ISO 37001 anti-bribery certification consultant in Malaysia
Anti-bribery & governanceISO 37001:2025
Build the documented adequate procedures Section 17A expects, before an investigation forces you to prove it existed.
What it is
ISO 37001:2025 is the international standard for an anti-bribery management system, setting requirements for policies, risk assessment, due diligence, controls, training, and reporting channels designed to prevent, detect, and respond to bribery. In Malaysia it carries particular weight since Section 17A of the MACC Act 2009 took effect on 1 June 2020, creating corporate liability for bribery by associated persons unless the organisation can show adequate procedures. ISO 37001 certification is widely used as documented evidence toward that defence, built around the T.R.U.S.T. principles Malaysian guidelines set out.
CIDB G7 contractor? See the ISO 37001 for SPKK 2027 page, with the G7 package and last intake date.
Who needs it in Malaysia
- Companies exposed to corporate liability under Section 17A
- Any commercial organisation with employees, agents, or associates operating in Malaysia carries exposure under Section 17A, whether or not bribery has ever occurred, since liability follows from an associated person's act, not the company's own.
- GLC suppliers and government tender bidders
- Government-linked companies and public sector tenders increasingly ask suppliers to demonstrate anti-bribery controls, with ISO 37001 certification serving as recognised, third-party-verified evidence rather than an internal policy statement.
- Companies with agents, distributors, or intermediaries
- Businesses that rely on agents, distributors, or facilitators to reach customers or regulators face the highest bribery risk exposure, since Section 17A liability extends to bribery committed by those associated persons.
- Boards and management needing documented adequate procedures
- Directors and senior management carry personal exposure under Section 17A unless they can show they had adequate procedures in place, making a documented, certified system a board-level governance priority.
Our process
Bribery risk assessment across the organisation
We assess bribery risk across your business units, geographies, and third-party relationships, and hand over a dated, written action list ranked by the exposure each gap actually represents.
Policies, due diligence, and controls aligned to T.R.U.S.T.
Anti-bribery policy, gift and hospitality controls, and third-party due diligence procedures are built around the T.R.U.S.T. principles Malaysian guidelines set out, not a generic template unrelated to your actual exposure.
Training and reporting channel implementation
We implement staff and third-party training and a confidential reporting channel for suspected bribery, giving employees a documented route to raise concerns without fear of retaliation.
Internal audit and management review
A full rehearsal against the standard's internal audit and management review requirements, with findings closed and objective evidence filed before the certification audit is booked.
Certification audit support
We accompany you through Stage 1 document review and Stage 2 on-site assessment, helping you demonstrate the adequate procedures defence in the language auditors and, if needed, investigators expect.
Timeline
A single-entity company with an existing code of conduct and no major third-party network typically reaches certification in four to seven months from gap analysis. Groups with multiple subsidiaries, agents, or distributors often need eight to eleven months, since due diligence records on third parties need to accumulate real evidence before Stage 2.
What affects the cost
- Number of business units or subsidiaries within the certification scope
- Existing compliance programme maturity and documentation
- Number of agents, distributors, or intermediaries requiring due diligence
- Certification body fees, which scale with scope and headcount
- Scope of staff and third-party anti-bribery training
- Whether a whistleblowing or reporting channel needs to be set up from scratch
How BUKTI helps
- BUKTI keeps your third-party due diligence records and risk assessments current, so missing documentation is never the finding an auditor, or an investigator, raises.
- Reported concerns and corrective actions run through BUKTI's CAPA workflow, with case status and closure evidence tracked automatically and confidentially.
- Management review inputs, from due diligence exceptions to reporting channel activity, are compiled in BUKTI so the meeting starts with organised data.
FAQ
What are adequate procedures under Section 17A?
Adequate procedures are the documented, risk-based controls an organisation has in place to prevent bribery, forming a defence against corporate liability if an associated person commits bribery without the company's knowledge. ISO 37001 certification is widely accepted as strong evidence toward that defence.
What are the T.R.U.S.T. principles?
T.R.U.S.T. is the set of principles Malaysian guidelines use to frame adequate procedures: top-level commitment, risk assessment, undertake control measures, systematic review and monitoring, and training and communication. We build your ISO 37001 system directly around these five areas.
Is ISO 37001 legally required in Malaysia?
For CIDB G7 contractors, yes in practice: under CIDB Pekeliling Bil. 1/2026, G7 contractors need ISO 37001 certification for new and renewed SPKK from 1 January 2027, which they need to tender for government works. For other companies no law mandates the certificate itself. Section 17A of the MACC Act 2009 requires adequate procedures as a defence, and certification is a widely recognised way to document them. G7 details: aiso.my/iso-37001-cidb-g7.html
How much does ISO 37001 certification cost in Malaysia?
Cost depends on the number of business units in scope, existing compliance maturity, and the number of third parties requiring due diligence. Certification body fees are quoted separately from consulting fees; we give a written, fixed-scope quote after reviewing your organisation.
How long does ISO 37001 implementation take?
Four to seven months is typical for a single-entity company with an existing code of conduct. Groups with multiple subsidiaries, agents, or distributors usually need eight to eleven months to build sufficient due diligence evidence.
What happens after we get certified?
Certification bodies run annual surveillance audits to confirm the system is still operating, with full recertification every three years. BUKTI keeps due diligence and reporting records current between visits so surveillance audits stay routine rather than a scramble.
Related standards
Where we work
Perlis, Kedah, Penang, Perak, Selangor, Kuala Lumpur, Putrajaya, Negeri Sembilan, Melaka, Johor, Pahang, Terengganu, Kelantan, Sabah, Sarawak, Labuan. ISO consultants in every Malaysian state.
Ask about this standard
Board asking for evidence of adequate procedures?
Tell us your business units and current third-party relationships. We will scope a realistic path to certification.