Here’s a scene that plays out in Malaysian companies after a serious incident.
The director calls a meeting. HSE presents the investigation report. The corrective actions are reviewed. The director nods, signs off, and asks HSE to track closure.
Every single CAPA on that list is assigned to HSE.
But look at what actually failed. The SOP was four years out of date — that’s a document control failure that sits with the process owner, not HSE. The supervisor had been allowing shortcuts for months — that’s a supervision standards failure that sits with operations management. New workers were signed off by a buddy instead of a qualified assessor — that’s a competency assurance failure that sits with HR.
HSE didn’t own any of those systems. They can’t fix them either.
The CAPA Accountability Problem in Malaysia
This is one of the most common — and most damaging — patterns in Malaysian workplace safety management. Incident investigations identify systemic failures across operations, HR, and management. The corrective actions are then consolidated into a list and handed to HSE to implement and close.
The result: HSE issues memos, runs retraining sessions, updates documents, and marks CAPAs closed. Twelve months later, the same system failure produces the same type of incident. HSE issues another memo. Nothing changes because the people who own the systems that failed were never made accountable for fixing them.
What OSHA 2022 Actually Says
Under the OSH (Amendment) Act 2022, the duty to ensure a safe workplace sits with the employer — and specifically with the employer’s directors and senior managers. Section 17A of the Act provides for individual liability: a director or officer of a company who fails to take reasonable steps to ensure OSH compliance can be personally fined up to RM500,000 or imprisoned.
That’s the law. But in most organisations, the corrective action list still points to HSE — as if personal liability is a legal concept that stops at the company letterhead and doesn’t extend to the operations manager who was tolerating unsafe practices on his shopfloor.
The Correct CAPA Ownership Model
Corrective actions should be assigned to the person who owns and controls the system that failed. HSE’s role is to facilitate the investigation, verify the quality of proposed corrective actions, and monitor closure — not to implement fixes for every system in the organisation.
In practice:
- An SOP that was outdated → corrective action owner: the process owner (operations, engineering, or the relevant function)
- Inadequate supervisory oversight → corrective action owner: the operations manager responsible for that supervisory function
- Competency verification gap → corrective action owner: HR or the L&D function accountable for training standards
- Maintenance deferral that degraded a safety control → corrective action owner: the maintenance manager
HSE can and should track closure. But closure means the accountable owner has made a verified change to the system — not that HSE has sent a reminder email and recorded it as done.
Why This Pattern Persists
Most incident investigation approaches in Malaysia — whether DOSH-format reports or internal 5 Whys analyses — focus on what happened and what the immediate cause was. They rarely systematically identify which management systems were implicated and who is accountable for those systems. The investigation finds “inadequate supervision” and leaves it there. Without naming the specific supervision system that failed and identifying its owner, the corrective action has nowhere to go except HSE.
What Systemic Investigation Changes
Tripod Beta is an incident investigation methodology built around management system accountability. It uses 11 Basic Risk Factor (BRF) categories — including Supervision, Procedures, Training, Communication, and Organisation — to classify every management system failure that contributed to the incident.
When the investigation names the BRF, it names the system. When it names the system, it identifies the function accountable for that system. The corrective action then goes to the right person — the one with the authority to change it.
In the post-incident director’s meeting, the corrective action list looks different. The operations manager is assigned to revise the supervisory sign-off process for high-risk tasks. HR is assigned to close the competency verification gap. The process owner is assigned to review and update the procedure. HSE is assigned to verify that each change has been implemented and is holding. That’s CAPA accountability. That’s what OSHA 2022 is designed to enforce.
Build an Investigation System That Gets Accountability Right
Tripod Beta training in Malaysia is delivered by Asyraf Khalil — the only accredited Tripod Trainer (Energy Institute UK) offering this methodology commercially in the region. The programme is designed for HSE leads, operations managers, and investigation teams who want corrective actions that actually land with the right people and produce lasting change.
Learn more about Tripod Beta Incident Investigation Training →
Or contact us to discuss in-house delivery for your team.