OSH Compliance in IPO Due Diligence: Why It's a Critical Requirement for Companies Going Public

Good occupational safety and health (OSH) compliance is good for business — and never more visibly so than when a company goes through an IPO. It protects the people the business depends on, it’s part of what gives the board and shareholders confidence in management, and it’s part of the reputation a company carries into public life. Legal due diligence for an IPO treats OSH as a critical item for exactly these reasons — not because it’s named as a Bursa Malaysia listing criterion (it isn’t). Directors carry personal exposure too: Section 52 of the Occupational Safety and Health Act 1994 (Act 514) makes them personally liable for the company’s OSH offences unless they can prove they exercised due diligence. For a company preparing for an IPO, OSH compliance is worth getting right well before the due diligence team asks the first question — not as a box to tick, but as part of the case for why the company deserves the market’s confidence.

Why OSH Compliance Matters for a Company Going Through an IPO

An IPO is the moment a company asks the public, institutional investors, and its own future shareholders to trust its management. A demonstrable, well-run OSH programme is part of how that trust is earned — it signals that the board and management team run a disciplined, well-governed operation, not just that the company has avoided trouble so far. Poor OSH compliance signals the opposite: gaps in oversight, weak internal controls, and an operation that hasn’t been tested against its own risks.

This is also where legal due diligence comes in. The Securities Commission’s Guidelines on Due Diligence Conduct for Corporate Proposals require the due diligence working group — sponsor, reporting accountants, solicitors — to review the issuer’s material contracts, contingent liabilities, ongoing material litigation, and material legal and business risks. A significant DOSH enforcement action, a fatality-related prosecution, or an unresolved improvement/prohibition notice under Act 514 sits squarely inside that review, the same way any other material regulatory exposure would.

In MESH’s experience advising clients preparing for an IPO, this question is usually raised early and bluntly — by the investment bank or corporate/listing adviser running the deal, or by the external legal team conducting due diligence. It’s treated as core regulatory due diligence and a genuine governance signal, not an ESG afterthought.

The Real Stakes: People, Reputation, and Investor Confidence

It’s worth being direct about why this matters, beyond satisfying a due diligence checklist:

• An unresolved OSH gap is a live risk to real employees — the people working on the factory floor, the construction site, or the plant, not an abstract line item. Fixing it protects them, whether or not an IPO is on the horizon.
• A strong, well-documented OSH record is evidence of good governance — exactly the kind of management discipline that boards, institutional investors, and analysts look for when they assess a company preparing for an IPO.
• A safety failure that surfaces during, or shortly after, an IPO does disproportionate reputational damage — precisely because the company has never had more public visibility, more media attention, or more scrutiny from new shareholders than at the point of listing.
• That reputational exposure has financial consequences: it can affect investor appetite and pricing during the offering, and after listing, a serious incident can move the share price, invite shareholder scrutiny, and raise hard questions about board oversight.
• Fixing an OSH gap discovered late — under the time pressure of an active due diligence exercise — is far more disruptive and costly than addressing it as ordinary good practice, years ahead of any IPO decision.

This is the reasoning MESH uses with clients preparing for an IPO: OSH compliance isn’t something to tidy up because a regulator eventually requires disclosure — it’s good business, because it protects people first, and builds the board, shareholder, and public confidence a newly listed company needs second.

What Legal Due Diligence Actually Looks At

In practice, a due diligence exercise on OSH compliance typically covers:

• DOSH correspondence, inspection reports, and enforcement notices — improvement notices and prohibition notices in particular.
• Any history of prosecutions, convictions, or penalties under Act 514.
• A record of work-related fatalities or serious injuries, and how each was investigated and remediated.
• Documented OSH policies, risk assessments, and safety and health committee records.
• Whether a proper OSH management system exists at all, and how mature it is — informal practice versus a certified system (e.g. ISO 45001).

A disclosed, well-managed issue reads very differently to a due diligence team than an undisclosed one found later. Companies with a documented history of addressing incidents properly are in a materially stronger position than ones that have simply avoided major enforcement so far.

The Governance Angle: Personal Liability Under Section 52

Act 514 adds a sharper edge to all of this. Section 52 (“Liability of director, etc., of company, etc.”) provides that where a company, LLP, firm, society or other body of persons commits an offence under the Act, any person who at the time was a director, compliance officer, partner, manager, secretary, or other officer responsible for or assisting in the company’s management is deemed guilty of the same offence and liable to the same punishment — unless that person proves the offence was committed without their knowledge or consent, and that they had taken all reasonable precautions and exercised due diligence to prevent it.

For a company preparing for an IPO, this turns OSH compliance into a governance question the board has to be able to answer directly, not delegate away. Due diligence teams — and the board itself — will want to know whether directors could actually make out that due-diligence defence if an incident happened: whether there’s real OSH oversight at board level, clear reporting lines, and documented management involvement, rather than a policy sitting unread in a drawer. Being able to answer that confidently is itself a mark of good governance — the kind that gives a board, and its future shareholders, genuine confidence in management.

OSH Compliance Doesn’t End at the IPO

A company’s OSH record keeps mattering as a matter of good governance and public reputation well after the IPO itself — Bursa Malaysia’s admission criteria (profit or market-capitalisation thresholds, public shareholding spread, management continuity) don’t name OSH specifically, but every Main Market and ACE Market listed issuer must publish an annual Sustainability Statement, and Bursa is in the middle of moving that disclosure from a fixed “Health and Safety” indicator set (number of work-related fatalities, lost time incident rate, employees trained) towards a materiality-based approach aligned with Malaysia’s National Sustainability Reporting Framework (NSRF) and IFRS S1/S2, phased in from financial years ending 31 December 2025 (larger Main Market issuers) through 2027 (ACE Market). The mechanics matter less than the underlying point: once public, a company’s safety record becomes something shareholders, analysts, and the public can see and judge on an ongoing basis — one more reason it pays to have the substance in place well before the IPO, not just the disclosure.

Preparing for Your IPO: A Practical Checklist

The point of getting ahead of this is building genuine board and shareholder confidence on your own timeline, rather than scrambling to fix gaps once an IPO due diligence exercise is already underway. Before your IPO:

• Have a documented OSH management system in place, not just informal practice. In practice, that means having each of the following properly documented, current, and actually followed on the ground — not sitting unused in a folder:
  • A written Occupational Safety and Health Policy, signed off by top management and communicated to the workforce, as expected under Section 16 of Act 514.
  • Hazard Identification, Risk Assessment and Risk Control (HIRARC) covering all work activities and processes, kept current and reviewed whenever a process, equipment, or work method changes.
  • Safe Work Procedures (SWPs) for higher-risk tasks, derived from the HIRARC findings rather than generic templates.
  • An Emergency Response Plan (ERP) — covering fire, chemical spills, and other foreseeable emergencies — with evidence of regular drills, not just a document.
  • Chemical management: a Chemical Health Risk Assessment (CHRA) and proper classification, labelling and safety data sheets for scheduled/hazardous chemicals used on site, in line with the USECHH Regulations.
  • Noise management: noise risk assessments and, where exposure limits are exceeded, a hearing conservation programme with audiometric testing, in line with the OSH (Noise Exposure) Regulations.
  • Ergonomics management: ergonomics risk assessments for manual handling, repetitive tasks, and workstation design, with corrective action tracked through to completion.
• Incident reporting and investigation procedures, with a clear record of past incidents and how each was closed out.
• Resolve or clearly document any outstanding DOSH notices, prosecutions, or compliance gaps before due diligence begins — these get surfaced either way, and a disclosed, managed issue reads very differently to a working group than an undisclosed one found later.
• Be ready to answer, and evidence, the Section 52 due-diligence defence for directors and compliance officers before the legal team or listing adviser asks — this is usually one of the first OSH-related questions raised.
• Track the metrics you’ll need for both IPO due diligence and, later, sustainability reporting: work-related fatalities, lost time incident rate, and safety training coverage, ideally with at least 3 years of clean historical data.
• Decide who at board or senior management level owns OSH oversight — a named, credible governance structure is itself part of what gives a board and its future shareholders confidence in management.

FAQ