Law, Ethics and Corporate Governance
One act, several legal consequences
Fraud is both a crime and a civil wrong. Criminal fraud requires proof beyond reasonable doubt of the elements in the applicable statute - for example the Penal Code, the Anti-Corruption and Economic Crimes Act, the Bribery Act, the Proceeds of Crime and Anti-Money Laundering Act, or the Computer Misuse and Cybercrimes Act. Civil fraud (deceit) requires a false representation, knowledge of its falsity or recklessness, intention that it be relied upon, actual reliance and loss, proved on the balance of probabilities. A single act can trigger prosecution, civil recovery, disciplinary referral and regulatory sanction at the same time.
Know the governance architecture: the board and its audit and risk committees, an internal audit function with unrestricted access that reports functionally to the audit committee, a whistleblowing policy with protected disclosure, conflict-of-interest registers, and an enforceable code of conduct. Know the Kenyan codes - Mwongozo for state corporations and the CMA Code for issuers - and the principle that governance is about behaviour, not paperwork.
Ethical framework: integrity, objectivity, professional competence and due care, confidentiality and professional behaviour. Identify threats (self-interest, self-review, advocacy, familiarity, intimidation) and the safeguards applied.
Traps: saying internal audit 'reports to management'; treating a written code as a sufficient control; confusing the two burdens of proof; assuming a criminal acquittal bars civil recovery.
Rule of thumb: criminal punishes, civil compensates, disciplinary protects the profession - same facts, three different tests.
Worked example: a finance manager diverts funds through a fictitious supplier. The employer may report to the police, sue for recovery, and refer the accountant to ICPAK, each on its own standard and timeline.