A phased, MVP-first plan for a corporate volunteering system that gives your CSR team one place to run programmes, and your leadership team a clear, auditable record of impact — built with Malaysian data governance in mind from day one.
Today, employee volunteering across most Malaysian banks runs on spreadsheets, email threads, and department-level goodwill. It works, but it doesn't scale, and it leaves CSR teams unable to answer a simple question with confidence: how many hours did we actually contribute this year, and where?
We propose building a purpose-built Volunteer Management Platform for Public Bank — starting with a lean, fully-functional MVP that replaces manual tracking with a single system of record, and growing in later phases into a full engagement and ESG-reporting engine.
Every opportunity, sign-up, and logged hour lives in one auditable place — no more chasing spreadsheets across branches.
Exportable participation and impact data, structured to feed directly into your sustainability and ESG disclosures.
SSO, role-based access, and a data-handling approach aligned to PDPA 2010 and BNM's technology risk expectations.
Bursa Malaysia's enhanced sustainability reporting requirements and growing investor attention to ESG performance are pushing CSR and community-investment data out of spreadsheets and into board-level reporting. A platform that produces clean, structured volunteering data isn't a nice-to-have anymore — it's becoming part of how listed financial institutions demonstrate their social impact commitments.
Based on how volunteering programmes typically run inside large Malaysian corporates, we expect the current state looks something like this:
Manual consolidation across branches typically consumes days of CSR staff time per reporting cycle — time better spent designing programmes than chasing data.
Self-reported, unverified hours are hard to defend in an audit or sustainability assurance review — a growing concern as ESG disclosures face more scrutiny.
Without a central view, it's difficult to tell which branches or departments are disengaged, or which causes resonate most with staff.
Great volunteering moments go undocumented and unshared, weakening the internal case for continued CSR investment.
Sustainability reporting expectations under Bursa Malaysia's listing framework, growing regulatory attention to community and social impact from Bank Negara Malaysia, and rising employee expectations around purpose-driven work are converging. A structured platform turns volunteering from a goodwill initiative into a measurable, reportable business function.
A single web platform with three connected views — one for employees, one for CSR administrators, and one for leadership reporting — built around one straightforward loop.
CSR team creates a volunteering opportunity — cause, date, location, capacity, whether it's virtual or in-person.
Staff browse opportunities, RSVP in one click, and the event syncs to their Outlook or Google calendar automatically.
After the activity, hours are recorded — self-logged with lightweight proof, or confirmed by an event organiser.
Admins and leadership see consolidated participation data, exportable for internal reporting and sustainability disclosures.
We are deliberately not proposing a full enterprise CSR suite on day one. The goal of the MVP is to prove this loop works end to end, replaces your current manual process, and gives you real data — before we invest in the more advanced engagement and integration features described in the roadmap.
Everything below is what we propose building and delivering in the initial engagement. Nothing here depends on features from later phases.
| Feature | What it does |
|---|---|
| Opportunity browser | Search and filter volunteering opportunities by cause, date, location, and format (virtual or in-person). |
| One-click sign-up | RSVP to an opportunity directly from the listing, with automatic capacity tracking. |
| Personal dashboard | A staff member's own history — hours logged, opportunities joined, upcoming commitments. |
| Manual hour logging | Log hours after an activity with a simple proof attachment (photo or organiser confirmation). |
| Notifications | Email and in-app reminders ahead of upcoming sign-ups and deadlines. |
| Feature | What it does |
|---|---|
| Opportunity management | Create, edit, publish, and close volunteering opportunities. |
| Sign-up & hours approval | Review and approve sign-ups and submitted hour logs. |
| Admin dashboard | Live view of total hours, active participants, and opportunities currently open. |
| Reporting export | CSV/Excel export of participation and hours data for internal and CSR reporting. |
| Feature | What it does |
|---|---|
| Single sign-on | Login via your corporate identity provider (Azure AD / Okta), no separate credentials. |
| Role-based access | Two roles at MVP stage — Employee and Administrator — each seeing only what they need. |
| Data protection baseline | Encryption at rest and in transit, access logging, aligned to PDPA 2010 handling principles. |
| Web platform | Fully responsive web application — works on desktop and mobile browsers; no native app at this stage. |
| Calendar sync | Add-to-calendar on RSVP, compatible with Outlook and Google Calendar. |
Gamification and leaderboards, the NGO/partner self-service portal, native mobile apps, HRIS/payroll integration, and ESG-framework-aligned report generation are all real, valuable features — and they're exactly what Phase 2 and Phase 3 are for. We've kept them out of the MVP so the first release stays fast to build, easy to test, and low-risk to approve.
The MVP is designed to be extended, not replaced. Phase 2 and Phase 3 are presented here to show the full trajectory of the platform, and to inform architecture decisions we make now.
Cloud-hosted (AWS or Azure), with data residency configured to your requirements. We will confirm whether in-country hosting in Malaysia is required before finalising this, given BNM's expectations for regulated financial institutions.
A standard, well-supported web stack — a modern JavaScript frontend, a REST API backend, and a managed relational database. Nothing exotic; chosen for long-term maintainability, not novelty.
SSO via SAML/OAuth 2.0 against your corporate identity provider. No parallel password system for your staff to manage.
Calendar sync via standard Outlook/Google APIs at MVP; HRIS and Teams integrations scoped for Phase 2/3 via documented REST APIs.
The MVP is architected to comfortably support your full employee base from day one, with headroom for concurrent usage spikes around large seasonal campaigns (e.g. flood relief drives, Financial Literacy Month). We size infrastructure for your actual headcount once confirmed during discovery.
This platform will hold employee personal data. We treat that with the same seriousness your organisation applies to any system touching staff records — not with the lighter posture sometimes given to "CSR tools."
| Area | Our approach |
|---|---|
| Encryption | TLS 1.2+ in transit; AES-256 at rest for all stored personal data. |
| Authentication | SSO via your identity provider; MFA enforced at the IdP level, not bypassed by the platform. |
| Access control | Role-based access control (RBAC), least-privilege by default, full access logging. |
| Data residency | Configurable hosting region; in-country Malaysian hosting available if required by your vendor risk policy. |
| PDPA alignment | Data collection, consent language, and retention practices aligned to the Personal Data Protection Act 2010. |
| Retention & deletion | Defined retention schedule with documented deletion process for departed employees, on request. |
| Testing | Independent penetration testing prior to go-live, with findings shared and remediated before launch. |
We want to be direct: as this is a newly-scoped software engagement, formal certifications such as ISO 27001 or SOC 2 for this specific platform will be pursued as part of the engagement roadmap rather than already in place. We are fully prepared to complete your vendor security questionnaire and welcome an early security review with your IT/InfoSec team — we'd rather surface any gaps during discovery than at go-live.
Requirements workshops with your CSR and IT teams, confirmation of SSO provider, hosting/data residency requirements, and existing branch/department structure.
UX flows and visual design for all three views (employee, admin, reporting), reviewed and signed off with you before development begins.
Build in two-week sprints, with a working demo shared at the end of each sprint.
Structured user acceptance testing with a nominated group from your CSR team, tracked against a formal sign-off checklist.
Go-live, staff communications support, and two weeks of hypercare with priority response to any issues.
Total indicative timeline: ~14 weeks from discovery kickoff to go-live, subject to confirmation during Phase A and your vendor risk review process.
Green Growth Asia Foundation is a not-for-profit organisation incorporated in Malaysia, dedicated to supporting strong, inclusive, and sustainable economic growth across emerging economies in Asia — with a long-standing focus on climate action, ESG practice, and community empowerment.
Our work has centred on programme design and delivery rather than commercial software development — but running large-scale community and sustainability programmes across the region for many years has required exactly the kind of operational infrastructure this proposal describes. Over that time, we've built an internal technical team capable of specifying, managing, and delivering software projects of this scale, and this platform reflects how we believe a corporate volunteering system should actually work in practice, having run programmes like it ourselves.
We're keeping formal staff bios, past client references, and detailed team CVs out of this initial proposal. A fuller team and credentials profile — including our technical delivery lead, project management approach, and relevant programme case studies — will follow once there's mutual interest in proceeding to a detailed scoping conversation.
| Item | Basis | Indicative |
|---|---|---|
| MVP build | Fixed-price, scoped against Section 4 | 45K to 50K |
| Hosting & infrastructure | Monthly, cloud usage-based | as per the prefered deployment platform |
| Support & maintenance | Monthly retainer, post-warranty | included for first 3 months |
| Phase 2 (indicative) | Scoped separately post-MVP | To be scoped |
| Phase 3 (indicative) | Scoped separately post-MVP | To be scoped |
Figures above are placeholders pending a detailed scoping conversation on headcount, branch count, and integration requirements — we'd rather price this precisely against confirmed requirements than offer a number that shifts later.
30 days post-launch, all defects fixed at no additional cost.
Monthly retainer covering maintenance, minor enhancements, and platform monitoring.
Critical issues: same business day. Standard issues: within 3 business days.
A full SLA document — including uptime commitment, escalation matrix, and named support contacts — will be issued alongside the final contract.
| Risk | Severity | Mitigation |
|---|---|---|
| Vendor security review extends timeline | High | We build the review into Phase A rather than treating it as a gate at the end; early InfoSec involvement. |
| Low initial staff adoption | Medium | Launch communications plan, pilot with 1–2 branches before org-wide rollout. |
| SSO/IdP integration delays | Medium | Confirm IdP details and test access in Week 1 of discovery, not at development handoff. |
| Scope creep into Phase 2 features | Low | MVP scope is fixed at contract signing; new requests are logged for Phase 2, not folded in mid-build. |
| Data residency requirement identified late | Medium | Confirmed explicitly during Phase A before infrastructure is provisioned. |
We'd suggest a 60–90 minute session with your CSR and IT/InfoSec stakeholders to walk through this proposal, confirm the MVP feature list against your actual needs, and align on your vendor risk process upfront — before any commercial terms are finalised.