Employee Fraud and Internal Corporate Investigations in Kenya Independent forensic investigations into fraud, collusion and data theft inside your organisation, run so the evidence holds up at the disciplinary hearing, in the Employment and Labour Relations Court and in a criminal case. Instruct Us on Your Matter Call +254 100 177 094 Reviewed by Paul Ooko, Lead Forensic Investigator, Ultimate Forensic Consultants Ltd. Last updated 1 October 2026. Quick answer An internal corporate investigation establishes what an employee or group of employees did, how, and with whose help, using evidence collected lawfully and kept in a verifiable chain of custody. Ultimate Forensic Consultants secures and analyses devices, email, system logs, payment and procurement records and documents, then reports to your board, audit committee, HR or legal team. The report supports dismissal, criminal referral and civil recovery. We are independent of the people under investigation, and we do not decide guilt: that remains the employer’s decision after a fair hearing. The schemes we investigate, and where the evidence sits Internal fraud rarely announces itself. It shows up as small anomalies in records that someone with access can control. Each scheme leaves a different trail. Scheme Typical warning signs Where we look Payroll fraud and ghost employees Staff who cannot be physically verified, duplicate bank accounts, unexplained allowances or overtime Payroll system logs, bank details against HR files, approval trails, ID and document verification Procurement fraud and kickbacks Repeat awards to one supplier, inflated prices, split orders, new vendors with no history Vendor master data, tender files, supplier registration and ownership, communications between buyers and suppliers Fictitious suppliers and false invoices Vendors sharing addresses, phone numbers or bank accounts with staff Link analysis of vendors, staff and bank accounts, invoice metadata and document examination Expense and claims fraud Recycled receipts, altered amounts, claims for unattended events Receipt forensics, email and calendar records, mobile money and card statements Cash skimming and lapping Unreconciled receipts, delayed banking, customer complaints about unrecorded payments Till and ledger data, bank deposits, CCTV, M-Pesa and Paybill reconciliations Stock theft and inventory manipulation Write-offs that repeat, shrinkage that tracks one shift or one storekeeper Stock system audit logs, gate and CCTV records, dispatch documents Data theft and IP leakage Bulk downloads before resignation, files sent to personal email or cloud, a rival launching a copy of your product Forensic images of laptops and phones, email and cloud logs, USB and printing history Conflict of interest and insider-assisted external fraud Undisclosed ownership of a supplier, staff tipping outsiders, repeated losses at one branch Company registry records, communications, system access logs, SIM and mobile money links where relevant Run it properly: five rules that protect your case Most internal fraud cases are weakened by how the employer handled them, not by the fraud. These are the rules we build every engagement around. Secure evidence before anyone is confronted Once a suspect is alerted, files are deleted and phones are reset. We image devices and preserve logs first, quietly. Investigate independently Anyone implicated, or reporting to someone implicated, stays out of the investigation. We report to the board, audit committee or counsel. Collect lawfully and proportionately Access to devices, email and personal data must follow your policies and the Data Protection Act. Unlawfully obtained evidence creates a second problem. Keep the chain of custody Every device and file is logged, hashed and documented, so the evidence can be authenticated under Sections 106A and 106B of the Evidence Act. Give the employee a fair hearing Dismissal that skips notice and a hearing can be found unfair even where the fraud is real. Our report feeds the process. It does not replace it. What UFC delivers Digital evidence acquisition Forensic imaging of laptops, phones, servers and cloud accounts, with recovery of deleted files and messages. Transaction and document analysis Tracing payments and approvals, and forensic examination of invoices, contracts, signatures and altered records. Link and relationship analysis Connecting staff, vendors, bank accounts, phone numbers and companies to expose collusion and undisclosed interests. Structured interviews Planned, documented interviews of witnesses and subjects, conducted without coercion and recorded properly. Asset tracing and recovery support Identifying where diverted funds went, to support civil recovery, freezing applications and settlement negotiations. Report, hearing and court support A clear findings report for the disciplinary panel, a referral pack for the police or EACC, and expert testimony in court. Two illustrative cases: ghost employees and inventory manipulation These scenarios are composites of patterns we see in Kenyan organisations. Names, sectors and figures are changed or indicative, and they are not reports of a specific client’s matter. Payroll fraud: ghost employees on a multi-site payroll What was suspected A manufacturer with several sites noticed that payroll cost was rising faster than headcount. Finance and HR each suspected the other’s records. What we examined Payroll master data and audit logs, HR personnel files, physical verification of staff at each site, bank and mobile money details of every payee, and a forensic image of the payroll officer’s workstation. What the record showed A group of payees could not be verified as real people, with no attendance records and no supervisor who knew them. Several shared the same bank account or phone number. Their records were created and edited after hours under one officer’s login, and approvals came from a supervisor whose credentials were being used by someone else. How the money moved Net pay for the ghost payees was paid into a small set of accounts. Link analysis tied those accounts to a relative of the payroll officer. What the report supported A fair disciplinary hearing, a criminal referral with a complete evidence pack and a civil recovery claim. It also set out the control failures: no segregation of duties, shared credentials and no periodic headcount verification. Inventory manipulation: write-offs that followed one storekeeper What was suspected A distributor saw repeated “damaged goods” write-offs at one warehouse that did not match supplier returns or insurance claims. What we examined Stock system adjustment logs,