BeME Community

Materiality assessment consulting sits at a specific fork in the road for Malaysian companies: unlike the European Union's Corporate Sustainability Reporting Directive, which requires companies to assess both financial and impact materiality under a "double materiality" model, Malaysia's National Sustainability Reporting Framework follows IFRS S1 and S2's single, financial materiality lens, focused specifically on what could reasonably affect a company's cash flows, access to finance, or cost of capital. That distinction shapes almost every practical decision in how a materiality assessment should actually be run, and getting it wrong, by applying an EU-style double materiality process where Malaysia's framework only requires a financial lens, wastes real time and resources.

What Is a Materiality Assessment, and Why Does the Type of Materiality Matter?

A materiality assessment is a structured process for identifying which sustainability-related topics are significant enough to a company to warrant formal disclosure and strategic attention, and the specific type of materiality applied, financial, impact, or both, determines exactly which topics make that cut. Under Malaysia's NSRF, this matters directly because a topic that would be flagged as material under an impact-focused lens may not clear the bar under IFRS S1's financial materiality standard, and vice versa.

Financial materiality asks whether a sustainability topic could reasonably affect a company's cash flows, access to finance, or cost of capital, the lens Malaysia's NSRF requires under IFRS S1 and S2. Double materiality, the approach used under the EU's CSRD framework, adds a second dimension, impact materiality, assessing how a company's operations affect the environment and society regardless of whether that impact carries a direct financial consequence back to the company. Materiality assessment consulting in Malaysia needs to be explicit with clients about which lens actually applies to their reporting obligations, since companies with European operations or investors sometimes assume they need the fuller double materiality process when their core Malaysian disclosure requirement is narrower.

How Long Does a Proper Materiality Assessment Typically Take?

A proper materiality assessment typically takes between two and six months for a large company, depending on organizational complexity, existing ESG infrastructure, and how many business functions need to be consulted, with a general framework of one to two weeks for scoping, four to six weeks for stakeholder engagement and issue identification, two to four weeks for scoring and validation, and roughly two weeks for final documentation and sign-off. Companies expecting this process to be completed in a matter of days are generally underestimating what genuine stakeholder engagement requires.

A company with a global supply chain and limited existing ESG infrastructure tends to sit at the longer end of this range, while a business with an established risk management function and prior sustainability reporting experience can generally move faster. Materiality assessment consulting engagements typically also require input from a genuinely wide range of internal functions, commonly including sustainability, finance, risk, operations, procurement, human resources, legal, and IT, since a materiality assessment built without input from functions like procurement or risk tends to miss issues that only become visible once those specific perspectives are consulted.

What Does the Stakeholder Engagement Phase of a Materiality Assessment Actually Involve?

The stakeholder engagement phase of a materiality assessment involves systematically gathering input from both internal groups, such as employees and management across different departments and regions, and external groups, such as customers, suppliers, investors, and community representatives, using a mix of surveys, interviews, and structured workshops to capture how each group views the company's most significant sustainability issues. This phase is consistently the most time-intensive part of a well-run materiality assessment, and shortcuts taken here tend to weaken the credibility of everything that follows.

Larger organizations often run this engagement at genuinely significant scale; one global consumer goods company's stakeholder engagement survey covering eleven stakeholder groups received more than 20,000 responses from domestic and international participants in a single cycle. Most Malaysian companies will not need engagement at this scale, but the underlying principle holds regardless of company size: engagement needs to reach a genuinely representative cross-section of stakeholders, not simply the internal teams and a handful of convenient external contacts, since a materiality assessment weighted too heavily toward internal perspectives risks missing issues that external stakeholders, particularly investors and communities, consider far more significant than internal teams realize.

How Are Materiality Assessment Findings Turned Into a Usable Matrix?

Materiality assessment findings are turned into a usable matrix by applying a structured scoring methodology to each identified topic, typically plotting financial significance on one axis, and consolidating the results into a visual matrix that ranks topics by relative importance, giving leadership a clear, prioritized view of which issues deserve the most attention and resourcing. This scoring step is where a materiality assessment moves from a broad list of potentially relevant issues to a genuinely prioritized set of disclosure and strategy priorities.

This scoring generally needs to weigh sustainability-related risks, impacts, and opportunities alongside a company's other business risks, ensuring the resulting priorities reflect a balanced view rather than treating sustainability topics in isolation from the rest of the company's risk landscape. Materiality assessment consulting typically culminates in presenting this matrix to senior leadership, sometimes through a dedicated sustainability committee, for formal review and sign-off, since a materiality assessment without genuine leadership validation risks being treated as a technical exercise disconnected from how the company is actually run.

Why Does Leadership Sign-Off Matter So Much for a Materiality Assessment?

Leadership sign-off matters because a materiality assessment is meant to shape a company's actual strategic priorities and disclosure focus, and findings that never receive genuine review and validation from senior leadership tend to remain a document produced by the sustainability team rather than a set of priorities the whole organization is actually working from. This step is what connects the technical materiality process back to real governance and decision-making.

Companies running well-structured materiality assessments generally build in a formal review stage where prioritized topics and identified risks and opportunities are presented to a chief sustainability officer or equivalent role, and then escalated further to senior leadership or a board-level committee for final validation and strategic alignment. Materiality assessment consulting that treats this sign-off step as a formality, rather than a genuine decision point, risks producing a matrix that looks rigorous on paper but has no real bearing on where the company actually allocates resources or attention.

How Often Should a Materiality Assessment Be Repeated?

A materiality assessment should generally be repeated at least every two years, or sooner in response to significant shifts in the external environment, such as major regulatory changes, a substantial acquisition, or a material shift in the company's business model, since a materiality assessment built around outdated assumptions can misdirect a company's disclosure and strategic focus for years if left unrevisited. Some companies additionally monitor for material developments between full reassessments through a lighter, ongoing process sometimes referred to as dynamic materiality.

A company that has undergone significant inorganic growth, for example, may find that a materiality assessment conducted before a major acquisition no longer accurately reflects its current operations or risk profile, making an earlier-than-scheduled reassessment genuinely necessary rather than optional. Materiality assessment consulting engagements increasingly build this review cadence into the initial project scope, agreeing upfront on both a formal reassessment cycle and the specific triggers, such as a major regulatory change like an NSRF reporting phase shift, that would justify revisiting the assessment ahead of schedule.

Is a Materiality Assessment a One-Time Deliverable or an Ongoing Capability?

A materiality assessment should be treated as an ongoing capability rather than a one-time deliverable, since the underlying process, stakeholder engagement infrastructure, scoring methodology, and leadership review structure, needs to persist within the organization well beyond the initial assessment in order to support the periodic reassessments that keep the results genuinely current. Companies that treat their first materiality assessment as a completed project, rather than the establishment of a repeatable internal capability, tend to find each subsequent reassessment more difficult and costly than it needs to be.

This distinction matters directly for how materiality assessment consulting should be scoped: an engagement focused purely on delivering a single matrix leaves a company having to rebuild much of the underlying process from scratch at the next reassessment cycle, while an engagement explicitly designed to transfer methodology and stakeholder engagement infrastructure into the business leaves the company considerably better positioned to run future assessments with less external support each time.

How Should Malaysian Companies Structure a Materiality Assessment Project?

Malaysian companies should structure a materiality assessment project by first confirming which materiality lens applies to their specific reporting obligations, financial materiality under IFRS S1 and S2 for NSRF purposes, then running structured stakeholder engagement across a representative set of internal and external groups, and finally scoring, validating, and securing leadership sign-off on the resulting priorities before building those findings into the company's broader ESG strategy.

What Should Be Confirmed Before a Materiality Assessment Begins?

Before a materiality assessment begins, a company should confirm exactly which materiality standard applies to its reporting obligations, which internal business functions will need to provide input, and which external stakeholder groups genuinely need to be engaged, since starting the process without this clarity tends to produce scope creep once the assessment is already underway.

What Is the Biggest Risk of Rushing a Materiality Assessment?

The biggest risk of rushing a materiality assessment is producing a matrix that looks complete but is built on inadequate stakeholder input, meaning the resulting priorities may not genuinely reflect what matters most to the company's investors, regulators, and other key stakeholders, undermining the credibility of every subsequent strategy and disclosure decision built on top of it.

What Are the Different Perspectives on How Rigorous a Materiality Assessment Needs to Be?

Perspectives differ on how rigorous a materiality assessment genuinely needs to be, particularly for smaller Malaysian companies: some argue that a lighter, faster process focused only on the most obvious material topics is sufficient given resource constraints, while others, including much of the ESG consultancy profession, argue that a genuinely rigorous, well-documented process is necessary regardless of company size, since materiality findings underpin every subsequent disclosure and strategy decision.

The case for a lighter process reflects real resource constraints; a smaller company without dedicated sustainability staff may reasonably question whether a multi-month, multi-function engagement is proportionate to its size and current reporting obligations, particularly if it does not yet fall within Malaysia's NSRF reporting groups. The case for genuine rigor rests on the fact that a materiality assessment built on a rushed or incomplete process risks directing a company's limited ESG resources toward the wrong priorities entirely, a mistake that tends to be more costly to correct later than the time saved by rushing the initial assessment. A reasonable middle path is for smaller companies to scale the engagement's scope, fewer stakeholder groups, a narrower set of business functions consulted, while still preserving the core structure of a defensible process: genuine stakeholder input, documented scoring, and leadership review, rather than skipping these steps entirely in the name of speed.

Conclusion

Getting materiality right matters more than getting it fast because every subsequent piece of a company's ESG strategy, its KPIs, its roadmap, its disclosure priorities, is built directly on top of whatever the materiality assessment identifies as significant. A rushed or poorly scoped assessment does not just produce a weaker document; it risks steering a company's genuine resources and attention toward the wrong issues for years, since the results typically stand until the next formal reassessment cycle.

As Malaysian companies continue building out their NSRF disclosure processes under IFRS S1 and S2's financial materiality standard, materiality assessment consulting that respects both the specific lens Malaysia's framework requires and the genuine time and stakeholder engagement a credible process demands is what gives a company confidence that its ESG strategy is actually built on the issues that matter most, rather than a matrix assembled to satisfy a deadline.

References

• Senken, Double Materiality Assessment — https://www.senken.io/glossary/double-materiality
• Wellkinetics, Materiality Assessment: A Strategic Guide for Businesses in Malaysia — https://wellkinetics.com.my/materiality-assessment-guide-malaysia/
• Royal Ahrend, Double Materiality Process and Outcomes — https://integratedreport.ahrend.com/en/royal-ahrend-integrated-report-2025/sustainability-statements-2025/double-materiality-process-and-outcomes
• Tata Power, Materiality Assessment — https://www.tatapower.com/html/integrated-annual-report-2026/materiality-assessment
• Charoen Pokphand Group, Stakeholder Engagement and Materiality Insights Supplement 2025 — https://www.cpgroupglobal.com/th/document/viewer/915/stakeholder-engagement-and-materiality-insights-supplement-2025-english
• Tata Consumer Products, Materiality Assessment and Stakeholder Discussions — https://www.tataconsumer.com/iar-2025-26/governance-stewardship/materiality-assessment-stakeholder-discussions/
• Godrej Consumer Products, Double Materiality 2024–25 — https://www.godrejcp.com/public/uploads/reports/2024-25/Double-Materiality-2024-25.pdf
• Dalmia Bharat, Integrated Annual Report 2025–26: Materiality Assessment Approach and Methodology — https://www.dalmiacement.com/dalmia-bharat-ci/dalmia_bharat_ar/deliver-meaningful-value.html
• Wellkinetics, ESG Reporting in Malaysia: Regulatory Requirements, Reporting Standards & Frameworks — https://wellkinetics.com.my/esg-reporting-malaysia/

HSE training in Malaysia for workplace risk management centers on HIRARC — Hazard Identification, Risk Assessment, and Risk Control — the specific methodology set out in DOSH's 2008 guidelines that Malaysian employers are legally expected to apply to identify workplace hazards, score their risk, and implement appropriate controls. This is not a generic risk management concept borrowed loosely from international standards; it is a defined, four-step Malaysian methodology with specific scoring criteria, six mandatory hazard categories, and enforcement consequences that have grown considerably more serious since 2022. This article explains exactly what HIRARC requires, why so many Malaysian HIRARC documents fail to meet DOSH's actual expectations despite existing on paper, and how structured HSE training closes that gap.

What Is HIRARC, and Why Is It the Foundation of Workplace Risk Management Training in Malaysia?

HIRARC stands for Hazard Identification, Risk Assessment, and Risk Control, a four-step methodology set out in DOSH's 2008 guidelines that requires employers to classify work activities, identify the hazards within each activity, assess the level of risk each hazard presents, and decide on and implement appropriate control measures. This methodology functions as the backbone of virtually all workplace risk management training in Malaysia, since it is the specific, DOSH-endorsed approach organizations are expected to apply and document, rather than one option among several equally acceptable international frameworks (Systematic Approach for HIRARC, 2016).

The four steps follow a defined logical sequence: first, classify work activities in a way that is neither too broad (an entire manufacturing process) nor too narrow (a single nut being tightened), using categories such as geographical area, production stage, or defined task; second, identify every hazard within each activity; third, conduct risk assessment by estimating the likelihood and severity of each hazard; and fourth, determine whether the resulting risk is tolerable or whether additional control measures are required (HIRARC Guidelines 2008, n.d.). HSE training built around this framework needs to walk participants through all four steps in sequence, since skipping or rushing any one step tends to produce a document that looks complete but does not actually reflect a genuine risk analysis.

Is HIRARC Unique to Malaysia, or Is It Based on an International Standard?

HIRARC as documented in DOSH's specific guidelines is a distinctly Malaysian methodology, though its underlying logic — hazard identification, risk scoring, and hierarchy-of-controls application — parallels similar frameworks used internationally, including OHSAS 18001's HIRADC (Hazard Identification, Risk Assessment and Determining Controls) approach. What distinguishes Malaysian HIRARC is DOSH's specific 5×5 risk matrix, specific hazard category requirements, and the direct legal and enforcement consequences tied to producing an adequate HIRARC document under Malaysian OSH legislation specifically.

How Does DOSH's Risk Scoring Methodology Actually Work?

DOSH's risk scoring methodology uses a semi-quantitative approach: assessors rate each hazard's likelihood of occurrence on a five-point scale and its severity of potential harm on a separate five-point scale, then multiply the two figures together to produce a risk score ranging from 1 to 25 (Get Foundation, 2026a). This resulting score is then plotted against a 5×5 risk matrix, which categorizes each hazard into low, medium, or high risk, using color coding to visually communicate risk distribution across a workplace or specific area (HIRARC Table Dosh Office, n.d.).

Both the likelihood and severity scales require defined, specific criteria at each point on the scale, precisely so that different assessors evaluating the same hazard arrive at reasonably consistent scores rather than producing wildly different ratings based on subjective judgment alone (Get Foundation, 2026b). This consistency requirement is one of the more technically demanding aspects of genuine HIRARC competence, and it is precisely the kind of skill that requires structured HSE training rather than intuitive guesswork — an untrained assessor is considerably more likely to under- or over-rate a given hazard, undermining the reliability of the resulting risk matrix.

What Happens After a Hazard Receives Its Risk Score?

After a hazard receives its risk score, the assessor determines whether the resulting risk level is tolerable as-is or whether additional control measures are required, applying an internationally recognized hierarchy of controls that prioritizes elimination and substitution of the hazard first, followed by engineering controls, administrative controls, and personal protective equipment as a final, least-preferred layer of protection (Get Foundation, 2026a). HSE training that teaches risk scoring without also teaching this control hierarchy produces assessors who can identify and rate risk accurately but may default to the weakest control option — PPE — rather than pursuing more effective elimination or engineering solutions higher in the hierarchy.

What Are the Six Hazard Categories DOSH's HIRARC Guidelines Require Organizations to Assess?

DOSH's HIRARC framework requires organizations to assess hazards across multiple defined categories, commonly summarized as accident, chemical, physical, ergonomic, biological, and psychological or psychosocial hazards, with employers expected to consider all of these categories rather than focusing narrowly on the most visually obvious physical dangers (Malaysia OSHA Understanding, 2024). In practice, most Malaysian organizations perform reasonably well identifying physical and chemical hazards — unguarded machinery, hazardous substances — but routinely underperform on the less visually obvious categories, particularly ergonomic and psychosocial hazards, which DOSH inspectors are specifically aware tend to be overlooked (Get Foundation, 2026b).

Psychosocial hazards specifically represent one of the largest gaps in current Malaysian HIRARC practice, with many HIRARC documents containing effectively zero entries in this category despite DOSH's increasing regulatory attention to it, particularly for operations running extended 12-hour shifts or heavy overtime schedules where psychosocial risk factors are demonstrably elevated (Get Foundation, 2026b). HSE training that fails to address this specific gap — training participants only on the more intuitive physical and chemical hazard categories — leaves organizations exposed to exactly the kind of incomplete HIRARC documentation DOSH inspectors are now actively looking for.

Why Are Psychosocial Hazards So Commonly Overlooked in Malaysian HIRARC Documentation?

Psychosocial hazards are commonly overlooked in Malaysian HIRARC documentation because they are considerably less visually obvious than physical or chemical hazards, requiring assessors to think beyond immediate, tangible workplace dangers toward less concrete risk factors such as excessive workload, shift patterns, workplace stress, or interpersonal conflict — categories that traditional, physically-oriented safety training historically did not emphasize. HSE training programs that explicitly walk participants through worked examples of psychosocial hazard identification, rather than assuming this category will be intuitively obvious, produce measurably more complete HIRARC documentation than training that focuses primarily on physical safety.

How Have Malaysia's Enforcement Expectations Around HIRARC Changed Since 2022?

Malaysia's enforcement expectations around HIRARC have tightened considerably since the OSHA Amendment Act 2022, with the penalty for related non-compliance rising from RM 50,000 to RM 500,000, and DOSH's enforcement approach shifting from largely advisory workplace visits toward prosecution-ready audits where inadequate HIRARC documentation is now one of the most commonly cited findings (Get Foundation, 2026b). A HIRARC document that would previously have drawn only an advisory comment during a DOSH visit can now expose an organization to a materially larger financial penalty, making the quality and genuine completeness of an organization's risk assessment documentation a considerably higher-stakes matter than it was before the amendment took effect.

A particularly common enforcement gap involves HIRARC documents that have simply been copied from a template used by another company, left undated or outdated for several years, and listing personal protective equipment as the sole control measure for virtually every identified hazard — a pattern DOSH inspectors now specifically look for as a sign the document does not reflect a genuine, organization-specific risk analysis (Get Foundation, 2026b). HSE training that teaches participants to conduct HIRARC as a template-filling exercise, rather than a genuine site-specific analytical process, produces exactly this kind of vulnerable documentation.

Does This Mean Every Business Needs to Redo Its Existing HIRARC Documentation Immediately?

Not necessarily immediately, but every business should treat a review of its existing HIRARC documentation as a genuine priority given the substantially increased penalty exposure, particularly checking whether documents are dated within a reasonable recency window, whether all six hazard categories are genuinely addressed rather than left blank, and whether control measures actually follow the hierarchy of controls rather than defaulting uniformly to PPE. Businesses that have not reviewed their HIRARC documentation since before the 2022 amendments took effect are at meaningfully elevated risk under the current, more assertive enforcement environment.

What Methods Does HSE Training Teach for Identifying Hazards in the First Place?

HSE training teaches that DOSH does not prescribe a single method for identifying hazards, instead listing several complementary approaches — direct workplace observation, review of past accident and incident records, employee and employer consultation and complaints, and analysis of specific work activities and processes — with the expectation that effective HIRARC uses a combination of these methods rather than relying on just one (Get Foundation, 2026b). Relying on a single identification method, such as observation alone, tends to miss entire categories of risk that would only surface through, for instance, a review of historical incident data or direct worker consultation.

This multi-method approach is particularly important for identifying hazards that are not immediately visible during a walkthrough, such as ergonomic strain patterns that only become apparent through worker feedback, or psychosocial stress that surfaces through incident records showing elevated turnover or absenteeism in a specific department rather than through direct physical observation. HSE training that teaches only observational hazard-spotting, without incorporating these complementary methods, produces a systematically incomplete hazard inventory.

How Often Should Work Activities Be Reassessed Using HIRARC?

HIRARC should be treated as an ongoing process rather than a one-time exercise, with reassessment triggered whenever work activities, equipment, materials, or processes change meaningfully, and reviewed periodically even without an obvious trigger to catch gradual drift between what was originally documented and what is currently happening on the ground. A HIRARC document assessed once at initial implementation and never revisited, even as an organization's operations evolve, becomes progressively less reliable as an accurate reflection of actual current risk — precisely the kind of outdated documentation DOSH's tightened enforcement approach is now specifically targeting.

What Are the Common Criticisms of How HIRARC Is Currently Applied in Malaysian Workplaces?

The most common criticism of how HIRARC is currently applied in Malaysian workplaces is that many organizations treat it as a documentation exercise to satisfy an audit requirement rather than a genuine analytical process, producing risk assessments that are technically present but substantively hollow — copied templates, uniform PPE-only controls, and entire hazard categories left unaddressed. Critics of the semi-quantitative 5×5 matrix approach specifically also note that without well-defined, consistently applied scoring criteria, different assessors can produce meaningfully different risk scores for the same hazard, undermining the matrix's core purpose of enabling reliable, comparable risk prioritization across an organization.

Defenders of the HIRARC framework argue that these are implementation failures rather than flaws in the underlying methodology itself, and that DOSH's own tightened enforcement posture since 2022 — treating inadequate documentation as a prosecutable finding rather than simply an advisory note — is specifically designed to push organizations away from superficial compliance and toward genuine analytical rigor. The more balanced view is that HIRARC, properly applied with well-trained assessors following defined scoring criteria and addressing all six hazard categories, is a genuinely effective risk management tool, but its value depends entirely on the quality of the HSE training behind the people conducting the assessment, not on the methodology's formal structure alone.

How Should Malaysian Businesses Structure HSE Training Around Genuine HIRARC Competence?

Malaysian businesses should structure HSE training around HIRARC by ensuring participants practice the full four-step process using real, organization-specific work activities rather than generic textbook examples, explicitly covering all six hazard categories with particular attention to the commonly under-addressed ergonomic and psychosocial categories, and training on the complete hierarchy of controls rather than defaulting to PPE as the default answer for every identified hazard. Training that culminates in participants producing a genuine, organization-specific HIRARC document — reviewed and corrected by an experienced trainer — builds considerably more durable competence than training that only covers the methodology conceptually without hands-on application.

Given the substantially increased penalty exposure since 2022, businesses should also build periodic HIRARC review and refresher training into their ongoing HSE program, specifically checking existing documentation against the patterns DOSH inspectors are now known to flag — outdated dates, copied templates, and PPE-only control measures — rather than assuming a HIRARC document produced years ago at initial implementation remains adequate under current enforcement expectations.

Conclusion

Workplace risk management in Malaysia centers on a specific, well-defined methodology — HIRARC — that demands considerably more analytical rigor than many existing Malaysian workplace documents currently reflect, and the gap between adequate and inadequate HIRARC documentation has become a far higher-stakes distinction since the 2022 amendments raised related penalties tenfold. HSE training, such as that provided by Wellkinetics, that builds genuine competence in all four HIRARC steps, addresses all six hazard categories including the commonly neglected ergonomic and psychosocial risks, and teaches the full hierarchy of controls rather than defaulting to PPE, is what actually protects Malaysian businesses — both from the workplace harm HIRARC is designed to prevent, and from the substantially increased enforcement consequences of documentation that fails to meet DOSH's current expectations.

References

• Get Foundation. (2026a). HIRARC Malaysia: The complete guide to DOSH compliance (2026). https://www.getfoundation.com.my/blog/hirarc-malaysia

• Get Foundation. (2026b). HIRARC guideline DOSH: Step-by-step implementation 2026. https://www.getfoundation.com.my/blog/hirarc-guideline-comprehensive-workplace-safety-malaysia-2026

• HIRARC Guidelines 2008: Risk management. (n.d.). https://www.scribd.com/doc/51594647/HIRARC-GuideLine-From-DOSH

• HIRARC Table Dosh Office. (n.d.). https://www.scribd.com/document/680471448/HIRARC-Table-Dosh-Office

• Malaysia OSHA understanding (HIRARC). (2024, August 26). [Presentation]. https://www.slideshare.net/slideshow/malaysia-osha-understanding-hirarc-pptx/271315659

• Systematic approach for hazard identification, risk assessment and risk control (HIRARC) in workplace according to DOSH guidelines. (2016, August 1). ResearchGate. https://www.researchgate.net/publication/344135062_SYSTEMATIC_APPROACH_FOR_HAZARD_IDENTIFICATION_RISK_ASSESSMENT_AND_RISK_CONTROL_HIRARC_IN_WORKPLACE_ACCORDING_TO_DOSH_GUIDELINES