A recent panel session on “The Safeguarded Boardroom” featuring Pav Gill, whose disclosures helped expose the Wirecard scandal, is a timely reminder that corporate governance is tested not by the policies an organisation adopts, but by what happens when someone with courage raises an uncomfortable truth.
The collapse of Wirecard, one of the defining corporate scandals of our era, exposed a deeper systemic failure: internal escalation mechanisms that existed on paper but failed in practice. Wirecard had whistleblowing hotlines, compliance frameworks and audit committees in place. So what happened? Were concerns raised by employees diluted, reframed or suppressed as they moved up the corporate hierarchy? Critical warning signs escalate throughout the lifecycle but yet, did those responsible for addressing these concerns have an interest in keeping them from coming to light? Were there no independent directors that similarly questioned any anomaly?
For Malaysian business leaders, legal advisers and boards, Wirecard offers an urgent wake-up call. A formal whistleblowing policy is merely the starting point. The real challenge is ensuring that employees can speak up without fear, investigations remain independent, and technology does not dilute accountability.
In Malaysia, statutory protections for whistleblowers appear robust on paper. Section 7(1) of the Whistleblower Protection Act 2010 provides for confidentiality, immunity from civil and criminal action, and protection against detrimental action in respect of disclosures of improper conduct made to an enforcement agency, subject to the Act. Section 15 and Section 16(2) provide further legal consequences of detrimental action.
Recent court decisions have given these protections greater practical significance. In Norhaida binti Ramli v Majlis Agama Islam Wilayah Persekutuan & 2 Ors (2026), the High Court held an enforcement agency accountable for disclosing a whistleblower’s identity and awarded monetary damages. The decision is believed to be the first reported judicial decision of its kind under the Act. This is mind boggling as the legislation year for the Whistleblower Act is 2010; and it took sixteen years until a reported judicial decision came to light.
The Malaysian Competition Commission (MyCC) is also seeking to address a gap in whistleblower protection in cartel cases. The Competition (Amendment) Bill 2026, which proposes new Sections 64A and 64B, was passed by the Dewan Negara (Senate) on July 27, 2026. The proposed provisions would protect whistleblowers’ identities and empower MyCC to offer financial rewards for information leading to the detection of cartel arrangements and anti-competitive practices. This addresses a gap in the existing Whistleblower Protection Act 2010 that does not extend to civil competition cases.
The need for reform is not merely theoretical. In September 2026, MyCC’s chief executive, Datuk Iskandar Ismail, acknowledged that some complainants had previously come forward but left when no reward was offered. He also highlighted the risk of losing one’s job for disclosing confidential company information. This highlights two barriers: the personal cost of speaking up and the absence of an incentive to continue cooperating with an investigation.
Importantly, the proposed protections go beyond confidentiality. They also seek to guard against reprisals, including contract termination, unreasonable litigation, withholding of payments and refusal to enter into subsequent contracts. Identity protection alone may offer little reassurance if speaking up can still jeopardise a person’s livelihood or professional relationships.
The proposed framework is a welcome step towards addressing these barriers. With the amendments still at an early stage, their practical impact remains to be seen. The absence of publicly reported developments does not, however, mean that the protections are ineffective. Confidentiality, safeguards and a safe space without feeling intimidated, threatened, vulnerable or feeling traumatised is itself central to building the trust needed for individuals to speak up.
Legislation alone cannot eliminate the fear that persists within corporate institutions. Employees may hesitate to speak up if they believe doing so could lead to ostracisation, stalled career progression or reputational damage. Legal protections offer limited reassurance without trust in the system itself.
This governance dilemma is global. When Anthropic whistleblower Jacob Coxon testified before the New York City Council about AI development risks, he highlighted the risks faced by those who challenge their organisations’ commercial interests. Protecting whistleblowers requires more than legal remedies. It also requires reporting channels employees can trust, including independent third-party platforms, which let employees raise concerns outside the usual management hierarchy. Corporations should retain professional firms with adequate, robust and comprehensive whistleblowing structures which streamlines the process for both whistleblowers and companies.
When a concern successfully reaches management, commercial interests can compromise the investigation that follows. Recent Malaysian High Court decisions illustrate how this can happen, and where legal accountability may ultimately lie.
In TRIplc Medical Sdn Bhd v Zaidi Mohamed Nor & Anor (2026), the High Court examined an internal domestic inquiry into allegations that a senior general manager had made secret profits and misappropriated corporate assets. During the trial, the lead investigator admitted that the investigation team deliberately avoided interviewing key external government stakeholders to prevent embarrassment to the company and protect its commercial relationships. The case illustrates how protecting business interests can compromise an investigation’s thoroughness and credibility.
The issue extends beyond internal investigations to the information management presents to the board. In Kulim (Malaysia) Berhad & Anor v Ahamad Mohamad & Ors (2026) involving cross-border plantation investments, senior executives were found to have filtered out critical legal red flags and bypassed explicit board directions on independent valuations. Although the High Court granted statutory relief under Section 581 of the Companies Act 2016 and described the directors’ failure as a “defect of procedure, not a defect of character” because they acted honestly, the case highlights the importance of full and frank disclosure. Nonetheless, honest intentions do not excuse withholding material information or adverse legal opinions from the board. The decision is currently under appeal.
Individuals also cannot escape responsibility by claiming they were following orders. In Golden Plus Holdings Bhd v Teh Wei Kian & Ors (2025) involving the diversion of corporate assets through overseas subsidiaries over two decades, senior officers who were not directors, including a general manager of finance, argued that they were merely carrying out their superiors’ instructions. Reaffirming the principle that “fraud unravels all”, the High Court held that senior finance officers occupy positions of trust and cannot blindly follow improper instructions or rely on tainted board resolutions to escape liability. Hierarchy does not absolve individuals of responsibility.
As organisations integrate artificial intelligence into compliance monitoring, document review, and internal investigations, boards face new evidential and liability risks. While AI platforms process vast datasets rapidly, courts worldwide have begun addressing that technological efficiency does not dilute human accountability.
In Crescendo Education Sdn Bhd v KTC Human Resource Consultants Sdn Bhd & Anor, (2024) the Malaysian High Court addressed the evidentiary risks of AI-generated material, emphasising the need to verify such material against primary source documents. Overseas decisions offer further lessons. In Moffatt v Air Canada (2024), a Canadian tribunal held an airline responsible for inaccurate information provided by its chatbot, while in ASIC v Bekier [2026] FCA 196, the Australian Federal Court underscored that AI may help directors process large volumes of information, but cannot replace their informed and independent judgment.
Accountability and liability remains human. AI-generated summaries and analyses must still be checked against reliable sources, with clear audit trails documenting the material relied upon and how they reached their conclusions. Without these checks, technology may accelerate information production without improving its reliability.
Accountability also matters when workplace concerns arise. Rather than letting internal friction escalate into formal litigation, organisations should consider alternative dispute resolution (ADR) such as mediation at an early stage, to “nip it in the bud”.
In Malaysia, the Ministry of Human Resources has highlighted the financial and operational benefits of early workplace mediation. Conducted confidentially, mediation offers a structured way to address interpersonal conflicts, executive grievances and retaliation claims before they escalate into costly disputes or damage the organisation’s reputation. But mediation has its limits. Allegations of financial fraud, secret profits or statutory breaches require independent investigation and cannot simply be resolved through mediation.
A resilient boardroom requires moving beyond paper compliance. Organisations need independent reporting channels that bypass executive gatekeepers, investigations that put the facts ahead of commercial interests, proper verification of AI-generated outputs, and early intervention in workplace disputes.
Governance is not measured by the safeguards an organisation has on paper, but by whether they stand up to scrutiny. Anyone can write a policy. Few can survive one being used. Governance is tested. Not written.
Mary-Ann Ooi Suan Kim (Kim) is managing partner of OS Kim & Associates, Barrister of Lincoln’s Inn; Advocate and Solicitor of Malaya; adjunct professor of Practice, Sunway University; external advisor (Industry) Board of Studies, Faculty of Law, Universiti Kebangsaan Malaysia; member, Board of Advisors, University of Sheffield School of Law; member, Legal Professional Advisory Panel, Taylor’s University and Royal Institution of Chartered Surveyors Accredited Mediator.