01 / 07
Internal Audit & Assurance
Risk-based audit plans, control testing and board-ready reporting.
- IIA Professional Practices Framework
- COSO
Kuala Lumpur · Internal audit · ISO · Risk & compliance
Strong governance. Managed risk. Proven compliance.
Independent internal audit, ISO certification support and risk frameworks for private-sector organisations in Malaysia — delivered by a senior team, not a rotating cast.
- 7service lines
- 9standards & frameworks
- 11+years' GRC experience leading engagements
- 3countries in the Think Risk group
What we do
We help private-sector organisations in Malaysia prove their controls work — independent internal audit, ISO management systems, risk and compliance frameworks, and the process engineering that makes them operate in practice.
Standards & frameworks
Work measured against the standards that matter.
ISO 9001, 14001, 45001, 27001, 31000, 22301 and 37001 — plus COSO, the IIA framework, Section 17A and the ISPS Code.
See the full listServices
Seven service lines. One accountable lead.
-
-
02 / 07
Risk & Compliance Management
ISO 31000 frameworks, risk registers, obligations and governance.
- ISO 31000
-
03 / 07
Management Systems & ISO Support
Gap assessment to certification, including ISO 45001 safety systems.
- ISO 9001
- ISO 14001
- ISO 45001
- ISO/IEC 27001
-
04 / 07
Business Process Engineering & Re-engineering
Process maps, control gap analysis, SOPs and redesign.
- StrategyX
-
05 / 07
Business Continuity & Crisis Preparedness
Business impact analysis, ISO 22301 plans and exercises.
- ISO 22301
-
06 / 07
Fraud Investigation & Integrity
Investigations, Section 17A adequate procedures and ISO 37001.
- ISO 37001
- MACC Act s17A
-
07 / 07
Maritime Security & ISPS
ISPS Code assessments, voyage risk and security drills.
- ISPS Code
Industries
Built for the sectors that must show control.
Manufacturing & industrial
- Integrated ISO 9001 / 14001 / 45001 systems
- Customer, supplier and second-party audit readiness
- Production, maintenance and QA/QC process mapping
- Non-conformance and corrective action systems
Oil, gas & energy
- Contractor and vendor compliance assurance
- Operational risk and control reviews
- Licence, permit and obligations registers
- Business continuity and crisis preparedness
Maritime & port operations
- ISPS Code obligations for ships and port facilities
- Voyage and route-specific risk exposure
- Charterer, flag and terminal audit readiness
- Security drill and exercise obligations
Small & medium enterprises
- A first formal governance and risk framework
- Certification required by a customer or tender
- Process documentation as the business scales
- Fraud control for owner-managed businesses
Our leadership
Senior people on every engagement.
Our Malaysian practice is led by Director Nicole Lee Suresh, with Managing Director Mick Hannam bringing more than 35 years of international risk, audit and compliance experience. Every engagement is scoped and overseen by senior people.
-
-
Experience
The work behind the services.
-
Listed energy group
Group-wide enterprise risk management
Quarterly risk workshops with business units, risk register ownership, and reporting to the Board Risk Committee and Board — spanning FPSO, green technology and renewables.
Risk & Compliance Management -
Listed energy group
Business continuity framework
Group-wide business continuity framework and departmental continuity plans, including business impact analysis and continuity strategy design.
Business Continuity & Crisis Preparedness -
Independent whistleblowing hotline
Whistleblowing investigations
Interviews with complainants, accused parties and witnesses, covert verification where required, and findings presented to the whistleblowing panel.
Fraud Investigation & Integrity -
Government-linked company
SOPs and limits of authority
Standard operating procedure and limits of authority development, performance gap analysis with process owners, and transformation programme control.
Business Process Engineering & Re-engineering -
Government-linked & listed clients
Risk-based internal audit
Internal audit across pharmaceutical, healthcare, fund management, manufacturing, vessel chartering, construction, property and timber.
Internal Audit & Assurance -
Listed manufacturer
Anti-bribery risk assessment
Bribery and corruption risk assessment, and establishment of the business continuity programme.
Fraud Investigation & Integrity
What does an engagement cost?
It depends on the model. Projects such as a gap assessment or a single internal audit are quoted at a fixed fee for a fixed scope. Retained and co-sourced internal audit is billed as a retainer or per audit cycle, and investigations at a day rate. Tell us what you need and we will send a written proposal.
Do you issue ISO certificates?
No — certificates are issued by accredited certification bodies, and staying independent of them is the point. We prepare you for certification: gap assessment, system build, internal audit and pre-certification readiness, and we represent you during the certification audit.
Can you act as our internal audit function?
Yes. We can run your internal audit function entirely (outsourced) or work alongside your team (co-sourced) under an annual risk-based plan, reporting to your audit committee and board.
What is a Section 17A adequate procedures review?
Under Section 17A of the MACC Act 2009, a company can be liable for corruption by people associated with it unless it shows adequate procedures were in place. We review your anti-bribery framework against the government's guidelines, assess bribery risk and close the gaps — with ISO 37001 where you want certification.
Who will actually do the work?
Our senior team in Kuala Lumpur, supported by the group's audit and compliance specialists in Australia and the Philippines where the work calls for it. You will know who is on your engagement before it starts.
How quickly can you start an investigation?
Investigations are mobilised at short notice and scoped to the allegation. Send an enquiry marked urgent and we will respond as a priority.
