The Finance Manager Who Approved His Own Supplier
At Tumaini Water Services, a state-owned utility, the procurement officer resigned abruptly. The finance manager, Otieno, was asked to 'hold the fort' and was given temporary authority over procurement in addition to his finance duties. Within six weeks he had: (a) approved a KES 4,200,000 contract to a company whose sole director is his brother-in-law; (b) processed the payment himself; and (c) recorded the transaction as 'emergency repairs' without a competitive quotation. The internal auditor's sample of 20 payments found this one but noted that the supporting documents 'appeared complete'. The board audit committee meets in two weeks. The CEO wants the matter 'handled quietly' because the utility is negotiating a donor-funded expansion and adverse publicity could jeopardise it. Otieno has offered to repay KES 500,000 as a 'goodwill gesture'.
1. Identify the control failures and the governance principles breached, and explain why the CEO's preferred approach is unacceptable.
Read the worked answer
Control failures.
- Segregation of duties: Otieno combined requisition, approval and payment - the classic incompatible-duties conflict. Custody, authorisation and record-keeping were in one pair of hands.
- Conflict of interest: A related-party supplier was awarded a contract without declaration or recusal.
- Procurement bypass: A KES 4.2m contract was split off as an 'emergency' with no competitive quotation; emergency provisions should be narrowly defined and documented.
- Documentation: The auditor's note that documents 'appeared complete' shows the paper trail was manufactured - completeness of documents is not evidence of validity.
- Monitoring: No exception report flagged a first-time supplier receiving a large payment.
Governance principles breached.
- Integrity, objectivity and accountability of officers.
- Transparency in procurement.
- The board's oversight role; management cannot self-clear a fraud.
- Duty to protect public resources and donor funds.
Why 'quiet handling' is unacceptable.
- It suppresses information the audit committee and donors are entitled to.
- It substitutes a private repayment for the public-law duty to investigate and recover.
- It exposes the CEO and board to liability for concealment.
- A goodwill payment of KES 500,000 is far below the KES 4.2m at issue and implies the matter is a private debt, not a suspected fraud.
- Donor due-diligence will likely uncover it anyway; concealment magnifies reputational and funding risk.
2. Recommend the steps the audit committee should take, including treatment of the repayment offer and the related-party contract.
Read the worked answer
Immediate steps.
- Preserve evidence: secure the contract file, payment records, emails and system logs before anything is altered.
- Independent investigation: appoint an investigator reporting directly to the audit committee, not to the CEO.
- Suspend involvement: restrict Otieno's system access and duties pending investigation, on full pay if policy requires.
On the repayment offer. Do not accept it as settlement. A repayment does not extinguish the underlying issues: the contract's validity, the loss to the entity, and possible criminal or disciplinary liability. Record the offer, decline it as a substitute for investigation, and if funds are recovered, account for them formally.
On the related-party contract.
- Review whether it was awarded at fair value; obtain an independent valuation.
- Consider rescission or recovery of any overpayment.
- Disclose the related-party transaction in the financial statements as required.
Reporting and remediation.
- Report to the board and, where required by law or donor agreement, to the relevant authority and donors.
- Refer for disciplinary action and, if evidence supports it, to law enforcement.
- Remediate controls: mandatory segregation of duties, a related-party declaration register, a low threshold for competitive quotation, and automated exception reporting for new suppliers and large payments.
- Report the outcome to the audit committee and track remediation actions to closure.