ISO 37001 Requirements Malaysia

ISO 37001 is the international standard for Anti-Bribery Management Systems (ABMS). It provides organisations with a structured framework to prevent, detect and respond to bribery risks through leadership commitment, risk assessment, due diligence, financial controls and continual improvement.

For organisations operating in Malaysia, ISO 37001 is particularly relevant because it supports the implementation of anti-bribery controls that may contribute to an organisation’s “adequate procedures” under Section 17A of the Malaysian Anti-Corruption Commission (MACC) Act 2009. While certification is voluntary, many organisations implement ISO 37001 to strengthen governance, improve stakeholder confidence and demonstrate their commitment to ethical business practices.

So, what are the actual ISO 37001 requirements? Here’s a simple breakdown.

ISO 37001 contains 10 clauses.

• Clauses 1 to 3 explain the scope, references, and definitions.
• Clauses 4 to 10 contain the actual certification requirements.

If you’re implementing ISO 37001 Certification Malaysia, these are the clauses you need to focus on.

Clause 4: Context of the Organization

Before setting up any controls, you need to understand where bribery risks could happen in your business. This clause requires you to:

1. Identify internal and external issues.
2. Understand the needs of interested parties.
3. Define the scope of the Anti-Bribery Management System.
4. Establish the processes needed to manage bribery risks.

Examples of Internal and External Issues

External issues: Industry corruption trends, regulatory requirements, government dealings, country risk

Internal issues: Company culture, sales incentives, procurement practices, existing compliance controls

Clause 5: Leadership

ISO 37001 places significant responsibility on top management. Leaders must show that anti-bribery is taken seriously, not just documented. They are required to:

• Establish an anti-bribery policy
• Communicate zero tolerance for bribery
• Assign responsibilities
• Provide resources
• Support the compliance function

Anti-Bribery Compliance Function

The organization must appoint a person or team responsible for overseeing the anti-bribery system. This function should have independence, authority, and direct access to top management.

Clause 6: Planning

This clause focuses on bribery risk assessment and planning actions to address those risks. You need to identify bribery risks, evaluate likelihood and impact, then implement the control and set anti-bribery objectives.

Typical Anti-Bribery Objectives

Examples include:

• 100% employee training completion
• Due diligence on all high-risk third parties
• Zero unresolved whistleblowing cases
• Quarterly compliance reviews

Clause 7: Support

Your anti-bribery system won’t work unless people know what to do. This clause covers resources, people competency, awareness of the internal and external people on the anti-bribery, communication channel within the organization, and how the organization documents the information.

Employees in higher-risk roles like people in the sales team, procurement personnel, senior management, or finance staff should receive targeted training.

Clause 8: Operation

This is the heart of ISO 37001. It requires operational controls to prevent bribery in day-to-day activities.

Key Operational Controls:

Due Diligence

During certification audits, organisations are expected to demonstrate that appropriate due diligence has been performed before appointing high-risk business partners. This may include evaluating the background, ownership structure, reputation, sanctions exposure, conflicts of interest and previous compliance history of agents, consultants, distributors, contractors or joint venture partners. The level of due diligence should be proportionate to the bribery risk involved.

Financial Controls

Examples include:

• Approval limits
• Segregation of duties
• Expense verification

Non-Financial Controls

Examples include:

• Tender controls
• Procurement reviews
• Contract approvals

Gifts, Hospitality, and Donations

The organization must control:

• Gifts
• Entertainment
• Sponsorships
• Political contributions
• Charitable donations

Speak-Up Mechanisms

Employees and stakeholders must be able to report concerns confidentially.

Investigations

Suspected bribery cases must be investigated and documented.

Clause 9: Performance Evaluation

You need to regularly check whether the anti-bribery system is working. This includes:

• Monitoring and measurement
• Internal audits
• Management reviews

The internal audit team periodically reviews whether controls are implemented effectively and conducts a management review meeting, which includes the top management, HOD, and internal audit team, to evaluate:

• Audit findings
• Incident trends
• Risk changes
• Improvement opportunities

Clause 10: Improvement

When issues are identified, the organization must:

• Correct the problem
• Investigate root causes
• Implement corrective actions
• Improve the system

The goal is continuous improvement, not just maintaining certification.

ISO 37001 is suitable for organisations of any size or sector, particularly those exposed to bribery risks, including:

• Construction companies
• Engineering firms
• Oil & gas companies
• Government contractors
• Property developers
• Manufacturers
• Financial institutions
• Logistics companies
• Healthcare organisations
• Higher education institutions

ISO 37001 is not mandatory, but it provides a structured framework that may support an organisation’s anti-bribery programme and contribute to implementing “adequate procedures” under Section 17A. However, certification alone does not guarantee compliance with legal requirements or establish a statutory defence. Organisations remain responsible for implementing appropriate anti-bribery measures based on their own risks.

Certification audits frequently identify opportunities for improvement such as:

Leadership commitment

• Anti-bribery policy not effectively communicated.
• Top management involvement not adequately demonstrated.

Risk Assessment

• Risk assessments too generic
• Risks not updated when business activities change.

Due Diligence

• Third-party assessments incomplete.
• No documented approval before engagement.

Gifts and Hospitality

• Registers not maintained.
• Approval thresholds unclear.

Training

• Only HR received training.
• High-risk departments excluded.

Internal Audit

• Anti-bribery controls not included in audit programme.

Corrective Action

• Root causes not adequately analysed.