Approval Workflow Automation: A Practical Guide for Malaysian Companies

A purchase requisition gets printed at the plant in Shah Alam. It sits in a tray for three days because the head of department is at the Penang site. Then it goes by internal mail to the GM in KL, who is on leave. By the time someone chases it on WhatsApp, the supplier’s quotation has expired and procurement has to start again.

If that sounds familiar, you are not alone. Most medium and large companies in Malaysia still run a surprising number of approvals on paper, email threads and Excel files passed around by hand. This guide covers what approval workflow automation is, which approvals to move first, what Malaysian law says about electronic approvals, and how to roll it out in a way your staff will actually use.

What is approval workflow automation?

Approval workflow automation means a request, such as a purchase, claim or leave application, is submitted through a digital form and then routed to the right approvers automatically, based on rules you set. Each approver gets notified, acts from a phone or laptop, and every decision is recorded with a name and a timestamp.

The rules are the important part. A good system does not just send the form to the same three people every time. It looks at the request and decides: this one is under RM5,000, so the head of department can approve it alone. That one is unbudgeted, so it also goes to finance.

Signs your approval process needs fixing

You probably don’t need a consultant to tell you. Look for these:

• Staff ask “where is my form?” more than once a week, and nobody can answer without walking around.
• Approvals stop when one person goes outstation or takes leave. The Hari Raya and Chinese New Year weeks are the worst.
• Forms come back because a field was missing, then go through the whole chain again.
• Approvals happen over WhatsApp (“ok boss approve”) and the paper gets signed later, if at all.
• Internal audit or your ISO auditor asks for proof of who approved something, and it takes days to find.
• Finance re-keys the same data from the form into the accounting system.

Two or three of these is normal. If you nodded at all six, the cost is already showing up in late payments, expired quotations and staff overtime.

Which approvals to automate first

Start with approvals that are frequent, follow clear rules and annoy a lot of people. Here is where most Malaysian companies begin:

Process	Usually owned by	Why it is a good first pick
Purchase requisition	Procurement	High volume, clear amount limits, delays cost money
Staff claims and outstation claims	Finance	Every employee touches it, so wins are visible
Leave application	HR	Simple flow, good for getting people used to the system
Recruitment requisition	HR	Needs several approvals and budget checks
Vendor registration	Procurement and Finance	Needs document checks and segregation of duties
IT access and hardware requests	IT	Lots of small requests that clog email
Engineering change request	Operations	Needs a clear history for quality audits

You don’t have to pick only one. Mamee-Double Decker moved twelve processes onto OSPROV across human capital, finance, operations and business technology, including recruitment requisition, vendor master creation, engineering change and hardware requests. But they all followed the same pattern: clear rules, many users, and a lot of chasing before.

A practical tip: avoid starting with your most political process. If the capex approval involves five directors who each like things done their way, leave it for round two, after the system has proven itself on something simpler.

Are electronic approvals legally valid in Malaysia?

For most internal approvals, yes. The Electronic Commerce Act 2006 says that where the law requires a signature, an electronic signature can satisfy it if it:

1. is attached to or logically linked to the electronic document,
2. identifies the person and shows they approved the information, and
3. is as reliable as is appropriate for the purpose.

A logged-in approver clicking “Approve” on a request in a system that records who, what and when generally fits this. Digital signatures backed by a licensed certification authority are covered separately under the Digital Signature Act 1997, and those carry stronger legal weight. You would normally only need them for external documents like contracts.

A few documents are excluded from the Act, such as wills and powers of attorney, and some documents still need stamping by LHDN. Internal purchase approvals, claims and leave forms are not in that category. If you are unsure about a specific document, ask your company secretary or legal adviser. This article is not legal advice. For a deeper read on e-signing, Low & Partners has a good summary.

Two other rules matter when you go digital:

• Keep records for seven years. Section 245 of the Companies Act 2016 requires companies to keep accounting and related records for seven years after the transaction is completed, and the Income Tax Act 1967 has a similar seven-year rule. Your approval history is part of that trail, so the system has to keep it and you have to be able to pull it out.
• Protect personal data. Forms like recruitment requisitions and medical claims carry personal data under the PDPA. The PDPA amendments that came into force in 2025 added duties such as appointing a Data Protection Officer and reporting data breaches. Make sure only the right roles can see these forms.

How to automate an approval workflow, step by step

1. Map the process as it really runs

Not as the SOP says it runs. Sit with the clerk who handles the forms and ask what actually happens. You will find steps nobody wrote down, like “if it’s IT equipment, we also send a copy to Encik Rahman”.

2. Write down the approval rules

Who approves what, up to how much, and under which conditions. Most companies already have this in a limits of authority document, an approval matrix, or someone’s head. If yours is out of date, fix it first. Our guide on how to build an approval matrix has a free Excel template you can start from.

3. Rebuild the form, but don’t redesign it yet

Use the PDF or Excel form your team already knows. People accept a new system faster when the form looks familiar. In OSPROV you can upload the existing PDF and add fillable fields, or keep a spreadsheet-style form with the same formulas. Remove fields nobody fills in, and add validation so incomplete forms can’t be submitted.

4. Build the route with conditions

Turn the rules from step 2 into the workflow. Amount above RM50,000? Add the CFO. Unbudgeted? Add finance. IT equipment? Notify IT. Assign approvals to roles like “Head of Department” rather than to named people, so the workflow doesn’t break when someone resigns.

5. Pilot with one department

Pick a department with a manager who wants this to work. Run it for two to four weeks, collect complaints, and fix them. Keep paper as a fallback only for the pilot period, then switch it off. If paper stays an option forever, people will keep using it.

6. Measure before and after

Write down the average time from submission to final approval before you start, even if it is a rough guess from the files. Compare after a month. Perodua used OSPROV to digitize skill assessments for its staff and saw a 60% increase in traceability of each assessment. Your number will be different, but you need one to show management.

What to look for in an approval workflow system

If you are a medium or large company, a basic form tool won’t be enough. Check for:

• Conditional routing. Routes that change based on amount, department, budget status or any field on the form.
• Role-based access. People see and approve only what their role allows.
• Full audit trail. Who approved, when, what changed and why, kept for years.
• Mobile approvals. Your managers approve from their phones between meetings, not when they get back to the office.
• Bulk approval. A GM with forty claims waiting should be able to clear them in one go.
• Single sign-on. Staff log in with the company account they already have.
• Reference and ISO control numbers. Every submission needs a running number, and if you are ISO 9001 certified, your forms need document control numbers.
• Integration. An API so approved data flows into your ERP or accounting system, whether that is SAP, Microsoft Dynamics or something local, instead of being typed in again.
• Reports. Dashboards showing where requests get stuck, so you can fix the slow steps.

OSPROV covers all of the above. You can see how it works or book a demo with our team.

Common mistakes to avoid

Digitizing a bad process. If a claim needs seven signatures on paper, automating it gives you a faster way to collect seven signatures. Ask whether each approver adds value before you build the route.

Naming people instead of roles. A workflow that sends everything to “Siti” breaks the day Siti moves to another department.

Ignoring leave and absence. Decide upfront what happens when an approver is away. Who acts on their behalf, and up to what limit? Write it into the process, not into a WhatsApp group.

Skipping training for approvers. Staff who submit forms usually learn fast. Senior approvers are often the ones who need a short walkthrough, and they are the ones who can stall the whole rollout.

Trying to do everything at once. Twelve processes is a great result, but it is not where you start. One or two processes done well will win over the rest of the company.

Frequently asked questions

How long does it take to automate an approval workflow?

A simple flow like leave application can often be built and tested in a few days. A purchase requisition with amount bands, budget checks and ERP integration takes longer, mostly because of the time needed to agree the rules. The software part is usually not the slow part.

Do we need our IT department to build it?

Not with a low-code platform. Process owners in HR, finance or procurement can build forms and routes themselves, with IT involved for single sign-on, security and integration with other systems.

Can we keep using our Excel forms?

Yes. Many teams start by importing their existing spreadsheet or PDF forms, then improve them once people are used to the system.

Is this the same as Microsoft Power Automate?

Power Automate is a general automation tool for connecting apps, and it can run approvals if you build the forms, routing and reporting around it. A dedicated approval workflow platform gives you the form builder, conditional routing, audit trail and reports in one place, which is usually easier for business teams to manage without a developer.

Is an approval in the system as valid as a wet signature?

For most internal approvals, the Electronic Commerce Act 2006 recognises electronic signatures that identify the approver and are reliable enough for the purpose. Some documents are excluded, so check with your legal adviser for anything unusual.

Approval workflow automation is not a big-bang IT project. Pick one process that everyone complains about, get the rules right, and let the results do the convincing. If you want to see how other Malaysian companies did it, read our customer stories.