Commentary by Datuk Mohamad Fauzi Husin, President of the Malaysian Integrity and Anti-Corruption Organisation (INTRAS) and former Deputy Commissioner of the Malaysian Anti-Corruption Commission.
The country does not lack auditors, audit committees or oversight mechanisms. What deserves greater attention is whether weaknesses identified through these processes are corrected, monitored and prevented from recurring.
This is particularly important when the institutions being audited manage public money, national assets and funds entrusted to them by Malaysians.
The National Audit Department, independent auditors, internal audit units, boards of directors and parliamentary oversight mechanisms each have different responsibilities. Their effectiveness, however, ultimately depends on what happens after an audit finding is reported.
An audit should trigger action, not merely produce another report.
Where weaknesses involve procurement procedures, financial controls or regulatory compliance, management should be required to identify those responsible, implement corrective measures and demonstrate that the underlying problem has been resolved. Suspected criminal misconduct should be referred to the appropriate authorities.
Every significant finding should have an accountable officer, a completion deadline and evidence that remedial action has worked. Follow-up audits should establish whether the same weaknesses continue to occur.
The same principle applies to public institutions such as Tabung Haji, Permodalan Nasional Bhd (PNB), Pelaburan Hartanah Bhd (PHB) and MARA.
For Tabung Haji, audit effectiveness should be measured by improvements in governance, investment decisions and depositor protection. At PNB and MARA, the existence of multiple control mechanisms must be accompanied by a clear process for resolving findings and preventing recurrence.
Strong financial performance does not eliminate the need for scrutiny. Audit should identify emerging risks before they turn into losses, rather than merely explain what went wrong afterwards.
The experience of Retirement Fund Incorporated (KWAP) offers another lesson.
KWAP invested RM163.4 million for approximately 2.51% of Indonesian aquaculture technology company eFishery. The investment subsequently came under scrutiny following the discovery of financial manipulation at the company.
KWAP has said the investment underwent due diligence and that it subsequently reviewed its investment processes and post-investment monitoring arrangements. The fund is also pursuing available avenues to maximise recovery.
The case demonstrates why due diligence cannot be treated as a one-off exercise.
Investment committees must continue evaluating financial performance, operational developments and emerging warning signs after funds have been committed.
Importantly, an unsuccessful investment does not automatically establish corruption or wrongdoing by the investor. The appropriate response is to examine what information was available when the decision was made, whether warning signs were identified and how the institution responded when problems emerged.
Strengthening The Auditor-General’s Independence
Institutional independence is another area deserving attention.
Article 105(1) of the Federal Constitution provides that the Auditor-General is appointed by the Yang di-Pertuan Agong on the advice of the Prime Minister after consultation with the Conference of Rulers.
INTRAS proposes consideration of a parliamentary special committee comprising government and opposition MPs to assess and nominate candidates for the position.
Such a change would require consideration within the constitutional framework. Its intended purpose would be to strengthen transparency, merit-based selection and public confidence in the independence of the institution responsible for auditing government activities.
Independence, however, should not mean an absence of accountability. The Auditor-General must be able to perform the office’s duties without improper interference while remaining subject to appropriate institutional checks and scrutiny.
What Matters Is What Changes After The Audit
For the public, the most useful question is not simply whether an institution has been audited.
It is whether the audit identified weaknesses, whether management corrected them, whether those corrections were independently verified and whether similar problems subsequently recurred.
Public institutions should be able to demonstrate that audit findings have produced measurable improvements in governance, financial controls and decision-making.
Audit without corrective action produces reports. Due diligence without continuous monitoring leaves investments exposed.
Protecting public money requires both independent oversight and a culture in which warning signs lead to timely intervention, responsibility and lasting institutional improvement.
