State corporations in Kenya are expected to meet governance standards that go beyond financial reporting. The Mwongozo Code of Governance for State Corporations sets out expectations on board effectiveness, accountability, risk, disclosure and ethical leadership. A governance audit tests the entity’s practice against those expectations. For a board, the exercise is more useful when it is treated as a structured review of how decisions are made, not as a document collection exercise completed for an oversight file.
What the Mwongozo Code covers
Mwongozo was presented in March 2015 and is implemented through Executive Order No. 7. It was developed by the Implementation Committee with the State Corporations Advisory Committee and the Institute of Certified Public Secretaries of Kenya. The Code is based on the Constitution of Kenya, 2010 and draws on international governance guidance. It addresses board effectiveness, transparency and disclosure, accountability, risk management, internal controls, ethical leadership and good corporate citizenship. It also provides a framework for shareholder rights and stakeholder engagement.
The Code is not the only source of obligations. State corporations also operate under their establishing statutes, the State Corporations Act (Cap 446), their constitutions or articles, financing agreements and sector rules. A governance review should test the Code alongside those instruments, not in isolation. Where the Code and a statute differ, the statute governs, and the reviewer should say so.
What a governance audit examines
- Board composition, skills, independence, appointment and induction.
- The board charter, committees, delegation and the separation of board and management roles.
- Meeting practice: notice, papers, quorum, minutes, resolutions and follow-up.
- Strategy, performance monitoring and board evaluation.
- Risk management, internal audit and internal controls.
- Financial oversight, procurement and conflict of interest arrangements.
- Disclosure, stakeholder relations and complaints handling.
- Ethical leadership, codes of conduct and integrity systems.
- Compliance with the establishing statute, the Code and reporting obligations.
A review may cover all of these areas or focus on the ones the board or oversight body identifies as higher risk. The scope should be agreed in writing before fieldwork begins, with the period covered, the entities included and the documents to be produced. A scope that is too broad produces a long report with shallow findings. A scope that is too narrow may miss the cause of a governance problem.
How the review is usually conducted
Fieldwork typically combines document review, interviews and observation. The reviewer asks for board and committee minutes, the charter, the register of interests, the risk register, the internal audit plan and reports, the performance contract, the annual report and the policies on procurement, ethics and whistleblowing. Interviews may cover the chair, directors, the chief executive, the company secretary, the head of audit and selected managers.
The reviewer tests whether the paper record matches practice. Minutes may show that a decision was taken, but not whether the board received enough information, whether a conflicted director withdrew or whether an action was completed. A fair process gives the entity an opportunity to explain gaps and to produce documents that were not in the initial request. The reviewer should distinguish a missing document from a decision that was never properly taken.
Reading the findings and gradings
Reports commonly grade findings, for example as compliant, partially compliant or non-compliant, and rate the associated risk. The labels matter less than the reasoning. For each finding, ask: what is the requirement, what is the evidence, what is the gap, what is the consequence and what would close it? A finding that is not linked to a requirement or to evidence is difficult to act on and easy to dispute.
Distinguish a documentation gap from a control failure. A missing board charter can be fixed quickly. A pattern of decisions taken without adequate papers, or conflicts not managed, needs a change in practice. The board should challenge findings that misstate the facts, and should not accept a finding simply because it is in a report. Equally, a board should not dismiss a finding because the reviewer was not a lawyer or an auditor.
From findings to a remediation plan
| Finding type | First action | Owner | Evidence of closure |
|---|---|---|---|
| Policy or charter gap | Adopt or update the document and record board approval | Company secretary | Approved document and board resolution |
| Meeting practice | Revise the agenda and paper cycle; train the secretariat | Company secretary | Agendas, paper deadlines and minutes |
| Conflict management | Update the register and apply the recusal rule | Chair and company secretary | Register and recusal minutes |
| Risk and audit | Refresh the risk register and track audit actions | Chief executive and head of audit | Risk register and action log |
| Compliance filing | Identify the obligation and file or remedy | Finance or compliance lead | Filing receipts and legal opinion |
| Board evaluation | Set a cycle, criteria and reviewer | Chair | Evaluation report and action plan |
Assign one owner for each action, a target date and the evidence that will show closure. Report progress to the board at fixed intervals. The remediation plan should be approved by the board and, where the audit was commissioned by an oversight body, shared in the form that body requires. Sequence the actions and name an owner for each; a long list without priorities is difficult to monitor.
Board conduct during and after the audit
Cooperation is part of good governance. Produce documents as requested, keep the record intact and answer questions factually. Do not edit minutes or backdate approvals to fill a gap. If a document does not exist, say so and explain what was done instead. A reconstructed record can undermine credibility, including where the original gap was innocent.
Protect legal privilege where advice was obtained for litigation or regulatory purposes, but do not label ordinary business papers as privileged. The reviewer should see the governance record, not a version prepared for the review.
After the report, the board should discuss it in a minuted session, approve the remediation plan and monitor delivery. A governance audit that ends with a report and no follow-up changes little. The useful test is whether the next review finds the same issues. The board should also consider whether a finding points to a need for training, a change in committee terms of reference or a revision of the charter.
Primary sources
- Mwongozo Code of Governance for State Corporations, State Corporations Advisory Committee, including the published Code.
- State Corporations Act (Cap 446), Kenya Law.
- State Corporations Advisory Committee, for board induction, evaluation and related guidance.
- Kenya Law, for the current text of the Act and subsidiary legislation.
This article is general information, not legal advice.
Related guidance
governance and audit lawyers in Nairobi. Related reading: board minutes and conflict records in Kenya · shareholding structures and director duties · annual returns under the Companies Act 2015.
