The Malaysian Bar’s International Malaysia Law Conference (“IMLC”) 2026 took place from 27 to 30 Oct 2026 at MITEC, Kuala Lumpur.
By Sangitha Namasoo, S V Namasoo & Co
The session titled “Regulatory Compliance for Businesses: Best Practices in Audits and Investigations by Regulators” was commenced by the moderator, Wong Keat Ching, Co-Chairperson of the Bar Council Industrial and Employment Law Committee, by introducing the three panellists to the audience. The moderator explained that the first speaker, Mohamed Sufyan Mohd Mokhtar, Director of the Regulatory Development and Services Division of the Companies Commission of Malaysia (“CCM”), would address the topic from the regulator’s perspective; the second speaker, Andrew Chiew Ean Vooi, Partner at Lee Hishammuddin Allen & Gledhill, would do the same from the practitioner’s perspective; and finally the Honourable Justice Dato’ Anand Ponnudurai, Judge of the High Court of Malaya, would offer the Bench’s perspective on the topic.
Mohamed Sufyan Mohd Mokhtar explained that CCM seeks to supervise or conduct audits in a structured manner in order to withstand challenges to its investigations. He explained that the process begins with complaints received by CCM, with the bulk of the complaints coming from corporate companies and the public. CCM then decides on whether to investigate the complaint internally or alongside other regulators. In the event CCM decides that no further action is to be taken, they may advise the complainant to pursue a private action.
He acknowledged that timeliness is an issue with these investigations, as it takes time to locate witnesses to record their statements. In this vein, he urged lawyers to advise their clients to cooperate with CCM investigations. He also briefly touched on the relevance of the Whistleblower Protection Act 2010 in relation to these complaints.
Mohamed Sufyan also informed the audience that lawyers may apply for practising certificates and immediately commence practice as company secretaries under section 241 of the Companies Act 2016, and that ample training is available for this role. He urged lawyers to consider taking up this role as listed companies are in need of knowledgeable and competent company secretaries. Finally, as a regulator and a former practitioner, he encouraged practitioners and the corporate sector to engage with CCM.
The second speaker, Andrew Chiew, then gave a presentation on how corporations should carry out investigations. In these situations, he says that the role of the lawyer is liability management. The starting point of an investigation is to set out its scope, which is how much of the investigation will be conducted by the client and how much will be outsourced to external investigators. He discussed the case of Iris Corporation Bhd v Tan Sri Razali Ismail & Ors [2025] 10 CLJ 948 in relation to the scope of the investigation and ensuing report.
The second step is to determine who the client is. The purpose is to know whose privilege is being protected and to define the retainer. There must also be a disclosure of any conflicts of interest regarding the persons conducting the investigation. Further, there could be an intertwining of interests when a lawyer is advising both the client and the board. The remaining steps in the investigation process are reporting, disclosing, preserving and reassessing. In terms of professional privilege, the client controls any waivers and has to expressly consent to disclosures. Finally, when it comes to choosing who is to conduct any investigation, his advice was to choose investigators based on risk, not convenience.
The third speaker, the Honourable Justice Dato’ Anand Ponnudurai, spoke about how regulatory compliance has become a feature of modern business and that the legitimacy of enforcement depends on the legality and fairness with which regulatory power is exercised. The best investigation is one that is lawful, proportionate, properly documented, procedurally fair and capable of being explained years later in court.
At the heart of regulatory legitimacy is whether the regulator has exercised their power in accordance with the law, as unfair enforcement weakens confidence. Compliance is no longer just a checklist, and business decisions should not be treated as unreasonable just because the outcome was poor.
His Lordship then concluded with tips from the bench for regulators. Firstly, start with the statute, not suspicion; record the reason before the conclusion, as contemporaneous explanation is critical; and evidence justifies the enforcement. He also urged regulators to test their case by looking for evidence pointing the other way and to preserve their records.
Further, the response must be proportional, and the regulator should be able to explain why the response was appropriate. Consistency is also key, which means that where outcomes differ, there should be reasons for the difference. He concluded with a reminder that the best defence is a strong compliance culture, the preservation of records, and the establishment of protocols for confidentiality.
*This article reports on Breakout Session 10, Stream C: Corporate and Commercial Law.