(Oct 15): Corporate governance in Malaysia is entering an enhanced phase. As Malaysia moves towards the forthcoming 2026 revision of the Malaysian Code on Corporate Governance (MCCG), attention is moving beyond boards and directors to the wider governance ecosystem, including the role and accountability of company secretaries.
The shift is significant. In a recent speech, the Securities Commission (SC) Chairman said consultations for MCCG 2026 highlighted the need to strengthen the competence, capabilities and professionalism of company secretaries.
The SC is exploring a multi-stakeholder task force and a standardised competency framework, while working with Bursa Malaysia on fit-and-proper and accountability requirements for company secretaries of listed companies. This raises a bigger question.
After 26 years of the MCCG, what should the next phase of corporate governance look like?
The MCCG, first introduced in 2000, was never meant to be a rulebook. It was designed to encourage companies to go beyond minimum legal and regulatory requirements. It was reviewed four times, in 2007, 2012, 2017 and 2021, as markets, expectations and business risks changed. Yet repeated revisions raise another difficult question. Why do serious corporate failures and misconduct continue to take place?
The answer is not that the MCCG has failed. A code can set expectations, but it cannot guarantee behaviour. The SC continues to take enforcement action against misconduct involving listed companies.
In August 2026, the Kuala Lumpur High Court ruled in favour of the SC in a case involving five individuals and four public-listed companies (PLCs), finding that the SC had proved its case involving a scheme to defraud and wrongful losses.
The defendants were ordered to pay a total of RM103.75 million in disgorgement, civil penalties and costs. The SC’s 2025 surveillance had also identified potential wrongful loss, financial misrepresentations and other emerging risks among PLCs.
This does not show that governance rules are ineffective. It shows that governance is ultimately about behaviour as much as structures and policies.
Some governance expectations promoted through the Code have already moved beyond it into mandatory requirements. Audit committees and internal audit functions are now embedded in Bursa Malaysia’s listing requirements. PLCs must also have at least one woman director.
But the MCCG has deliberately retained flexibility. For example, MCCG 2017 introduced the establishment of a Risk Management Committee as Step Up Practice 9.3, but this is not a mandatory requirement under the Bursa Malaysia Listing Requirements.
Since 2017, its approach has been “apply or explain an alternative”, allowing companies to use a different approach if they explain how it achieves the intended outcome. That flexibility has merits because companies differ. The question now is when flexibility becomes a limitation.
The Securities Commission’s Corporate Governance Monitor 2025 gives an interesting picture. Of its 48 best practices, 33 had adoption rates of at least 90%. On the other hand, some practices remain difficult to adopt. Only 5% of PLCs disclosed detailed remuneration of senior management.
Women made up 34.1% of directors among the top 100 PLCs and 28.7% across all PLCs. The contrast is revealing. Voluntary adoption can work well when a practice is widely accepted and easy to implement. It becomes harder when greater transparency, behavioural change or commercially sensitive information is involved.
The Code’s strength, its flexibility, is also its weakness. It relies on companies to choose transparency when transparency is not always in their interest. This matters for investors and financial reporting. Investors do not look only at the profit figure or balance sheet. They also want to know who oversees the company, how risks are managed and whether management incentives are properly disclosed. Good governance supports the credibility of the financial information investors rely on.
This is where the forthcoming MCCG 2026 becomes important. The SC has said the new Code is being shaped around accountability, integrity, transparency and effective oversight, while encouraging more forward-looking boards and organisations to address issues affecting long-term value creation.
The answer is not to make everything mandatory. Some corporate governance mechanisms are already clearly established under the Companies Act 2016, including requirements relating to directors, company secretaries and auditors.
Making every governance practice mandatory would turn a principles-based Code into another compliance checklist. Instead, the forthcoming MCCG 2026 should distinguish between practices that should remain flexible and those too important to leave entirely to choice, especially as boards face new challenges involving technology, artificial intelligence and cybersecurity.
After more than two decades, the challenge is no longer simply writing better governance principles. It is deciding where accountability should sit, where ethical responsibility should be reinforced and which expectations should remain flexible.
Ultimately, corporate governance exists to protect stakeholders, especially investors. That may be the real test of MCCG 2026 when it is issued.
Hijat A. Jabbar is a professor and Rohami Shafie an associate professor of accounting at Universiti Utara Malaysia.