ESG Consultation Work
Meet Your Obligations Before Someone Else Checks Them
Structured compliance programmes across three tiers — for SMEs building their first governance framework, exporters facing buyer audits, and listed issuers reporting under the NSRF.
Service Overview
Malaysian businesses now sit inside several overlapping compliance regimes that have tightened considerably since 2024. Corporate liability for corruption places the burden of proof on the organisation. Data protection obligations carry fixed notification deadlines. Sustainability reporting has moved from voluntary to mandatory on a published timetable. And for exporters, buyer audit requirements increasingly arrive with contractual weight behind them.
These obligations do not arrive together or in order. A manufacturer may face a buyer audit long before it thinks about sustainability reporting. A family business may discover its anti-corruption exposure only when a director is asked to sign something. This practice area is organised in three tiers so an organisation can start where its exposure actually is.
Who is this for?
- Tier 1 — SMEs & Family-Run Businesses Building Their First Governance Framework
- Tier 2 — Exporters & Manufacturers Facing Buyer Audits
- Tier 3 — Listed Issuers & Large Entities Reporting Under the NSRF
Core Offerings & Deliverables
Tier 1 — ESG Handbook
A working document tailored to your organisation's size, sector and risk profile — not a template. Sets out governance structure, responsibilities and escalation routes.
Tier 1 — Section 17A Adequate Procedures Framework
Section 17A of the Malaysian Anti-Corruption Commission Act 2009, in force since 1 June 2020, creates corporate liability for corrupt conduct by associated persons carried out for the organisation's benefit, whether or not senior management knew — with liability extending to directors, controllers, officers and partners. Conviction carries a fine of not less than ten times the value of the gratification or RM1 million, whichever is higher, up to twenty years' imprisonment, or both. The only statutory defence is adequate procedures. We build your framework against the five T.R.U.S.T. principles set out in the Prime Minister's Department's December 2018 Guidelines on Adequate Procedures, so the defence rests on documented evidence.
Tier 1 — Whistleblowing Channel & Policy
Reporting routes, protections for the person reporting, investigation procedure and record-keeping.
Tier 1 — Code of Conduct
Business ethics, conflicts of interest, gifts and hospitality, and facilitation payments.
Tier 1 — PDPA Compliance Programme
The Personal Data Protection (Amendment) Act 2024, with principal obligations effective 1 June 2025, introduced mandatory Data Protection Officer appointment, mandatory breach notification and direct obligations on data processors, and raised maximum penalties to RM1 million with imprisonment of up to three years. Breach notification runs to a fixed clock — the Commissioner within 72 hours, affected individuals within seven days where the breach is likely to cause significant harm. Work covers DPO appointment and registration, breach response protocol, privacy notices, consent mechanisms, data inventory and cross-border transfer review.
Tier 2 — SMETA Audit Readiness
SMETA (Sedex Members Ethical Trade Audit) is among the most widely used social audit formats globally. Version 7.0, published September 2024, broke the ETI Base Code into specific workplace requirements and introduced a Collaborative Action Required finding for four areas a supplier cannot resolve alone — living wages, responsible recruitment, child labour and discrimination. Preparation covers gap assessment against the applicable pillars, documentation review, and readiness for the areas auditors examine most closely. Reports are typically valid for twelve months, sometimes eighteen depending on buyer risk appetite.
Tier 2 — Sedex Membership & Self-Assessment
Registration, membership type, and completion of the Self-Assessment Questionnaire covering labour, health and safety, environment and business ethics.
Tier 2 — Supplier Code of Conduct
A code your organisation can hold its own suppliers to, with the flow-down provisions buyers increasingly expect to see.
Tier 2 — Human Rights Due Diligence
Risk mapping and a documented due diligence process. SMETA 7.0 aligns with the requirements of the EU Corporate Sustainability Due Diligence Directive, and the same evidence supports obligations under the German Supply Chain Due Diligence Act and the UK Modern Slavery Act.
Tier 2 — Corrective Action Support
Where findings are raised, assistance assembling remediation evidence for upload to the Sedex platform, which allows buyers to verify that issues have been closed without a repeat site visit.
Tier 3 — NSRF Readiness
The National Sustainability Reporting Framework, issued 24 September 2024 by the Securities Commission Malaysia and the Ministry of Finance, adopts the ISSB standards — IFRS S1 and IFRS S2 — and moves Malaysia to mandatory disclosure on a phased timetable: Main Market issuers with market capitalisation of RM2 billion or above from annual periods beginning on or after 1 January 2025, remaining Main Market issuers from 1 January 2026, and ACE Market issuers and large non-listed companies from 2027. The framework sequences IFRS S2 and Scope 3 emissions ahead of full IFRS S1, with the transition reliefs available under the ISSB standards.
Tier 3 — Bursa Integration & Submission
Following the 23 December 2024 amendments to the Main Market and ACE Market Listing Requirements, issuers prepare sustainability statements under IFRS S1 and S2, disclose whether the statement was internally reviewed or independently assured, and submit through the Centralised Sustainability Intelligence platform.
Tier 3 — Assurance Readiness
External assurance is currently voluntary but becomes mandatory in phases — reasonable assurance over Scope 1 and Scope 2 emissions is expected from FY2027 for Group 1, FY2028 for Group 2 and FY2029 for Group 3, under ISAE 3000 (Revised) or ISSA 5000. Preparation focuses on making the underlying data and controls capable of surviving assurance.
Tier 3 — MCCG Application
The Malaysian Code on Corporate Governance 2021 operates on an apply-or-explain basis across three principles — board leadership and effectiveness; effective audit and risk management; and integrity in corporate reporting and stakeholder relationships — applying its CARE approach of comprehend, apply, report. Work covers the Corporate Governance Report, board composition including the 30% women directors recommendation, the two-tier voting process for independent directors serving beyond nine years, and Step Up practices for companies going further than baseline.
Tier 3 — Board Sustainability Oversight
MCCG 2021 placed explicit emphasis on the role of the board and senior management in addressing sustainability risks and opportunities. Work covers board and committee structure, terms of reference, reporting lines and director briefings.
Start Where Your Exposure Is
Talk to our team about which tier matches your current obligations.
Connect with Our Practice Team