A Permissioned Blockchain-Based Secure Audit Framework for Malaysia’s E-Procurement System: Integrating Artificial Intelligence and Sustainability Perspectives

Abstract

Malaysia’s e-Perolehan system functions as the primary digital platform for managing public procurement activities across federal government agencies. The system supports several procurement processes, including supplier registration, procurement planning, supplier selection, contract management, and fulfilment. Although the adoption of e-Perolehan has improved procurement efficiency, documentation management, and accessibility for suppliers, concerns regarding governance integrity, auditability, and transparency continue to persist within several operational stages of the system. Among these stages, the submission-to-opening phase within the Supplier Selection module represents one of the most sensitive and high-risk areas because supplier bids must remain confidential and protected until the official opening process. Weaknesses during this stage may expose procurement activities to risks such as premature access to confidential bid information, unauthorized modification of submitted documents, incomplete audit logging, and limited transparency for independent verification. These vulnerabilities can directly affect supplier trust, procurement fairness, and accountability within the Malaysian public procurement environment.

Current e-Perolehan operations rely largely on a centralized architecture in which control over submission data, audit logs, and access management remains concentrated within a single administrative environment. While centralized systems provide operational convenience and simplified system administration, they also create concerns regarding tamper resistance, independent verification, and transparency. Existing studies on public procurement consistently identify centralized control and insufficient auditability as major contributors to procurement integrity risks. Furthermore, international procurement integrity reports continue to recognize the submission-to-opening stage as one of the most corruption-prone phases within procurement systems because bid confidentiality and controlled access are difficult to independently verify. Although digital procurement systems improve operational efficiency, digitalization alone does not guarantee integrity if the underlying system architecture still permits limited transparency and centralized manipulation.

Emerging technologies such as blockchain and artificial intelligence (AI) have increasingly been explored as mechanisms for strengthening governance transparency, system security, and auditability in digital environments. Blockchain technology provides immutable record management, distributed validation, cryptographic verification, and tamper-evident audit trails that can strengthen procurement integrity and accountability. In procurement environments, blockchain can ensure that submitted bids remain protected from unauthorized modification while also enabling transparent verification of submission and opening activities. Permissioned blockchain platforms are particularly suitable for government environments because participation and access rights can be restricted to authorized agencies such as procurement authorities, auditors, and governance regulators. This enables stronger control over sensitive procurement information while maintaining distributed verification and accountability mechanisms.

At the same time, AI technologies offer additional monitoring and analytical capabilities that complement blockchain-based controls. AI-based anomaly detection mechanisms can continuously monitor procurement activities and identify suspicious behaviour patterns, such as repeated attempts to access bid data before the official opening time or irregular user activities that deviate from normal operational behaviour. By integrating AI-based monitoring with blockchain-based audit controls, procurement systems can move beyond passive record storage towards more proactive governance monitoring and risk detection. This integration enables both tamper-evident auditability and intelligent behavioural monitoring within a unified governance framework.

Despite growing interest in blockchain and AI applications for procurement systems, existing research remains limited in several important aspects. Most blockchain procurement studies focus broadly on entire procurement ecosystems rather than concentrating on specific high-risk operational stages where integrity vulnerabilities are most critical. Existing frameworks also tend to remain conceptual without sufficient empirical validation through prototype implementation, scenario-based testing, or stakeholder evaluation. In addition, most proposed procurement blockchain solutions are designed for generalized governance environments and are not specifically aligned with Malaysia’s procurement workflow, Ministry of Finance (MOF) operational procedures, or MAMPU ICT governance requirements. As a result, there remains a lack of Malaysia-specific blockchain audit frameworks that address the submission-to-opening stage while also providing validated evidence of technical and organizational feasibility.

To address these gaps, this study proposes a Malaysia-specific Permissioned Blockchain-Based Secure Audit Framework designed specifically for the submission-to-opening stage of the Supplier Selection module within e-Perolehan. The framework integrates permissioned blockchain technology, AI-based anomaly monitoring, encrypted bid handling, immutable audit logging, time-locked access control, and multi-agency verification mechanisms to strengthen procurement integrity and auditability. Unlike generalized procurement blockchain models, the proposed framework focuses specifically on securing bid submission confidentiality, preventing premature access, detecting document tampering, and ensuring complete traceability of procurement activities within the submission-to-opening process. The framework also introduces governance-aware validation mechanisms that align with Malaysia’s procurement administration structure and regulatory environment.

The study adopts a Design Science Research (DSR) methodology because the research aims to design, develop, and evaluate a technological artefact that addresses a practical governance problem. The research is conducted in three main phases consisting of problem identification, framework design, and prototype development with evaluation. During the first phase, document analysis, workflow mapping, and semi-structured interviews are conducted to identify weaknesses within the current submission-to-opening process. Participants involved in the exploratory stage include procurement officers, ICT governance specialists, and audit professionals. The findings from this phase reveal several key weaknesses, including insufficient tamper-evident logging mechanisms, centralized control over bid access, limited transparency for independent audit verification, and potential vulnerabilities related to unauthorized access during the bid holding period.

The second phase focuses on the design of the proposed framework. The framework architecture incorporates permissioned blockchain nodes involving relevant governance entities, encrypted bid submission mechanisms, immutable transaction logging, and smart contract-based enforcement of procurement rules. Smart contracts are designed to automate submission verification, enforce bid-locking periods, regulate opening permissions, and record all submission and opening activities within an immutable ledger. The framework also integrates AI-based monitoring components capable of analysing behavioural patterns and detecting suspicious activities during procurement operations. These AI components strengthen the overall framework by enabling early identification of abnormal access behaviour and potential integrity threats.

The third phase involves prototype implementation and evaluation within a permissioned blockchain test environment. The prototype simulates the submission-to-opening workflow under multiple operational scenarios, including normal bid submission processes, premature access attempts, bid modification attempts, and audit trail verification procedures. The technical evaluation results demonstrate that the framework successfully enforces time-locked access restrictions, preventing unauthorized bid access before the official opening time. The prototype also effectively detects document tampering attempts through hash mismatch verification and maintains complete immutable audit trails for all procurement activities. The integration of blockchain and AI further enables real-time monitoring of suspicious access patterns and abnormal system behaviour.

To complement the technical evaluation, expert validation is conducted involving procurement officers, ICT governance experts, and internal audit professionals. The evaluation assesses the framework’s feasibility, governance alignment, implementation suitability, and perceived effectiveness in improving procurement auditability and integrity. Feedback from participants indicates that the framework has strong potential to strengthen transparency, accountability, and trust within Malaysia’s public procurement environment. Experts also recognize the importance of immutable audit trails, distributed verification, and intelligent monitoring in supporting future procurement governance initiatives. However, participants also emphasize the need for organizational readiness, governance coordination, policy alignment, and system integration planning to support successful implementation within operational environments.

This study contributes to both theoretical and practical knowledge in several important ways. First, the study adopts a focused governance approach by targeting a specific high-risk stage within the procurement lifecycle rather than addressing procurement systems in a generalized manner. Second, the proposed framework is designed specifically for Malaysia’s procurement governance environment, increasing its practical relevance and implementation applicability. Third, the study integrates blockchain and AI technologies in a complementary manner that combines immutable auditability with intelligent anomaly monitoring. Fourth, the study contributes empirical evidence through prototype-based validation and expert evaluation, addressing limitations found in many existing conceptual blockchain procurement studies.

In conclusion, this study demonstrates that strengthening procurement integrity requires more than conventional digitalization approaches. Effective governance requires system architectures that embed trust, accountability, transparency, and verifiable auditability directly into operational processes. The integration of permissioned blockchain technology and AI-based monitoring provides a promising approach for achieving these objectives within public procurement systems. The validated framework proposed in this study demonstrates the ability to strengthen submission confidentiality, prevent unauthorized access, detect tampering attempts, and provide complete audit traceability within the submission-to-opening stage of e-Perolehan. Beyond Malaysia’s procurement environment, the framework also provides broader insights into how emerging technologies can support secure, transparent, and trustworthy governance systems in other public-sector digital transformation initiatives.