An internal reporting channel run by the people who might be reported on does not get used. We operate an independent channel on your behalf, triage what arrives, and give your audit committee a view of what is being reported without exposing the reporter.
An outsourced whistleblowing channel. Reports arrive through independent lines that Orbix operates, are triaged and recorded in a controlled case file, and are escalated to your nominated recipients under rules you set in advance.
A reporting channel is a required control under an organisational anti-corruption plan and under ISO 37001, and it is one of the adequate procedures a company relies on under section 17A of the MACC Act. It only works if people believe it is safe to use, and an email address monitored by the head of department is not that. Independence is the control, not the technology.
The channel is configured to your organisation: who may report, what may be reported, who receives what, and where the escalation route goes when a report concerns the usual recipient.
Multiple intake routes so people use the one they trust: a dedicated web form, an email address, and a phone line, available in English and Bahasa Malaysia. Anonymous reporting supported, with a mechanism to continue a conversation with an anonymous reporter.
Drafting or reviewing the whistleblowing policy: who is covered, what is in scope, the protection offered, how anonymity is handled, the escalation matrix and the conflict route when a report concerns a director or the usual recipient.
Every report acknowledged, assessed against your criteria, categorised and recorded in a controlled case file with a full audit trail. Reports that are not whistleblowing matters, such as HR grievances or customer complaints, are routed correctly rather than mishandled.
Escalation to your nominated recipients under agreed rules and timelines. Where you want it, investigation support from the integrity practice, or a fully independent investigation where the subject is senior enough that internal handling would not be credible.
Managing the confidentiality of the reporter's identity, the anonymous follow-up channel, and detriment monitoring after a report so retaliation can be detected rather than assumed absent.
Periodic reporting on volume, category, source, outcome and timeliness, presented so the audit committee can oversee the system without receiving information that would identify a reporter.
Independence is what converts a policy into a working channel. Reports that would have gone nowhere, or gone to a regulator or the press first, arrive where you can act on them.
Organisations with an OACP, an ISO 37001 system or a section 17A adequate procedures defence are asserting a reporting channel exists. This makes that assertion true and evidenced.
Every report is logged, acknowledged and tracked to an outcome with timestamps. The audit trail is the part that matters when a matter resurfaces two years later.
The hardest report is the one about the person it would normally be reported to. The escalation matrix settles that in advance rather than in the moment.
Regular reporting gives the committee genuine visibility into volume, themes and timeliness, which is what oversight requires and what most internal channels cannot produce.
It attaches naturally to Compliance Officer as a Service and to an existing integrity programme, without adding headcount.
Agreeing scope, who may report, categories, escalation matrix, timelines, the conflict route and the protection offered. Policy drafted or reviewed.
Standing up the web form, email and phone intake in both languages, with the case system configured to your categories and recipients.
Launch materials so people know the channel exists and believe it is safe. Awareness content, and briefing for the recipients on what they will receive and what they must do with it.
Reports acknowledged within the agreed time, assessed, categorised and recorded. Non-whistleblowing matters routed to the right internal process.
Escalation under the agreed rules, with investigation support or independent investigation where required.
Periodic board and audit committee reporting, plus annual review of categories, timeliness and whether the channel is being used at the rate you would expect.
Policy, scope, categories, escalation matrix, timelines and the conflict of interest route.
Live web, email and phone intake in English and Bahasa Malaysia, with anonymous follow-up supported.
A controlled file per report with acknowledgement, assessment, escalation, actions and outcome, all timestamped.
Communications that make the channel known and credible, plus briefing materials for nominated recipients.
Volume, category, source, timeliness and outcome reporting for management and the audit committee.
Assessment of channel usage, handling quality and timeliness, with recommendations.
We do not resell products, so nothing here is shaped by a vendor margin. The recommendation is whatever your risk and your budget actually justify, including telling you that you do not need the engagement yet.
Findings come with a sequence, an owner and a realistic effort estimate, sized to the team you have rather than the team a framework assumes. A report that cannot be acted on is an expense, not a control.
Our people have carried the obligation internally, not only audited it. That shows up in what we consider proportionate, and in how much documentation we think you genuinely need.
Work is grounded in Malaysian law and regulator expectation, from the PDPA and the Cyber Security Act 2024 to Bursa, BNM and SC requirements, rather than translated from a European or American template.
Where an engagement includes training, the training component is structured to be HRD Corp SBL-Khas claimable, which changes what the programme costs you in practice.
Not as a standalone statutory duty for most Malaysian companies. It becomes effectively required through other routes: as a control in an organisational anti-corruption plan, as a requirement of ISO 37001, as part of the adequate procedures a company relies on under section 17A of the MACC Act, and through the Malaysian Code on Corporate Governance for listed issuers.
Yes. The channel supports anonymous reporting with a follow-up mechanism, so an investigator can ask an anonymous reporter for more detail without learning who they are. Anonymity does limit what can be investigated, and we are explicit with reporters about that.
Your nominated recipients, typically the integrity officer, the audit committee chair, or both, defined in the escalation matrix. Orbix triages and escalates; we do not decide outcomes. Where a report concerns a nominated recipient, the matrix routes it elsewhere automatically.
Triage. A significant share of what arrives on any channel is a grievance, a customer complaint or a personal dispute. Those are identified and routed to the right internal process rather than being investigated as integrity matters or ignored.
Case files are held under access control with a defined retention period, and the reporter's identity is restricted to the minimum set of people. Handling follows the PDPA, and the policy tells reporters plainly what will happen to their information.
That case is designed for in advance. The escalation matrix routes reports concerning senior management or directors to the audit committee chair or to an independent director, and we will recommend an independent investigation where internal handling would not be credible.
Optionally. Many organisations investigate internally and use us only for the channel. Where the subject is senior, or where independence matters for the finding to be believed, the integrity practice can run the investigation.
Tell us your headcount, your structure and whether this is driven by an OACP, ISO 37001, a listing requirement or a board decision. We will come back with a framework, an escalation design and a fixed quotation.
