The Letter in the Company Secretary's Inbox

The first 72 hours decide whether this becomes a governance failure or a managed incident. Sequence:

1. Protect the source. Acknowledge receipt through a channel that does not reveal identity, confirm the anti-retaliation commitment, and do not forward the email broadly. Log receipt, time and content.
2. Preserve evidence. Instruct IT (through the board chair, not the CFO) to preserve emails, ERP approval trails, supplier master data, the draft internal audit report and version history. Do not let the CFO or procurement manager control access.
3. Escalate to the right person - and not the wrong one. The CFO is the subject, so the CEO alone is not sufficient. The audit committee chair has a close personal relationship with the CFO and should recuse. The chair of the board should convene a special committee of directors with no connection to the allegations, with a written scope and its own adviser.
4. Appoint independent investigators. External forensic accountants or counsel, reporting to the special committee, not to management. Give them access to all records and staff.
5. Neutralise conflicts of process. The CFO should not sign off on payments to Delta Spares, approve internal audit work, or sit on any related decision pending the review. Frame this as administrative, not disciplinary, to avoid a premature finding.
6. Notify the external auditor and consider the loan covenant. Audited accounts are due in eight weeks; the auditor needs to know now, and the board must assess whether the loan agreement requires notification of material fraud allegations.

Governance. The special committee should have three members, at least two of them independent of management, a written terms of reference covering scope, budget, reporting and timetable, and power to instruct advisers directly. It should meet without management present. The company secretary services the committee and maintains a single evidence chain.

Reporting lines. Investigators report to the special committee, with a copy to the board chair. Internal audit must report to the audit committee, not the CFO; if the audit head was pressured, that is itself a disciplinary matter and internal audit's independence must be restored immediately. The audit committee should meet without management and minute that it did.

Interim reporting. The full board should receive a status update at its next meeting with an agreed communications position, but without prejudging findings. The CFO should be given a fair opportunity to respond before any adverse conclusion is recorded.

Disclosure decisions. Three audiences matter:

• The lender, if the loan agreement contains a notification or representation obligation; silence risks an event of default.
• The external auditor, who must consider the effect on the financial statements and may need to extend procedures.
• Regulators or law enforcement, if the amounts and the evidence point to a criminal offence; take legal advice before reporting, and record the reasoning either way.

Internal communication should be limited and factual: allegations are being investigated, cooperation is required, retaliation is a disciplinary offence. Do not announce names, and do not brief customers or staff beyond need to know.

The policy existed but the system did not. Fixes should be specific:

• Channel. A confidential, independently operated reporting line (phone and web) that allows anonymous reporting and is available to contractors and suppliers, not just employees.
• Triage and protocol. A written procedure: acknowledgement within 48 hours, risk rating, decision on investigation route, investigator independence test, timelines and closure criteria. One case log, owned by the company secretary, with restricted access.
• Anti-retaliation. Explicit prohibition, a presumption that any adverse action against a reporter within 12 months is retaliatory unless management proves otherwise, and a route for reporters to escalate outside line management.
• Committee oversight. The audit committee reviews the log quarterly and receives a thematic annual report; the risk committee meets at least quarterly and has fraud risk on a standing agenda. Seven months without a meeting is not a diary problem, it is an oversight failure.
• Internal audit independence. A direct reporting line to the audit committee, committee involvement in appointing and removing the head of audit, and a rule that draft reports cannot be edited by management - only responded to.
• Procurement controls. Supplier master-data checks for related parties, mandatory conflict declarations by procurement staff, competitive tendering thresholds, and payment approvals segregated from vendor creation.
• Tone at the top. The board should state, in the annual report and internally, that fraud and retaliation are treated as dismissible offences - and then act consistently, including against senior officers.

The real test is not the policy document but whether the board, when the next allegation names a senior executive, follows the process it wrote.