Employee Fraud and Internal Corporate Investigations in Kenya
Independent forensic investigations into fraud, collusion and data theft inside your organisation, run so the evidence holds up at the disciplinary hearing, in the Employment and Labour Relations Court and in a criminal case.
Instruct Us on Your Matter Call +254 100 177 094Reviewed by Paul Ooko, Lead Forensic Investigator, Ultimate Forensic Consultants Ltd. Last updated 1 October 2026.
The schemes we investigate, and where the evidence sits
Internal fraud rarely announces itself. It shows up as small anomalies in records that someone with access can control. Each scheme leaves a different trail.
| Scheme | Typical warning signs | Where we look |
|---|---|---|
| Payroll fraud and ghost employees | Staff who cannot be physically verified, duplicate bank accounts, unexplained allowances or overtime | Payroll system logs, bank details against HR files, approval trails, ID and document verification |
| Procurement fraud and kickbacks | Repeat awards to one supplier, inflated prices, split orders, new vendors with no history | Vendor master data, tender files, supplier registration and ownership, communications between buyers and suppliers |
| Fictitious suppliers and false invoices | Vendors sharing addresses, phone numbers or bank accounts with staff | Link analysis of vendors, staff and bank accounts, invoice metadata and document examination |
| Expense and claims fraud | Recycled receipts, altered amounts, claims for unattended events | Receipt forensics, email and calendar records, mobile money and card statements |
| Cash skimming and lapping | Unreconciled receipts, delayed banking, customer complaints about unrecorded payments | Till and ledger data, bank deposits, CCTV, M-Pesa and Paybill reconciliations |
| Stock theft and inventory manipulation | Write-offs that repeat, shrinkage that tracks one shift or one storekeeper | Stock system audit logs, gate and CCTV records, dispatch documents |
| Data theft and IP leakage | Bulk downloads before resignation, files sent to personal email or cloud, a rival launching a copy of your product | Forensic images of laptops and phones, email and cloud logs, USB and printing history |
| Conflict of interest and insider-assisted external fraud | Undisclosed ownership of a supplier, staff tipping outsiders, repeated losses at one branch | Company registry records, communications, system access logs, SIM and mobile money links where relevant |
Run it properly: five rules that protect your case
Most internal fraud cases are weakened by how the employer handled them, not by the fraud. These are the rules we build every engagement around.
Secure evidence before anyone is confronted
Once a suspect is alerted, files are deleted and phones are reset. We image devices and preserve logs first, quietly.
Investigate independently
Anyone implicated, or reporting to someone implicated, stays out of the investigation. We report to the board, audit committee or counsel.
Collect lawfully and proportionately
Access to devices, email and personal data must follow your policies and the Data Protection Act. Unlawfully obtained evidence creates a second problem.
Keep the chain of custody
Every device and file is logged, hashed and documented, so the evidence can be authenticated under Sections 106A and 106B of the Evidence Act.
Give the employee a fair hearing
Dismissal that skips notice and a hearing can be found unfair even where the fraud is real. Our report feeds the process. It does not replace it.
What UFC delivers
Digital evidence acquisition
Forensic imaging of laptops, phones, servers and cloud accounts, with recovery of deleted files and messages.
Transaction and document analysis
Tracing payments and approvals, and forensic examination of invoices, contracts, signatures and altered records.
Link and relationship analysis
Connecting staff, vendors, bank accounts, phone numbers and companies to expose collusion and undisclosed interests.
Structured interviews
Planned, documented interviews of witnesses and subjects, conducted without coercion and recorded properly.
Asset tracing and recovery support
Identifying where diverted funds went, to support civil recovery, freezing applications and settlement negotiations.
Report, hearing and court support
A clear findings report for the disciplinary panel, a referral pack for the police or EACC, and expert testimony in court.
Two illustrative cases: ghost employees and inventory manipulation
These scenarios are composites of patterns we see in Kenyan organisations. Names, sectors and figures are changed or indicative, and they are not reports of a specific client’s matter.
Payroll fraud: ghost employees on a multi-site payroll
- What was suspected
- A manufacturer with several sites noticed that payroll cost was rising faster than headcount. Finance and HR each suspected the other’s records.
- What we examined
- Payroll master data and audit logs, HR personnel files, physical verification of staff at each site, bank and mobile money details of every payee, and a forensic image of the payroll officer’s workstation.
- What the record showed
- A group of payees could not be verified as real people, with no attendance records and no supervisor who knew them. Several shared the same bank account or phone number. Their records were created and edited after hours under one officer’s login, and approvals came from a supervisor whose credentials were being used by someone else.
- How the money moved
- Net pay for the ghost payees was paid into a small set of accounts. Link analysis tied those accounts to a relative of the payroll officer.
- What the report supported
- A fair disciplinary hearing, a criminal referral with a complete evidence pack and a civil recovery claim. It also set out the control failures: no segregation of duties, shared credentials and no periodic headcount verification.
Inventory manipulation: write-offs that followed one storekeeper
- What was suspected
- A distributor saw repeated “damaged goods” write-offs at one warehouse that did not match supplier returns or insurance claims.
- What we examined
- Stock system adjustment logs, physical stock counts against system balances, gate passes, dispatch notes, CCTV, and the phones and laptop of the staff involved under the company’s device policy.
- What the record showed
- Write-offs clustered on the shifts of one storekeeper and were posted just before stock counts. Dispatch notes showed quantities lower than what the CCTV recorded leaving the gate. Recovered messages showed the storekeeper coordinating pick-ups with an outside buyer and a transport contractor.
- How the loss was hidden
- Goods were removed on genuine dispatch paperwork, then the difference was written off as damage, which kept the system balance and the physical count in step.
- What the report supported
- Disciplinary action against the staff involved, a referral covering the outside buyer and contractor, and a recovery claim. The company also tightened write-off approvals and gate reconciliation.
Are you seeing the same patterns? Instruct us before anyone is confronted, so the logs, devices and footage are preserved.
How an engagement runs
- Scope and instruct. We agree the allegations, the people involved and who we report to. Where possible, we are engaged through your advocate to support legal privilege.
- Secure the evidence. Devices, mailboxes, system logs, CCTV and records are preserved discreetly, before any suspension or confrontation.
- Analyse. Transactions, documents and communications are reconstructed into a timeline showing what happened, when and through whom.
- Interview. Witnesses and, where appropriate, subjects are interviewed in a structured, documented way.
- Report and act. You receive a findings report, and we support the disciplinary hearing, criminal referral or civil recovery that follows.
The legal framework we work within
- Employment Act, 2007: the requirements for a valid reason, notice and a hearing before dismissal (sections 41, 43, 44 and 45), and the employer’s burden of proving the reason was fair.
- Penal Code (Cap. 63): stealing by employees, forgery, uttering false documents and obtaining by false pretences.
- Computer Misuse and Cybercrimes Act, 2018: computer fraud, forgery, unauthorised access and data interference.
- Anti-Corruption and Economic Crimes Act, 2003 and Bribery Act, 2016: corruption, fraud in procurement and the duty of private entities to have anti-bribery procedures.
- Proceeds of Crime and Anti-Money Laundering Act, 2009: reporting and tracing obligations where stolen funds are laundered.
- Evidence Act (Cap. 80), Sections 106A and 106B: admissibility of electronic records and the supporting certificate.
- Data Protection Act, 2019: lawful, proportionate processing of employee data during an investigation.
Frequently asked questions
What is an internal corporate investigation?
It is an independent, confidential examination of suspected fraud, theft, collusion or data leakage within your organisation. It establishes the facts using lawfully collected evidence and gives management a report it can act on.
Should we suspend or confront the employee before investigating?
Not before the evidence is secured. Alerting a suspect early lets files be deleted and devices wiped. Decisions on suspension should be made with your HR and legal advisers once evidence is preserved.
Can we search an employee’s company laptop or email?
Usually yes, where your policies allow it and the search is lawful and proportionate under the Data Protection Act. We image the device forensically rather than browsing it, which protects both the evidence and your position.
Will your report stand up in the Employment and Labour Relations Court and in a criminal case?
Our evidence is collected with a documented chain of custody and supported by the certificate required under Section 106B of the Evidence Act. Whether a dismissal is fair also depends on the process you follow, which is why we build the investigation around your hearing obligations.
Can you recover the stolen money?
We cannot guarantee recovery. We trace where funds went and prepare the evidence that supports civil recovery, freezing orders and settlement, working with your advocates.
Do you investigate senior managers and directors?
Yes. In those cases we report only to the board, the audit committee or external counsel, never to anyone within the management line under review.
Instruct us before the evidence disappears
Tell us what you suspect. We will confirm what can be preserved, who should be told and how to proceed fairly.
Instruct Us on Your Matter +254 100 177 094Ultimate Forensic Consultants Ltd is PSRA-licensed and ODPC-registered, with offices in Nairobi, Mombasa and Kisumu. This page is general information and not legal advice.