always involve cash. Under Section 17A, it covers giving, promising or offering any gratification, whether money, services or goods, to win or keep business or a business advantage. To spot it, a company must first understand what drives it.

1. Unchecked power and authority

Anyone with the power to make decisions can be tempted, not just directors and senior executives. The book gives everyday examples:

• a compliance manager handling regulatory approvals who asks for a bribe to speed up the process,
• an accounts clerk checking expense claims who takes kickbacks to approve transactions, and
• a security guard who is paid to let people into a warehouse after hours to steal from the company.

The more power one person holds, and the more pressure he is under to deliver quickly, the greater the temptation. The book suggests these safeguards:

• Spread the power. Where practical, let a committee or task force make important decisions instead of a single officer.
• Require conflict of interest declarations, and make sure the process is actually followed.
• Build in checks and balances for decision-making, and make sure they are observed.
• Rotate staff in high-risk roles, such as those who deal regularly with public officials or handle procurement.

2. The “get it done” agent

Companies often use agents or intermediaries to handle tasks for them. The agent’s goal is to get the job done and get paid. The company, meanwhile, often does not supervise the agent closely and lacks the information to monitor what the agent is doing. This creates a real risk that the agent will complete the task “at all costs”, including by paying bribes.

3. Inheriting a corrupt system

Where corruption is already widespread, it tends to continue. Existing staff may fall into a kind of “ethical blindness”, where wrong actions become routine and are no longer questioned. New staff inherit the system and carry on the practice. Even people who do not want to be involved come under pressure to fall in line.

The book refers to a 2021 interview with a former magistrate convicted of accepting bribes. He described inheriting an existing system in which “brokers” approached him as a young magistrate, paying for his meals and finding him a place to stay.

Changing such a culture is hardest when corruption is sanctioned by top management and junior staff feel they have no choice. In Skansen, the problem was only fixed because a new managing director arrived with the power to put things right. In many companies, that may never happen.

4. Personal financial gain

Personal gain is one of the most common reasons for workplace corruption:

• According to KPMG’s Global Profiles of the Fraudster (2016), the main motivation for fraudsters is personal financial gain and greed, at around 66 per cent, compared with organisational culture at 13 per cent.
• The former magistrate mentioned above said his starting pay was RM1,500, while he could earn as much as RM10,000 in bribes for each case. When a bribe dwarfs a person’s salary, the temptation is hard to resist.

It is a mistake, however, to think corruption is only a problem among low-paid staff. Data cited in the book shows that, compared with other types of fraud, 51 per cent of corruption offenders were executives and 26 per cent were CEOs. At the top, the pressure to maintain a certain lifestyle or social status can play a part.

In the Australian case of R v Carl Christian Wulff, the chief executive of a city council in Queensland was convicted of receiving corrupt kickbacks through two schemes involving false invoices and fictitious contracts. In mitigation, a psychologist said that his judgment had been affected by several factors, including multiple financial pressures from his investments, leaving him with what was described as a misaligned moral compass.

5. Pressure to improve the company’s results

Sometimes the goal is not personal gain but making the company look good. Business owners and senior executives are naturally driven to improve performance, and some cross the line to do it:

• Samsung: In 2017, Lee, the de facto head of Samsung Electronics, was convicted of bribing a confidante of former South Korean president Park Geun-hye and jailed for five years. He was freed on appeal after a year, but the Supreme Court ordered a retrial, after which he was found guilty and jailed again before being released on parole. Samsung was accused of contributing about 30 billion won (about US$28 million) in exchange for the government’s support for a controversial merger of two Samsung units in 2015, which strengthened Lee’s control of the group.
• Rolls-Royce: A board member of China Eastern Airlines, a majority state-owned airline, asked Rolls-Royce to fund a training programme for senior managers at a business school and to contribute to a pilots’ healthcare centre, which was understood to be his pet project and would “close the deal”. Rolls-Royce agreed to contribute US$3 million to the training fund and US$2 million to the healthcare centre. It secured the deal with the airline on the same day that commitment was communicated.

The five drivers at a glance

Tool 1: Risk Mapping

With corporate liability in force, the focus must be on reducing corruption risk. Risk cannot be eliminated completely, but it can be identified and significantly reduced. Risk mapping is a method for identifying, controlling and managing corruption risks. It is cost-effective, and most companies can run it internally, without hiring outside parties or investing in new systems.

The book sets out an eight-step method:

Tool 2: Data Analytics

Many business processes that used to be done in person are now done electronically. This creates data that can be analysed. Research discussed in the book shows that data analytics helps organisations prevent corruption proactively, rather than dealing with it after the damage is done.

Analytics can be used to spot:

• anomalies and irregularities in transactions,
• deviations from normal processes, and
• possible signs of corruption, such as the same organisations repeatedly bidding for and winning contracts together.

How Malaysia compares in Southeast Asia

In 2021, the United Nations Office on Drugs and Crime (UNODC) Regional Office for Southeast Asia and the Pacific published a report on how anti-corruption agencies in eight Southeast Asian countries use data analytics. It found that data analytics is not yet widespread in the region. Only two of the eight countries had implemented data analytics methods, while three did not use any at all. The two countries were Malaysia and Indonesia, and the methods they used included:

• artificial intelligence and machine learning,
• geographic data mapping,
• text mining and data analysis,
• social network analysis and predictive analysis, and
• modelling, data visualisation and automated red flags.

According to the report, data analytics tools are most commonly used in contracting and procurement and in payroll. They can also be applied to licensing and to financial management at state and local level. The use of blockchain technology to fight corruption has been debated, but there are few or no real-life examples of it being used for this purpose.

For companies, the message is that the authorities are already using these tools. Businesses that apply the same thinking to their own procurement and payment data are more likely to spot problems before investigators do.

Tackling the Risks Without Breaking the Bank

How far a company goes in addressing corruption risk depends on its priorities and how much it is willing to spend. Most businesses are profit-driven and naturally focus on activities that increase profit. This shows in the numbers. In a 2003 OECD working paper on the top 100 non-financial multinational companies, only 43 of the 100 published anti-corruption material on their websites, compared with more than 90 per cent that published statements on the environment.

Yet addressing corruption risk effectively improves a business in every respect and may even increase profitability. The OECD looked at 18 anti-corruption management tools. The most popular among the top 100 companies were:

The good news is that the most popular tools do not require a large budget. External audits were far less common, probably because they are costly, time-consuming and require giving outsiders access to company documents and procedures.

Other inexpensive options suggested in the book include:

• placing a duty on employees to report bribery,
• raising awareness of the criminal penalties for corruption, and
• asking employees to sign anti-corruption pledges.

Training on a budget

Training is important, but it is often neglected because of cost, particularly for companies without in-house trainers that must pay external providers again and again for new hires and refresher courses. Companies with limited funds can still make sure everyone is aware of the risks by:

• including anti-corruption material in induction programmes for new staff,
• focusing training on staff in high-risk business units, and
• running refresher sessions through virtual workshops or online training.

Practical Checklist: Start Spotting Corruption Today

• Accept that policies alone are not enough. Aim to detect corruption early, identify what is already happening and limit the damage.
• Map your risks using the eight steps, starting with the departments most exposed, such as procurement, licensing and dealings with public officials.
• Spread decision-making power and require conflict of interest declarations for key decisions.
• Rotate staff in high-risk positions where practical.
• Check every agent and intermediary before engaging them, and monitor what they do on your behalf.
• Look for patterns in your data, such as unusual transactions, departures from normal processes and the same parties repeatedly winning contracts together.
• Set up a whistleblowing channel and protect those who use it.
• Keep accurate records and make clear that breaches will lead to disciplinary action.
• Include senior management in all controls. Corruption is not only a problem at junior levels.
• Review and update your risk map regularly, because new risks will keep emerging.

Conclusion

Doing nothing about corruption is no longer an option. There is no one-size-fits-all solution, but every company can take practical steps. By understanding why corruption happens, mapping where the risks lie and using data to spot warning signs, a business can catch problems long before they reach the MACC’s desk.

As the book stresses, these measures should not be taken merely to build a legal defence against employees’ wrongdoing. More importantly, they should be taken to genuinely reduce corruption risks within the organisation. A company that does this well protects not only itself, but also its people, its reputation and its bottom line.

Cases and Sources Referred To

The following cases and reports are described as summarised in the book Corporate Liability for Corruption in Malaysia:

• R v Skansen Interiors Ltd, Case No T20172024 (Southwark Crown Court, 2018)
• Serious Fraud Office v Rolls-Royce plc and another [2017] Lexis Citation 3
• Serious Fraud Office v XYZ Limited [2016] Lexis Citation 685
• Serious Fraud Office v Standard Bank plc (now known as ICBC Standard Bank plc) [2015] Lexis Citation 567
• R v Carl Christian Wulff [2019] QCA 183 (Queensland Court of Appeal)
• KPMG International, Global Profiles of the Fraudster (May 2016)
• UNODC Regional Office for Southeast Asia and the Pacific, Preventing Corruption through Data Analytics in Southeast Asia (2021)
• OECD, Business Approaches to Combating Corrupt Practices, Working Papers on International Investment 2003/02