Built for Section 17A & ISO 37001

Every integrity workflow.
One system of record.

i-IMS runs the full mandate of an integrity unit — complaints, declarations, due diligence, risk, and governance — on one platform where every action is logged and audit-ready.

MACC Act s. 17A adequate procedures ISO 37001 ABMS aligned PDPA-compliant reporting
Integriti Holdings Integrated Integrity Management System Enterprise EN A
Tuesday, 14 April 2026

Good morning, Aiman

Integrity Officer · Integriti Holdings
Report & investigate
Complaints Management 4 waiting for you
Disciplinary Management
Declarations
Conflict of Interest 3 waiting for you
Gifts & Hospitality 7 waiting for you
Needs your attention 14
Complaints awaiting triage 4
Gift declarations for approval 7
COI declarations pending review 3
Complaints COI
Powered by i-IMS
Inside the platform

Fourteen modules.
One record system.

Pick a module to see what's inside — every one shares the same login, the same people, and the same audit trail.

Full module directory
Reporting & Investigation 01

Complaints Management

End-to-end management of integrity complaints — official complaints, whistleblowing, CEC case decisions, and detection & verification.

Replaces today: Email inboxes, WhatsApp threads, and paper intake forms.
  • Anonymous & identified intake
  • SLA-tracked case workflow
  • Secure two-way chat
Inside the module
ADU-2026-0141 Procurement irregularity — Zone 3 office In investigation
ADU-2026-0138 Whistleblower: vendor kickback allegation Under review
ADU-2026-0133 Misuse of vehicle — verified & closed Resolved
See the full module directory
Governance & Compliance 02

Governance Management

Policy documents, procedures, directives, and the organization's integrity governance framework in one place.

Replaces today: Shared drives and folders of policy PDFs.
  • Versioned policy register
  • Directives & procedures
  • Committee framework records
Inside the module
GOV-2026-0032 Anti-bribery policy v3.2 In force
GOV-2026-0029 Procurement SOP — revision draft Awaiting approval
See the full module directory
Governance & Compliance 03

Integrity Strengthening

Training certification, ethics surveys, corruption risk awareness campaigns, and integrity pact participation records.

Replaces today: Training spreadsheets and signed attendance sheets.
  • Certification tracking by employee
  • Ethics & culture surveys
  • Awareness campaigns
Inside the module
TRN-2026-0187 Ethics induction — May intake 86% certified
TRN-2026-0179 Refresher — declaration policy Closing 30 Jun
See the full module directory
Governance & Compliance 04

Compliance Management

Monitor adherence to policy, procedure, and legal obligations — including Section 17A MACC Act corporate liability.

Replaces today: The annual last-minute audit-preparation scramble.
  • Obligation register
  • Section 17A controls
  • Compliance calendar
Inside the module
CML-2026-0071 Section 17A control review Due 30 Jun
CML-2026-0068 Gift policy attestation cycle Completed
See the full module directory
Reporting & Investigation 05

Disciplinary Management

Show-cause letters, hearings, penalty records, and full tracking of disciplinary proceedings.

Replaces today: HR files and forwarded email chains.
  • Show-cause & hearings
  • Penalty records
  • Precedent search
Inside the module
DIS-2026-0021 Repeated policy breach — show cause Hearing scheduled
DIS-2026-0019 Late declaration — warning issued Closed
See the full module directory
Declarations & Conflicts 06

Conflict of Interest (COI)

Structured annual COI declarations with Integrity Officer review, helping identify and mitigate conflicts early.

Replaces today: The yearly Google Form and the spreadsheet behind it.
  • Annual declaration cycles
  • Integrity Officer review
  • Mitigation tracking
Inside the module
COI-2026-0344 Annual declaration — Finance dept Pending review
COI-2026-0341 Vendor relation declared — mitigated Approved
See the full module directory
Reporting & Investigation 07

Support Letter Management

Formal reporting of support letters received from external parties during procurement or decision processes.

Replaces today: Physical filing cabinets and logged hardcopies.
  • External letter intake
  • Procurement linkage
  • Acknowledgment trail
Inside the module
SL-2026-0056 Support letter — Tender 42/2026 Acknowledged
SL-2026-0054 Representation letter — rezoning Under review
See the full module directory
Declarations & Conflicts 08

Gifts, Hospitality & Sponsorship

Declare gifts, hospitality, and sponsorships online with multi-level approval workflows and policy alerts.

Replaces today: Ad-hoc email approvals with no central record.
  • Policy thresholds & alerts
  • Multi-level approval
  • Sponsorship register
Inside the module
GFT-2026-0213 Vendor dinner — RM 320 Awaiting approver
GFT-2026-0209 Festive hamper — RM 150 Within policy
See the full module directory
Declarations & Conflicts 09

Asset Declaration (HAD)

Employee asset ownership declarations — property, vehicles, investments — with periodic verification cycles.

Replaces today: Sealed envelopes kept in HR filing.
  • Periodic cycles & reminders
  • Change flagging
  • Verification workflow
Inside the module
HAD-2026-0098 2026 declaration cycle 92% submitted
HAD-2026-0091 New property flagged for review Verifying
See the full module directory
Risk & Oversight 10

Integrity Due Diligence (IDD)

Integrity screening for staff, vendors, and business partners, aligned with MACC Act 2009 Section 17A best practice.

Replaces today: Ad-hoc background checks done over email.
  • Staff & vendor screening
  • Risk-based scoring
  • Section 17A alignment
Inside the module
IDD-2026-0117 Vendor screening — Mesra Sdn Bhd Medium risk
IDD-2026-0113 Director check — two appointees Cleared
See the full module directory
Risk & Oversight 11

Corruption Risk Management

Identify, assess, and mitigate corruption risk through risk registers, MAP, KRIs, and a matrix dashboard.

Replaces today: Risk workshop whiteboards and stale slide decks.
  • Risk register & MAP
  • Key risk indicators
  • Matrix dashboard
Inside the module
CRM-2026-0043 Procurement — bid rigging exposure Mitigating
CRM-2026-0038 Cash handling — controls reviewed Residual: low
See the full module directory
Risk & Oversight 12

E-IBI Integrity Behaviour Index

Periodic surveys measuring the health of your organization's integrity culture via the E-IBI score.

Replaces today: One-off surveys run in generic tools.
  • Periodic culture surveys
  • E-IBI score tracking
  • Trend analysis
Inside the module
EIBI-2026-Q2 Integrity culture survey Closed — 78% resp.
EIBI-2026-Q3 Pulse survey — drafting Scheduled
See the full module directory
Governance & Compliance 13

Integrity Pact

Generate, e-sign, and manage digital integrity pact agreements with full audit trail.

Replaces today: Printed PDFs chased for wet signatures.
  • Digital pact generation
  • E-signature collection
  • Audit trail
Inside the module
IP-2026-0089 Pact — new vendor cohort 14 of 15 signed
IP-2026-0087 Pact renewal — advisory panel Sent for signing
See the full module directory
Risk & Oversight 14

PROTECT

Procurement, Transparency, Evaluation, Compliance & Tracking — monitor tenders end to end with integrity red flags.

Replaces today: Scattered tender records across units.
  • Tender monitoring
  • Integrity red flags
  • Approval-to-completion view
Inside the module
PRC-2026-0077 Tender 42/2026 — CCTV upgrade Red flag: linked directors
PRC-2026-0072 Quotation 18 — office supplies Evaluation
See the full module directory
Why i-IMS

Spreadsheets and email are not “adequate procedures”.

Integrity teams are asked to detect risk, enforce policy, and prove it to regulators — usually with tools built for neither. Here is what changes when the work moves into i-IMS.

Today

Complaints arrive by email, WhatsApp, and paper — and quietly get lost between inboxes.

With i-IMS

Every complaint enters one tracked intake with a case number, an owner, and a deadline from day one.

Official and whistleblower channels share the same register — nothing lives in someone's inbox.

Today

Whistleblowers stay silent because there is no way to report without fear of being identified.

With i-IMS

An encrypted, anonymous reporting channel with secure two-way chat protects identity while the case keeps moving.

Role-based access means identifying details are seen only when a case requires it.

Today

When an auditor asks “show me the trail”, the honest answer is reconstructing it from memory.

With i-IMS

Every submission, review, and decision is logged automatically — Section 17A and ISO 37001 evidence on demand.

One shared record across all 14 modules, so patterns — like repeat gifts from the same vendor — are never invisible.

14 modules, one login One shared record system Anonymous channel built in First module live in under a day
Why now

The law changed. Your evidence has to keep up.

Section 17A of the MACC Act made organizations liable for corruption by their people — unless they can prove adequate procedures. That proof has to come from somewhere.

Report received
Intake logged with case number
logged
Triage & assign
Owner, classification, deadline
logged
Investigation
Secure chat, evidence attached
logged
Resolution
Decision recorded, actioned
logged
Audit-ready export
Full trail, on demand
logged
Every step, every actor, every timestamp. That is what an “adequate procedures” defence is built on.
2018
MACC (Amendment) Act 2018 passed
Introduced Section 17A — corporate liability for corruption, a first for Malaysia.
2020
Section 17A comes into force
Commercial organizations become strictly liable for bribery by employees, agents, or associates acting on their behalf.
Today
GLCs, agencies, and PLCs are formalizing integrity units
Most still prove compliance with spreadsheets and manual filing — fragile evidence in a regulator's eyes.
What “adequate procedures” requires
Top-level commitmentLeadership sees a live dashboard of cases, declarations, and risk — not a quarterly slide deck.
Risk assessmentCorruption Risk Management and IDD modules document risk reviews as they happen.
Due diligence on staff & partnersIDD screening covers employees, vendors, and business partners before risk becomes exposure.
Communication & trainingIntegrity Strengthening tracks certification, ethics training, and pact participation by employee.
Monitoring & reviewEvery module logs who did what and when — the exact trail defences are built on.
How it works

From sign-up to audit-ready

Adopting a new system shouldn't mean a six-month IT project. This is the actual path from first login to your first audit trail.

1
Pick your modules

Choose which of the 14 modules your integrity unit needs first — most teams start with Complaints and COI.

2
Migrate existing records

Bring over open cases, declarations, and policy documents — historical data doesn't get left behind.

3
Set roles & approvals

Officers, investigators, and admins each see only what their role requires — enforced, not assumed.

4
Go live, audit-ready

From day one, every action is logged. The next regulator request is a report, not a scramble.

Deployment flexibility

Keep your data wherever policy demands.

From standard cloud SaaS to a private cloud under your own account, or fully on-premise — i-IMS is tailored to your comfort level, not the other way round.

Cloud SaaS

Fully managed on our ISO/IEC 27001-aligned infrastructure. Fastest to deploy, zero IT overhead.

Best for: fast start
Private Cloud

A dedicated, isolated environment provisioned under your organization's own cloud account.

Best for: control with comfort
On-Premise

Runs entirely within your own data centre — data never leaves your organization's walls.

Best for: strict data residency
Questions

Before you ask, we probably already did

i-IMS is a new category in Malaysia — here's what teams usually want to know first.

Is i-IMS just another whistleblowing or complaint tool?
No — most tools in this space handle one function, usually whistleblowing intake. i-IMS covers all 14 areas an integrity unit is responsible for: complaints, COI, gift declarations, asset declarations, disciplinary action, governance, risk management, and more — sharing one record system instead of 14 separate logins.
How does i-IMS handle PDPA and data protection?
Whistleblower identities are encrypted and access-controlled by role, so only authorized reviewers can see identifying details when a case requires it. Infrastructure runs on ISO/IEC 27001-aligned hosting, and every access to a record is logged — which also supports your obligations under Malaysia's Personal Data Protection Act.
We already use spreadsheets and email — why switch now?
Spreadsheets and email don't produce the kind of evidence trail Section 17A's “adequate procedures” defence requires, and they make it nearly impossible to spot patterns — like the same vendor showing up across multiple gift declarations. The risk isn't using simple tools today; it's still using them when a regulator asks for your controls.
How long does implementation actually take?
Most teams are live with their first module — usually Complaints or COI — within a day of setup. Full rollout across all 14 modules depends on how much historical data needs migrating, but there's no multi-month IT project required to get started.
Who is i-IMS built for?
Integrity and compliance units in GLCs, government agencies, and PLCs operating under Malaysian regulatory requirements — anyone responsible for proving “adequate procedures” under Section 17A, or formalizing integrity functions under ISO 37001.
Seen something that shouldn't be?

Make a public integrity report — you can stay anonymous. Already reported? Track your case status with your reference number.