A whistleblower letter at a high-risk mining subsidiary
Kestrel Copper is listed in London with two mines; 60 percent of revenue comes from the Marula mine in a jurisdiction ranked in the bottom quartile for rule of law. The state owns 30 percent of Marula. Internal audit is outsourced and its head reports to the CFO; the CFO approves the annual audit plan. The whistleblowing line is outsourced, but reports concerning Marula are routed to the country general manager for local follow-up. In February the audit committee chair received an anonymous letter alleging that the Marula country manager approved USD 300,000 in payments to customs officials over 18 months, recorded as community liaison costs. She forwarded it to the CEO and asked him to look into it; no minutes were kept. The CEO told the board in March that the matter was operational and being handled locally. Non-executive directors visit Marula once every two years on management-designed programmes. The chair now wants to know how serious this is.
1. Assess the oversight and accountability architecture. Explain how reporting lines and information flows affect the board's ability to govern, independent of whether the allegation is true.
Read the worked answer
The architecture fails before the allegation is tested.
Assurance independence: internal audit reporting to the CFO means the person responsible for financial records controls the scope, budget and findings of the function that should test those records. The audit committee cannot rely on assurance it does not own.
Whistleblowing: routing Marula reports to the country general manager means the person potentially implicated, or his subordinate, decides whether and how to investigate. That destroys confidentiality, invites retaliation and guarantees that serious matters are filtered before the board sees them.
Escalation: the audit committee chair forwarded the letter to the CEO and kept no minutes. Even if the CEO acts honourably, the governing body cannot evidence oversight, and the CEO is now both subject and supervisor of the response.
Information flow: biennial, management-designed site visits give directors curated exposure. The board's picture of a high-risk jurisdiction is produced by the people whose conduct is in question.
These are structural defects under the principles of accountability, oversight and data and decisions. They mean the board cannot know whether the allegation is true, which is itself a governance failure.
2. What should the audit committee chair do in the next 30 days? Give a sequenced response and explain the judgements involved.
Read the worked answer
Preserve and protect (days 1-3): secure the letter and related correspondence, restrict circulation, and confirm whistleblower protection. Do not ask the country manager to investigate.
Take ownership (days 3-7): convene the audit committee, record the matter in minutes, and engage external counsel and forensic accountants reporting directly to the committee. The judgement is that the CEO's involvement creates at least a perceived conflict; independence of the investigation is more important than speed.
Scope (days 7-14): cover the payments, the recording of community liaison costs, knowledge at site and head office, controls over customs agents, and whether similar arrangements exist elsewhere. Consider suspending implicated individuals on employment-law advice, without prejudging guilt.
Escalate and disclose (days 14-30): inform the board on a need-to-know basis, take legal advice on self-reporting to the relevant authorities and on market-disclosure obligations, and brief the external auditor. Self-reporting is a judgement about legal risk, cooperation credit and licence to operate; it should not be made by management alone.
Document: every decision, rationale and date. The chair's task is not to prove the allegation but to ensure the governing body can demonstrate an independent, documented response.
3. Recommend durable changes to assurance, ethics and stakeholder engagement so that the board does not depend on management's account of events.
Read the worked answer
Assurance: give internal audit a functional reporting line to the audit committee, with the committee approving the plan, budget and appointment of the head. Add a direct board reporting line for high-risk jurisdictions and require periodic external quality assessment.
Whistleblowing: operate a channel independent of local management, with local-language access, triage by a central ethics function, a retaliation monitoring mechanism and reporting metrics to the audit committee. The country manager should not receive reports concerning his own unit.
Ethics and third parties: tighten controls over customs agents and intermediaries, including due diligence, contractual anti-bribery clauses, payment controls and training. Treat facilitation payments as prohibited regardless of local practice.
Information and engagement: replace curated site visits with unscripted access to workers, contractors and community representatives, and require directors to meet local stakeholders without management present. Add a board-level risk appetite for high-risk jurisdictions and a standing report on legal, regulatory and community developments.
Culture: measure whether bad news travels upward. Track near-misses, speak-up rates and investigation closure times, and discuss them at every audit committee meeting. These changes link ethical behaviour, risk governance and engagement to evidence the board can test.