Anti-bribery training Malaysia: what to cover, for whom and how often

Why anti-bribery training matters in Malaysia

Since 1 June 2020, a commercial organisation can be charged under section 17A of the Malaysian Anti-Corruption Commission Act 2009 when a person associated with it gives a bribe for its benefit. The only defence is to prove that the organisation had adequate procedures to prevent it. Our section 17A guide explains the offence, the penalties and director liability in detail, so this page focuses on one part of the defence: training.

The Guidelines on Adequate Procedures, issued by the Prime Minister’s Department on 4 December 2018 under section 17A(5), set out five principles known as T.R.U.S.T. The last one, Training and communication, is the most visible to staff. A policy that nobody has been taught is hard to defend, and a training record is one of the few documents that shows the policy reached the people it was written for.

Training also protects people. Most employees who end up in a bribery case did not set out to break the law. They accepted a “small token” from a vendor, agreed to “help speed things up” with an approval, or did not know that a payment through an agent counts. Good training gives them the words to say no and a clear place to report.

What the Guidelines on Adequate Procedures say about training

Principle V asks the organisation to develop and share internal and external training and communication on its anti-corruption management system, in proportion to its operation, covering four areas:

1. the policy;
2. training;
3. the reporting channel; and
4. the consequences of non-compliance.

On communication, the Guidelines say the anti-corruption policy should be made publicly available and communicated to all personnel and business associates. When planning, the organisation should decide what key points to communicate, to whom, how, over what timeframe and in which languages. Suggested channels include the intranet or website, e-mails, newsletters and posters, the code of business conduct and employee handbook, video messages and town-hall sessions.

On training, the Guidelines say employees and business associates should receive adequate training so they thoroughly understand the organisation’s anti-corruption position, especially in relation to their own role. The formats listed include:

• induction programmes with anti-corruption elements;
• role-specific training tailored to the corruption risks a position is exposed to;
• corporate training programmes, seminars, videos and in-house courses;
• intranet or web-based programmes;
• town-hall sessions, retreats and outreach programmes.

Principle IV adds a link: the organisation should monitor how well personnel understand and comply with its anti-corruption policies in their roles. Assessment scores and completion records are a practical way to show that.

ABMS and MS ISO 37001

An anti-bribery management system (ABMS) is a structured set of policies, controls, training, monitoring and review designed to prevent, detect and respond to bribery. The international standard for it is ISO 37001. Its second edition, ISO 37001:2025, replaced the 2016 edition, and Standards Malaysia has adopted it as MS ISO 37001:2025. Standards Malaysia, supported by the MACC as scheme owner, launched an accreditation programme for ABMS certification bodies in January 2019.

Three points are often misunderstood:

• Certification is voluntary. Section 17A does not require ISO 37001. The Guidelines on Adequate Procedures suggest considering an independent external audit at least once every three years and give MS ISO 37001 auditors as an example, but a court decides whether procedures were adequate in practice.
• A certificate does not replace training. An ABMS still depends on people knowing the rules. Auditors will look at training plans, completion and whether high-risk roles received more than the general course.
• The 2025 edition puts more weight on culture. It asks the organisation to develop and promote an anti-bribery culture at all levels and adds clearer requirements on conflicts of interest. Training that uses realistic decisions rather than reading a policy fits that direction.

Whether or not you seek certification, structuring your programme around ABMS elements (policy, risk assessment, due diligence, controls, training, reporting, review) makes it easier to show adequate procedures.

What to cover, by role

Use your corruption risk assessment to decide which roles count as high risk. The Guidelines expect training to follow the risks the position is exposed to, not a single course for everyone.

How often to train

The Guidelines do not set a fixed frequency. A pattern that is easy to defend for most Malaysian organisations:

• At induction, before a new joiner handles suppliers, customers or officials.
• Every year for all staff, with a short assessment.
• Every year, in more depth, for the high-risk roles identified in your risk assessment.
• On a trigger: a change to the policy, a new market or business line, a merger, an incident or audit finding, or a move into a high-risk role.
• At festive seasons, a short reminder about gifts and hospitality before Hari Raya, Chinese New Year, Deepavali and Christmas, when vendor gifts peak. Our gifts and hospitality policy guide covers what that reminder should say.

Keep each session short and practical. A 15-minute scenario that staff actually finish teaches more than a two-hour slide deck that people click through.

Evidence: what records to keep

If the company is ever investigated, it has to show that its procedures existed and worked. For training, that means records you can produce quickly:

1. Training plan approved by management: audiences, content, frequency and the link to the risk assessment.
2. Completion records per person: course, version, date and assessment score.
3. Policy acknowledgements from staff and from agents and contractors.
4. Board briefing minutes showing directors were trained and reviewed the programme.
5. Follow-up on people who did not complete, and on wrong answers that show a common gap.
6. Review of the content at least yearly and after any incident.

Our training records guide shows how to lay out a training matrix that covers this. For the wider programme, see the compliance training platform guide.

Making the training stick

Bribery rarely looks like a bribe in the moment. It looks like a hamper, a dinner invitation, a “consultancy fee” for an agent or an official who hints that a permit could be faster. Training works better when people practise the decision rather than read the definition.

In WorkQuest2U, staff practise these decisions in a 3D scene in the browser. The Anti-Bribery & Corruption lesson covers section 17A, officials, facilitation payments, agents and red flags. Gifts, Hospitality & Donations covers when to accept, decline and declare. Conflicts of Interest and Procurement Integrity give high-risk roles more depth, and Speak Up & Whistleblowing shows how to report. Each lesson records completion and an assessment score, and learners who pass receive a WorkQuest2U completion certificate. The lessons are awareness and practice content; they support your programme but do not replace your own policy, risk assessment or legal advice.

This guide is general information, not legal advice. For a specific situation, speak to a lawyer who handles anti-corruption matters.