ISO 37001 for GLC and Government Suppliers: Section 17A

If your company supplies a government-linked company, bids on a government tender, or sits in the vendor chain of a PETRONAS project, you have probably already heard the term "Section 17A" from a procurement officer or compliance form. It refers to a change in Malaysian law that made companies, not just individuals, criminally liable for corruption committed on their behalf, and it is the single biggest reason ISO 37001 requests have moved from "nice to have" to "a condition of the contract" over the past few years. This article explains what changed, what the law expects of your company, and how ISO 37001 certification supports the legal defence you now need.

What Section 17A changed

Section 17A of the Malaysian Anti-Corruption Commission (MACC) Act 2009 came into force on 1 June 2020. Before this provision, prosecutors generally had to prove a company's directors or senior management personally directed or knew about a corrupt act for the company itself to be held liable. Section 17A changed that: a commercial organisation can now be held criminally liable if a person associated with it, an employee, agent, or even a third-party representative acting on its behalf, gives or offers a bribe intending to obtain or retain business or a business advantage for the organisation. Critically, the prosecution does not need to prove the company's leadership knew about the specific act. Liability can attach to the organisation itself, and by extension to its directors and controllers, unless the company can show it had adequate procedures in place to prevent the conduct.

The adequate procedures defence and T.R.U.S.T.

That last point is the one that matters most for your business. Section 17A provides a statutory defence: a commercial organisation is not liable if it can prove it had "adequate procedures" in place designed to prevent persons associated with it from bribery. The Malaysian government's guidelines describe these adequate procedures using five principles, commonly remembered as T.R.U.S.T.:

• T — Top Level Commitment: leadership visibly commits to anti-bribery and sets the tone from the top, not just a signed policy in a drawer.
• R — Risk Assessment: the organisation identifies and assesses its actual bribery risks, rather than adopting a generic policy that ignores its real exposure.
• U — Undertake Control Measures: proportionate controls are implemented, covering things like gifts and hospitality, facilitation payments, and third-party due diligence.
• S — Systematic Review, Monitoring and Enforcement: the procedures are actually monitored, reviewed periodically, and enforced when breached, not filed away after being written.
• T — Training and Communication: staff and relevant third parties understand the policy and know how to raise a concern.

An ISO 37001 anti-bribery management system is, in practice, the most recognised and auditable way to demonstrate all five T.R.U.S.T. principles are genuinely in place, because a certification body independently verifies the system rather than taking the company's word for it.

What ISO 37001 actually covers

ISO 37001 sets requirements for a management system designed to help an organisation prevent, detect, and address bribery. In practice, implementing it means putting the following in place:

1. Bribery risk assessment, covering the specific ways your company's operations, markets, and third-party relationships could expose it to bribery risk.
2. Due diligence on business associates, particularly agents, distributors, joint venture partners, and other third parties acting on the company's behalf, since Section 17A liability extends to their conduct.
3. Controls, including a gifts and hospitality policy, restrictions or prohibitions on facilitation payments, and financial controls that make bribery harder to conceal.
4. Training, so staff at every level recognise a bribery risk and know the company's expectations, not just senior management.
5. Reporting channels, including a way to raise concerns confidentially, and a documented process for investigating and responding to reports.

Who is asking for it

Demand for ISO 37001 in Malaysia is concentrated among a specific set of buyers: government-linked companies rolling the requirement down to their supplier base, PETRONAS and its vendor ecosystem, contractors bidding on government and statutory-body tenders, and increasingly private companies that want the same protection Section 17A gives GLCs to extend down their own supply chains. If your customer's procurement team has started asking for anti-bribery policy documents, a named compliance officer, or evidence of due diligence on your own suppliers, that is usually an early signal that ISO 37001 certification, rather than an informal policy, will become the actual requirement within a tender cycle or two.

Implementation steps and timeline

An ISO 37001 project generally follows the same five phases as any management-system certification: bribery risk assessment and gap analysis, documentation of the anti-bribery policy and controls, implementation and staff training, an internal audit and management review, and finally the certification audit itself. For a single-site company with no existing compliance framework, three to six months from gap analysis to certificate is typical, similar to ISO 9001. Companies that already hold ISO 9001 or another management-system certificate usually move faster, since the underlying management-system clauses, leadership commitment, documented control, internal audit, are already built and mainly need extending to cover bribery-specific risks.

Common mistakes

The most common mistake is treating ISO 37001 as a policy-writing exercise rather than a live system: a beautifully written anti-bribery policy with no risk assessment behind it, no due diligence records on third parties, and no evidence of training will not satisfy a certification body, and more importantly will not hold up as an adequate procedures defence if the company is ever investigated. A second common mistake is scoping due diligence too narrowly, covering only direct customer contracts and ignoring the agents, subcontractors, and joint venture partners who are just as capable of triggering Section 17A liability on the company's behalf.

FAQ

Is ISO 37001 legally required under Section 17A? No. Section 17A does not name ISO 37001 specifically, but certification is the most recognised, independently audited way to demonstrate the adequate procedures defence, and many GLC and government buyers now treat it as the practical evidence they expect to see.

Does Section 17A apply to small companies too? Yes. The law applies to commercial organisations of any size that carry on business in Malaysia, and smaller suppliers in a GLC's vendor chain are increasingly the ones being asked to demonstrate compliance, since larger buyers are pushing the requirement down their supply chain.

How is ISO 37001 different from ISO 9001? ISO 9001 manages quality and customer satisfaction; ISO 37001 manages bribery risk specifically. Many companies implement both together since they share the same management-system structure, which shortens the combined timeline and cost.

Can directors still be personally liable if the company is certified? Certification supports the company's adequate procedures defence, but directors and controllers still carry personal duties under the MACC Act. Certification is strong evidence of a functioning system, not a guarantee against every scenario.

Next step

If a customer, tender, or GLC procurement team has already raised Section 17A or ISO 37001 with you, the practical next move is a bribery risk assessment scoped to your actual business relationships. Book a free consultation and a consultant will walk through what an adequate procedures defence looks like for your company. To see the standard's requirements in full, visit our ISO 37001 certification page.