Investigating Employee Fraud in Kenya: A Defensible Process for Employers

When a Kenyan company suspects that an employee has taken kickbacks, falsified invoices or helped an outsider defraud it, two sets of rules apply at once. The Employment Act decides whether any later discipline or dismissal will survive a challenge in the Employment and Labour Relations Court (ELRC). The Anti-Bribery Act (Cap. 79B, formerly the Bribery Act, 2016) decides what the company itself must do about the suspicion, and how quickly. This guide explains how to approach investigating employee fraud so that both sets of rules are met, with particular attention to Kenyan subsidiaries of foreign groups.

The Anti-Bribery Act clock starts at suspicion

Section 14(1) of the Anti-Bribery Act requires every state officer, public officer or other person in a public or private entity to report to the Ethics and Anti-Corruption Commission (EACC), within twenty-four hours, any knowledge or suspicion of instances of bribery. Failing to report is an offence under section 14(2). Regulation 14 of the Bribery Regulations, 2022 repeats the duty and speaks of a person holding a position of authority. Reports may be made in person, in writing, by email or telephone, or through any anonymous system the EACC sets up.

The duty is tied to bribery. A payment to a procurement officer or a supplier’s side commission is squarely within it. Plain theft or expense fraud may not be, but real cases rarely stay on one side of that line, so decide in advance who assesses the question and how fast. Sector regulators, lenders and insurers may impose their own reporting duties, which this article does not cover.

Foreign groups should note regulation 6. A subsidiary or branch of a foreign entity must establish its own bribery prevention procedures. It may adopt the parent’s procedures with the necessary modifications, but they must still comply with section 9. Section 9(1) requires procedures appropriate to the entity’s size, scale and operations, and regulation 19 requires internal and external reporting mechanisms. A global hotline policy silent on a twenty-four hour EACC report does not, on its face, deal with that.

Start with a preliminary inquiry, then choose the route

The ELRC has endorsed a staged approach to misconduct. In Bernard Ngugi v G4S Security Services Kenya Limited, Ongaya J adopted guidance from an earlier decision of the same court. The steps are: a report of the misconduct to the proper authority in the company; a preliminary inquiry into how grave the conduct is and what evidence exists; and then a decision. If the inquiry shows obvious gross misconduct, the employer may dismiss summarily. If it does not, the court said the wiser course is the wider path of notification and hearing under section 41 of the Employment Act.

The preliminary inquiry should be quick, confidential and documented, and should answer what is alleged, what the records already show, and whether the conduct is so plainly serious that summary dismissal is realistic. We recommend that whoever runs it does not later decide the outcome.

Suspension while you investigate

The Employment Act has no provision on suspension, so the terms come from the contract, the handbook or the disciplinary policy. Check those first. In Jacob Oriando Ochanda v Kenya Hospital Association Ltd t/a Nairobi Hospital, an employee implicated in a fuel-ordering scam was suspended with pay for two weeks, later extended by a few days, so that the employer could complete its investigation. A disciplinary hearing followed, and the Court of Appeal upheld his summary dismissal.

The safer pattern is suspension on full pay, for a short stated period, described in the letter as a neutral step and not a finding. Suspension achieves little if the employee keeps system access, so plan access controls with IT on the day.

Fair process inside the investigation

Section 41(1) of the Employment Act requires the employer, before terminating for misconduct, to explain to the employee in a language the employee understands the reason it is considering termination. The employee is entitled to have another employee or a shop floor union representative present. Section 41(2) requires the employer to hear and consider the employee’s representations, and it expressly covers summary dismissal.

The guidance quoted in Bernard Ngugi goes further. It expects an objective, factual investigation in which the employee can be heard, call and cross-examine witnesses, produce documents and be assisted by a colleague or union representative. It also expects the show cause letter to warn that dismissal is contemplated. The Court of Appeal in Ochanda added that a fair hearing need not be oral.

First, put the allegations in writing. State dates, amounts and the documents you rely on, so that the employee can actually answer them. The Act does not say in terms that you must hand over the whole investigation file, but disclosing what you rely on is the safest way to meet the fair-hearing standard.

Second, record the reason you genuinely held. Under section 43(2), the reasons for termination are the matters the employer genuinely believed to exist at the time and which caused it to terminate. Under section 43(1), the employer must prove them, and failure to do so makes the termination unfair under section 45.

Third, settle the basis of the outcome before you write the letter. In Bernard Ngugi the court treated an employer’s shifting between a contractual notice clause and a disciplinary finding as evidence of bad faith. Choose one basis.

Handle employee data lawfully

An investigation usually means reviewing emails, phone records, expense claims and access logs, and all of that is personal data. Section 25 of the Data Protection Act requires that it be processed lawfully, fairly and transparently, collected for explicit and legitimate purposes, and limited to what is necessary. Section 28(2)(f)(i) allows indirect collection of personal data where necessary for the prevention, detection or investigation of crime.

Tell staff in advance, through a monitoring policy, what the company may review, limit the review to what the allegation requires, and restrict who sees the material.

Keep the record that wins the case

Section 45(5) directs the ELRC to weigh the employer’s procedure, its handling of any appeal, how it dealt with similar cases in the past and any earlier warning letters. Consistency therefore matters as much as the evidence. Section 74(1)(l) requires employers to keep records of warning letters and other evidence of misconduct. Keep the inquiry note, hearing minutes and decision letter together, and offer an internal appeal.

If the evidence points to a crime, the next questions are police reporting and whether to wait for the criminal case, which we cover in our guide to dismissal for suspected crime.