The Life and Times of Whistle Blowers

Do you remember that annoying classmate in primary school who always provided to the teacher unsolicited reports of those who were “making noise” when the teacher had stepped out of class? Or the one in boarding school who reported to the dorm master when colleagues had scaled the fence using military grade subterfuge and sneaked out of school to have a good time? In school we referred to these dystopian citizens as “snitches” or “tattle tales” but this was largely informed by the folly of youth where everyone was supposed to be bound by the Mafian oath of omerta or silence when such indiscretions were being perpetuated. However in adulthood, the role of these informers in an organization is absolutely critical in providing information about criminal activities that are being perpetuated by staff, management or, in extreme cases, the board of the organization itself.

Such an informer is called a whistle blower and is defined as a person who informs on a person or organization that is engaged in an illicit activity. A bank I know had a whistle blower call in to say that the branch manager was stealing from the branch. An auditor was sent over to the branch but he couldn’t find any evidence of the stealing. The whistle blower was tenacious and called again, this time saying “tell the auditor to put a camera in the backroom where the ATM is loaded with cash. He will see.” Sure enough a hidden camera was placed and the branch manager was busted in all his glory skimming money from the ATM cassettes as he ostensibly loaded them with cash.
The Capital Markets Authority (CMA) code of corporate governance practices for issuers of securities to the public 2015(we should probably reduce that mouthful to two words: “The Code”) specifically mentions whistle blowers three times. Some context around its genesis would be useful here. The Kenyan private and public sector space has a litany of cases of gross malfeasance perpetuated by senior management, very often leading to the eventual collapse of institutions for lack of cash flow. More often than not, staff knew what was going on but did not have the avenue to report such activities, as it would lead to instant dismissal, or in some extreme cases, grave personal injury. Imperial and Chase Banks are classic cases of organizations that could have done with a whistle blower policy, but they also beg the question: who do you whistle blow to, when it’s the owners or key officers of the institution perpetuating the fraud? The CMA Code tries to address this, on the premise that companies issuing securities to the public – such as shares via the Nairobi Securities Exchange (NSE) or bonds – have the basic corporate governance framework of a board of directors where the buck should stop. Section 4.2.1 provides that the board shall establish whistle-blowing mechanisms that encourage stakeholders to bring out information helpful in enforcing good corporate governance practices. Sounds a bit la-di-da right? Like some flowery language meant to incorporate current buzzwords such as “good corporate governance” and “stakeholders”.
But a second and far more robust attempt is made further down the Code under Section 5.2.5 which states that the board shall establish and put into effect a Whistleblowing Policy for the company whose aim shall be:
a) To ensure all employees feel supported in speaking up in confidence and reporting matters they suspect may involve anything improper, unethical or inappropriate; b) To encourage all improper, unethical or inappropriate behavior to be identified and challenged at all levels in the company; c) To provide clear procedures for reporting of such matters; d) To manage all disclosures in a timely, consistent and professional manner; and e) To provide assurance that all disclosures shall be taken seriously, treated as confidential and managed without fear of retaliation.

Why should you wake up and take notice if your company is not listed on the NSE? The CMA Code covers any company that has issued securities to the public. Therefore an Imperial Bank, which had issued a CMA approved bond to the public not too long before it crashed and burned, would have been expected to be applying the code within its own corporate governance framework had it lasted long enough. Section 7.1.1 (w) of the Code gets even more prescriptive by declaring that the board shall disclose the company’s Whistleblowing Policy on its annual report and website.

The CMA Code is a fairly modern and well thought out regulatory framework that encourages issuers of securities to “apply or explain” the guidelines provided therein. It will therefore require an inordinate amount of CMA supervision to ensure that issuers of securities are religiously submitting annual returns where they undertake the self-evaluation mechanism that an “apply or explain” framework presumes. If the CMA does this well, it then provides a second level of scrutiny to banks that may have inadvertently escaped the Central Bank of Kenya’s statutory hawk eyes and wish to take money from the public in a different form.

The institutions that do this well outsource the whistleblowing framework to an independent third party whose number is widely circulated within the organization. Staff members are encouraged to call that number or send an email with the assurance that the information will be handled sensibly by a non-aligned entity. The third party entity provides these reports directly to the organization’s board audit committee for directive action to be taken. It is imperative that the feedback loop on the whistleblowing falls outside of current management for obvious reasons: management might be part of the problem. Outsiders have no way of knowing what rot goes on inside an institution until the crap hits the fan. What the CMA Code has done is provide a way to protect investors and enable them to hold issuers of securities to a higher standard of transparency. However, this can only work successfully if the CMA plays its enforcement role judiciously.

Uchumi Directors are not living happily ever after

[vc_row][vc_column width=”2/3″][vc_column_text]It’s one thing to see the law being created. It’s another to see it being applied. The outcome of the Uchumi Supermarkets Ltd (USL) enforcement action by the Board of the Capital Markets Authority (CMA) was one of the best precedents set by the regulator since John Hanning Speke discovered Lake Victoria as the source of the Nile. As a corporate governance educator, I am constantly asked for local case studies since our curriculum is replete with American and European examples, as those are more mature markets that have built up a significant jurisprudence of corporate scandals and enforcement actions thereafter. Kenya itself has a litany of white-collar scandals, but very little in the form of punishment for the perpetrators of corporate malfeasance.

The CMA has undoubtedly set the tone for board directors and key officers of listed and non-listed public companies in this town which tone is as clear as the waters in a baptismal font as evidenced by the allegorical language used. “The Chairman and the directors will be required to “disgorge” their director allowances.” A dictionary meaning of disgorge is to “yield or give up funds, especially funds that have been dishonestly acquired.” Another definition of the same word is “to eject food from the throat or mouth.” And therein lies the allegory, the hidden meaning. Directors who allow malfeasance to occur on their watch and are remunerated during such time are feeding from the wrong trough and will be asked to regurgitate those emoluments swiftly, unashamedly and unequivocally.

The former chairperson and two former non-executive directors of USL were disqualified from holding office as directors or key officers of a publicly listed company, a company that has issued securities, or a company that is licensed or approved by the CMA for a period of two years. They were also asked to return the director allowances paid to them for the financial years 2014 and 2015. Finally, they were instructed that if ever a listed company saw it fit to appoint them to a board after they had atoned for their sins and sat in director purgatory for two years, they would be required to attend corporate governance training before being eligible for appointment.

The former chief executive officer and the former finance manager were also disqualified from holding office as a directors or key officers of companies that are regulated by the CMA. The regulator will also be filing a complaint at the Institute of Certified Public Accountants regarding the professional conduct of the two who are registered Certified Public Accountants.

In retrospect, what the named Uchumi directors and officers have gotten is a rap on the knuckles. They dodged a bullet provided by the current and newly operationalized Companies Act 2015 that allows a shareholder to bring a derivative action against a director for negligence, default, breach of duty or breach of trust. And the regulatory outcome would set enough of a precedence to warrant a shareholder to pursue this course of action in our highly litigious country. The new Companies Act 2015 has given a lot of teeth to stakeholders – including the company itself – to seek retribution for malfeasance or wrong doing on the part of the very parties supposed to maintain the best interests of the company. In light of the fact that a law cannot be applied retrospectively, and the fact that these breaches happened before 2015, the main worry for the named directors is how to mpesa those funds back to base and, for the officers, what color tie to wear to the disciplinary hearing at ICPAK.

The CMA itself issued a new corporate governance code in 2015 (CMA Code), and relied on its fairly modern tenets, that codified director fiduciary duties, in its conclusions about the creative accounting undertaken by the officers of Uchumi and overseen by the non executive directors. Quoting the CMA press release on the Uchumi decision: “The inquiry further established that in some instances the USL branch expansion program was undertaken without due regard to the Board’s fiduciary duty of care due to the absence of a proper risk management framework being in place. It was also established that in some instances, USL pre-financed landlords in addition to making payment of respective commitment fees, but nevertheless the branches were never opened or funds recovered.”

Under Chapter 6 of the CMA Code titled Accountability, Risk Management and Internal Control, boards of directors are required to put in place adequate structures to enable the generation of true and fair financial statements. The Code explains that the rigours of risk management by the board should seek to provide interventions that optimize the balance between risk and reward in the company. In layman’s language: Figure out what could possibly go wrong in the company whose board you sit on and ensure you put in place processes that recognize that risk and, where possible, mitigations for such an eventuality. Furthermore all times ensure the financial statements reflect- rather than conceal – those risks. In the Uchumi case, paying developers of buildings where you intended to open new branches in advance and not putting into place protection measures in case your advance funds were mis-directed to personal Christmas slush funds, was a big mistake. Those pre-payments that were not being recovered should have been provided for or written off entirely.

In light of all the recent corporate scandals, and our seeming inefficiency in prosecuting white-collar thugs dressed in oversized Bangkok knock off suits, the CMA enforcement action is a breath of fresh air. While the directors have all gotten off fairly lightly with a mild disgorgement, it is the social pariah status that will be the most effective deterrent for board directors in this market. I’m not sure that there is a self respecting board in this town, whether in the public or private sector that wants a “director formerly known as the Uchumi guy” serving on its board anytime soon.

[email protected]
Twitter: @carolmusyoka[/vc_column_text][/vc_column][vc_column width=”1/3″][/vc_column][/vc_row]