By Assoc. Prof. Dr. Noor Adwa Sulaiman
The recently declassified Royal Commission of Inquiry report on Lembaga Tabung Haji (LTH) is more than an account of past financial and investment problems. It offers an important lesson on what can happen when governance is weak, controls fail to challenge decisions, and accountability becomes blurred. For an institution entrusted with the savings of millions of Malaysian Muslims, these issues go directly to the heart of public trust.
The RCI identified several interconnected weaknesses, beginning with the governance structure itself. First, it highlighted the broad powers vested in the responsible minister under the Tabung Haji Act 1995 and the lack of sufficiently specific professional requirements for board appointments. It also raised concerns over political considerations influencing decisions involving hibah, hajj charges and financial support. This is fundamentally a governance issue within the practices of LTH.
Good governance is not simply about having a board or committees in place. It is about ensuring that those entrusted with authority possess the competence, independence and willingness to exercise effective oversight. An institution managing billions of ringgit requires board members with relevant expertise in finance, investment, accounting, risk and governance. Political or representational considerations should not outweigh professional competence.
The RCI therefore recommended stronger competency requirements for board members and restrictions on active politicians serving on the boards of LTH and its subsidiaries. The underlying principle is clear: decisions involving depositors’ money must be guided primarily by fiduciary responsibility and long-term financial sustainability.
A second concern was the pressure to maintain high hibah distributions. The RCI found that the desire to sustain attractive returns between 2014 and 2017 contributed to greater investment risk and weakened financial resilience. It also referred to the use of “creative accounting” in relation to hibah distributions. This illustrates how governance and control are closely connected.
Performance expectations are not necessarily problematic. But when expected outcomes become targets that must be achieved regardless of financial circumstances, they can weaken judgement and encourage excessive risk-taking or aggressive accounting assumptions. A strong control environment should provide a counterweight to such pressure.
Hibah decisions should therefore be linked clearly to realised income, asset quality, liquidity and financial strength. The RCI’s recommendation that distributions be based on audited financial statements rather than alternative valuation approaches is particularly important. The broader lesson is that controls should protect an institution from sacrificing long-term sustainability for short-term expectations.
The third issue concerns financial reporting practices in LTH. The RCI stated that if applicable financial reporting standards had been fully reflected in 2017, LTH would have recorded an estimated RM1.4 billion net loss rather than the RM3.4 billion profit reported.
That is more than an accounting technicality. Financial reporting is a central mechanism of accountability. Depositors, regulators and boards rely on financial statements to understand whether an institution is genuinely financially sound. When reported performance diverges substantially from underlying economic reality, both control and accountability are weakened.
Controls over impairment, valuation and significant accounting estimates must therefore be robust and independent. Material judgements should be subject to challenge by audit committees, internal auditors, external auditors and, where necessary, independent experts.
The RCI also raised uncomfortable questions about the effectiveness of external audit. It criticised the firmness of the 2017 audit response and concluded that the accounting issues identified warranted stronger action. The lesson is important. Auditors do not protect confidence by avoiding difficult audit conclusions. They protect confidence by ensuring that the financial information relied upon by stakeholders is credible. Effective control therefore depends not only on procedures but also on independence and professional scepticism.
A fourth issue involves investment governance. The RCI recommended forensic audits into several investments that had suffered significant deterioration in value. It is important to distinguish between investment losses and misconduct. An investment loss is not automatically evidence of fraud. Markets change, businesses fail and legitimate investment decisions can produce poor outcomes.
However, every significant loss should be explainable. From an accountability perspective, institutions must be able to identify who proposed an investment, who performed due diligence, who assessed the risks, who challenged the assumptions, who approved the transaction and who monitored its subsequent performance. Without this clear chain of responsibility, accountability becomes diluted.
The RCI also raised concerns over board members and senior management holding multiple positions across subsidiaries and committees. Such arrangements may create conflicts of interest and contribute to accountability diffusion, where responsibility becomes so widely shared that no one is clearly answerable for the outcome. More committees do not necessarily mean stronger accountability. Good governance requires clear ownership of decisions.
The fifth issue is the wider effectiveness of internal controls and oversight. The RCI’s findings were not confined to one transaction or one department. Weaknesses emerged across financial reporting, investment decisions, auditing, board oversight and governance arrangements. This suggests that the problem was not simply the failure of a particular control, but the inability of different layers of oversight to challenge one another effectively.
A sound governance system requires several lines of defence. Management must operate within approved policies. Risk management must identify emerging risks. Internal audit must independently test controls within an organization. Audit committees and boards must challenge management. External auditors must provide credible assurance, while regulators must intervene when risk becomes excessive. When these mechanisms operate independently, one layer can compensate when another fails.
The RCI’s recommendations therefore provide an important reform agenda. Board appointments should be competency-based and independent. Political influence over fiduciary decisions should be limited. Financial reporting and hibah decisions should rely on transparent, audited financial information. Internal audit and risk functions should have sufficient authority to escalate concerns directly to the board. Major investments should also be supported by stronger documentation, independent review and clearly assigned responsibility.
Public institutions could also benefit from periodic governance reviews, in addition to financial audits. Such reviews should assess board effectiveness, conflicts of interest, management override, risk culture and whether internal challenge genuinely works. Most importantly, accountability must follow authority. Those who have the power to approve major decisions must also be responsible for explaining those decisions and their consequences.
The wider lesson from the RCI report is therefore not merely about what went wrong in the past. Governance determines who has power and how that power is constrained. Controls determine whether questionable decisions can be detected and challenged. Accountability ensures that those who exercise authority must answer for their actions. Weak governance allows poor decisions to be made. Weak controls allow them to continue. Weak accountability allows responsibility to disappear after the damage is done. The real test is whether the lessons from the RCI can now be used to strengthen Malaysia’s public institutions before the next crisis occurs.
