Can ISO 37001 Help Your Company Comply with Section 17A of the MACC Act?

If you run a business in Malaysia, Section 17A is something you can’t ignore. It makes companies responsible if employees, agents, or partners commit bribery, even if management didn’t know. That’s where ISO 37001 helps. It gives your company a clear system to prevent bribery and show you’ve taken proper steps to control the risk.

So yes, ISO 37001 can support Section 17A compliance.

Section 17A of the Malaysian Anti-Corruption Commission (SPRM) Act introduced corporate liability for corruption.

This means a company can be prosecuted if a person associated with the organization gives or offers a bribe to obtain or retain business or secure an advantage.

Associated persons may include:

• Employees
• Directors
• Agents
• Distributors
• Contractors
• Joint venture partners

The penalties are serious:

• A fine of not less than 10 times the value of the gratification, or RM1 million, whichever is higher
• Imprisonment of up to 20 years
• Possible liability for directors and senior management

That’s why companies are paying much closer attention to anti-bribery controls.

No. Section 17A does not require companies to be certified to ISO 37001.

However, the law allows organizations to defend themselves if they can prove they had adequate procedures in place to prevent corruption. ISO 37001 is widely recognized as one of the strongest frameworks for demonstrating those procedures.

So while certification is voluntary, it can significantly strengthen your compliance position.

The government’s Guidelines on Adequate Procedures are built around five principles:

T – Top Level Commitment

Senior management must lead by example.

R – Risk Assessment

The organization must identify corruption risks.

U – Undertake Control Measures

Controls and procedures must be implemented.

S – Systematic Review, Monitoring and Enforcement

The system must be monitored and enforced.

T – Training and Communication

Employees and stakeholders must be informed and trained.

These principles align closely with the requirements of ISO 37001.

Imagine your sales agent pays a bribe to secure a government contract.

Under Section 17A, your company may be liable even if management wasn’t directly involved.

If your organization can demonstrate that it:

• Conducted due diligence on the agent
• Included anti-bribery clauses in the contract
• Provided training
• Monitored activities
• Had reporting mechanisms in place

You’ll be in a much stronger position to show that adequate procedures existed. That is exactly what ISO 37001 is designed to document.

“We’re a small company, so this doesn’t apply to us.”

Section 17A applies regardless of company size.

“We already have a code of conduct.”

A code of conduct is useful, but on its own, it usually isn’t enough.

“Certification guarantees legal protection.”

Certification helps, but it does not provide automatic immunity.

“This is only for large corporations.”

ISO 37001 can be scaled to fit SMEs as well.

Companies often struggle when they:

• Copy generic templates
• Perform superficial risk assessments
• Ignore third-party due diligence
• Provide minimal training
• Keep poor records
• Treat certification as a box-ticking exercise

ISO 37001 works best when it reflects your actual business risks.

For many Malaysian companies, yes. If your business deals with regulators, tenders, agents, or higher-risk transactions, ISO 37001 can strengthen governance and support your Section 17A readiness. It also provides reassurance to customers, investors, and business partners.