The Director Who Wants It Verbal
A forensic firm is engaged by a tier-2 bank's General Counsel to investigate suspected procurement fraud. In week three the team finds that the CEO signed off a KES 46 million contract with a supplier whose sole director shares a surname, residential address and mobile number with the CEO's brother-in-law, and that the CEO chaired the tender committee that awarded it. The CEO, who sits on the board, asks the partner to 'give me a verbal briefing first, no paper, so we don't spook the regulator'. The General Counsel says the engagement is privileged, the CEO is her internal client, and the firm should cooperate. The firm is also one of three bidders for the bank's KES 120 million three-year internal audit outsourcing contract.
1. Analyse the conflicts of interest and state who the client is and to whom the report is owed.
Read the worked answer
Conflicts, in order of seriousness:
- The CEO is a subject, not a client. He signed the contract and chaired the tender committee. He is a witness at best and a suspect at worst. Treating him as an internal client of the investigation is a category error that would compromise the file.
- The firm has a live commercial interest in pleasing the CEO - the KES 120 million audit tender, on which the CEO will likely sit or influence. This is a self-interest threat of a magnitude that cannot be managed by disclosure alone. One of the two engagements must go. Recommend the firm withdraw from the tender (or, if the tender predates and is more valuable, decline/transfer the investigation) and record why.
- Reporting line ambiguity. An engagement letter naming the General Counsel alone is inadequate where the CEO is a subject and the GC reports to him. The reporting line must be the Board Audit Committee, with a copy to the full board.
Who is the client: the bank as a legal entity - not the CEO, and not the GC personally. Legal professional privilege over the investigation belongs to the entity and can be waived only by the entity's proper organ, not by a subject of the investigation. The GC's instruction to 'cooperate' with the CEO is not an instruction the firm can safely follow once the CEO is a subject.
2. Respond to the request for a verbal-only briefing.
Read the worked answer
Decline the form of the request, while not refusing to communicate. The distinction matters:
- A verbal-only briefing to a subject is not a briefing, it is a leak with no record. It creates an untraceable account of what was said, allows the CEO to test and shape the firm's findings before they are documented, and leaves the firm exposed if the CEO later claims he was told something different.
- It is also an evidential risk. The conversation will be reconstructed in any later disciplinary, regulatory or criminal process, and the firm will be the only party with an interest in the reconstruction.
What to offer instead:
- State in writing that no findings will be communicated verbally ahead of the written report.
- Accelerate the written report to the Audit Committee chair, with findings, evidence and recommendations.
- Offer a briefing after the report is issued, to the Audit Committee, minuted, with the GC present and the CEO recused from any discussion concerning himself.
- Notify the GC in writing that the CEO is a subject, that she has a personal conflict as his direct report, and that the matter is being escalated to the Audit Committee chair.
Tone: do not accuse. The reply is procedural - 'our methodology requires a written record before any briefing' - so that the firm is not later characterised as having made an allegation it could not substantiate.
3. The CEO is suspended. The board asks whether the firm can 'keep it in-house'. Advise on external reporting and on the firm's continuing role.
Read the worked answer
Distinguish three separate decisions, and advise on each.
1. Does the bank have to report externally? Possibly, and the board must decide on advice, not on the firm's say-so. Where the institution is regulated, suspected internal fraud involving the chief executive and a related-party contract will normally engage the prudential regulator's notification expectations, and may engage anti-money-laundering/related-party dealing rules. The firm should set out the triggers in writing and let the board and its counsel decide; 'keeping it in-house' is a decision that must be documented, with reasons, because it is the decision that will be scrutinised.
2. Can the firm stay? Yes, if the reporting line is fixed to the Audit Committee, the tender conflict is resolved, and the CEO has no role in the engagement or in reviewing the report. The firm should not accept any limitation on what it may report to the board. If the board attempts to restrict the scope or the recipients, that is a ground to consider withdrawal and, before withdrawal, to put the concerns to the Audit Committee chair in writing.
3. What should the report recommend? Recovery of the KES 46 million, a related-party register with mandatory annual declarations, tender committee composition rules excluding any member with a related-party connection, and a review of whether other contracts show the same director-address/phone signature. The firm should also state what it could not establish - for example whether the services were genuinely delivered - so that the report is not read as wider than the evidence.