RISK implies future uncertainty about deviation from expected outcome. It measures the level of uncertainty that an organisation is willing to accept in view of managing stakeholder confidence and sustaining business operations towards realization of organisational goals.
Risk management lets us have a grip on the levels of risk posed to the organisation, its root causes and control measures which can be assimilated in order to reduce the level of exposure.
As we are well aware, the pandemic has driven businesses to fast-track commercial practices and neglect basic checks and balances in the name of recovery and sustainability.
This puts commercial organisations at greater risk for unethical and illegal conduct which would result in strategic disadvantage, severe operational disruption, legal and regulatory issues along with reputational damage.
One of the key matters which has been a buzz in the business community is the enforcement of the Corporate Liability Provision, Section 17A of the Malaysian Anti-Corruption Commission Act 2009 (MACC Act 2009) back in June 2020, which places liability on legal persons (commercial organisations) and its stewards for actions of persons associated to the commercial organisation.
It criminalizes the act of giving, promising to give or offering any form of gratification to another party with the corrupt intent of receiving a commercial benefit or advantage in return.
Even though many may argue that the Ministerial Guidelines on Adequate Procedures, released by the Minister in the Prime Ministers Department back in December 2018 has drawn out what can be construed as a legal defense for the Commercial Organisation, its Directors and Senior Executives if they are charged under the said provision but this remains a rather ambiguous notion as we do not have a written judgement or court precedent to define what is "adequate" in the eyes of the law.
Following a principled based document without proper direction may steer organisations towards believing in a false narrative of corporate immunity once certain measures had been put in place.
Here we should take a step back and understand the "rule of proportionality" instead of fixating ourselves to the term "adequate" or "adequacy". Principle 2 of the Ministerial Guidelines details out the need for Risk Assessment.
The risk assessment exercise would be the means by which organisations are able to understand the context of their organisation, ascertain structural weaknesses that may facilitate corruption, provide a framework for all staff to take part in identifying risk factors and treatments, and embed corruption prevention within a well-established governance framework.
Keeping in mind the key offences under the MACC Act 2009 (including Section 17A) and others related, where are the vulnerabilities or structural weaknesses in current systems and procedures? How can organisations now determine the likelihood that such activities could take place and what is the impact if such things would take place?
We should also keep in mind that every organisation would come with its set of inherent risks due to the context of its environment and nature of business.
The risk assessment exercise forms the basis of an organisation's anti-corruption efforts. It should be performed periodically and when there is a change in law or circumstance of the business to identify, analyse, assess and prioritise the internal and external corruption risks of the organisation.
The results from the exercise should then be used to establish appropriate processes, procedures, systems and controls approved by the top-level management to mitigate the specific corruption risks the business is exposed to.
With a well-established corruption risk assessment / management exercise, commercial organisations would be in a better position to implement the five principles of T.R.U.S.T for bribery prevention and adhere to the rule of controls by proportionality rather than adequacy. Such are efforts as we go along the road of understanding the true definition prescribed by the Courts.
The writer is a Certified Fraud Examiner (CFE)
The views expressed in this article are the author's own and do not necessarily reflect those of the New Straits Times