Safina DT Sacco: Board Independence, Related-Party Leases and a Whistleblower

1. Chair as bank signatory. Combines oversight and execution. The person who authorises payments is also the person who should be challenging them. Risk: override of the payment controls with no independent check; fraud is both possible and undetectable.

2. Board dominated by one family (chair plus three siblings = 4 of 9). Not a majority, but combined with the chair's influence it makes independent challenge unlikely. Risk: decisions reflect family interest; minority members' funds are exposed; the regulator may treat the board as not fit and proper.

3. Audit committee chaired by a former finance manager, eight months after leaving. Independence is compromised - the individual previously prepared the figures now being audited, and social and reporting ties persist. Risk: committee becomes a rubber stamp; prior-period errors are not pursued.

4. Internal audit reports to the CEO. The auditor's subject is the auditor's boss. Risk: scope is restricted, findings are suppressed, and the audit plan avoids the CEO's areas. This is a direct breach of the principle that internal audit must be functionally independent and have unrestricted access.

5. Related-party lease at double market rent (KES 4.2m vs 2.1m). Excess of KES 2.1m a year is an extraction of member funds. Risk: breach of fiduciary duty, undisclosed conflict of interest, and a benefit that must be recovered or ratified by an independent process.

6. Loan of KES 25m to a director's company, approved by a committee the director sat on. Two failures: the director voted on a matter in which he is interested, and the exposure is 25/150 = 16.7% of capital, above the 10% single-borrower limit of KES 15 million. Risk: regulatory sanction, unenforceable or impaired exposure, and a loss borne by depositors.

7. Whistleblower allegations with no channel. Signing without a board paper and loan files held at branch indicate weak documentation and concealment risk. The absence of a protected reporting route is itself a control failure.

Immediate (within 30 days).

1. Remove the chair as bank signatory; re-allocate signing authority to the CEO and finance manager with dual sign-off and board-approved limits.
2. Convene a board meeting without the interested parties present to consider the lease and the KES 25 million loan. Record the conflict in the minutes.
3. Refer the related-party lease to an independent valuation; suspend further payments above market rent pending the outcome and seek recovery of overpayments already made (approximately KES 2.1m per annum).
4. Require immediate regularisation of the KES 25m exposure - reduction to within the KES 15m limit within 90 days, or full recall - and report the breach to the regulator without delay; self-reporting is materially better than being discovered.
5. Instruct external counsel to investigate the whistleblower allegations, with a documented scope, preservation of records, and a report to the audit committee.
6. Freeze removal or alteration of loan files; require all files to be returned to head office and reconciled against the loan register within 14 days.

Within 90 days. 7. Reconstitute the audit committee under an independent chair with financial expertise; the former finance manager steps down from the committee entirely and observes a 12-month cooling-off period. 8. Re-draw internal audit's reporting line: functionally to the audit committee (charter, plan, budget, appointment and appraisal of the head of audit), administratively to the CEO only for day-to-day logistics. 9. Adopt a written related-party policy: register of interests, annual declarations, mandatory recusal with the interested party absent from the room, independent valuation for any transaction above a threshold, and board approval of all related-party dealings. 10. Adopt a whistleblowing policy with an independent reporting channel, confidentiality, and explicit anti-retaliation protection; brief all staff.

Within 12 months. 11. Board renewal: stagger terms, cap family representation, bring in at least two independent directors, and run a skills matrix against the strategy. 12. Delegate the single-borrower and connected-lending limits to a credit committee with a terms of reference that requires recusal and minuted dissent; install system controls that block approvals that breach limits. 13. Commission an independent governance review and table it at the annual general meeting.

What must be done.

1. Acknowledge and protect. Log the disclosure, confirm confidentiality to the reporting person, and state in writing that no detriment will follow. Do not ask them to repeat the disclosure to the person accused.
2. Route it away from the subject. Because the allegations concern the CEO, the matter cannot be handled by management. It goes to the audit committee, or to an independent director if the audit committee is conflicted - which here it partly is, given the chair's former role.
3. Appoint an independent investigator with a written scope covering: (a) authority for the lease and whether a board paper exists; (b) procurement and pricing of the lease; (c) location and completeness of loan files; (d) whether any files have been removed or altered.
4. Preserve evidence immediately: litigation hold on emails, the lease file, board papers, and the loan register; secure backup of the branch server.
5. Report to the board and the regulator as required, and record decisions in minutes.
6. Close the loop with the reporting person on the outcome at a general level, so the channel is seen to work.

What must not be done.

• Do not pass the letter to the CEO or the chair for 'comment' before investigation.
• Do not attempt to identify the author, or speculate about motive, in writing.
• Do not interview the accused before evidence is secured.
• Do not treat an anonymous letter as inherently unreliable: anonymity is often rational where no protected channel exists. Corroborate it against records - the lease file and the loan register are documentary and can be tested regardless of the source.
• Do not let the audit committee chair who previously worked under the CEO lead the investigation.

Judgement point. The strongest corroboration is documentary and independent of the whistleblower: the lease price against market, the absence or presence of a board paper, and the physical location of loan files. Start there. If those three tests corroborate the letter, the matter escalates immediately regardless of whether the author is ever identified.