Governance Audits and Board Evaluations in Kenya: What the Law Requires, Who Must Do Them and Who Is Allowed to Conduct Them

In short, three separate exercises are confused with one another in Kenyan boardrooms. A board evaluation is the board assessing its own performance, and for listed companies, banks, insurers and state corporations it is required every year. A governance audit is an independent assessment of the company’s governance against a governance code, required every year of every company which has issued securities to the public, and conducted only by a professional accredited by the Institute of Certified Secretaries. A legal and compliance audit is an advocate’s review of the company’s adherence to the law, required at least every two years. This article says which applies to your board, who is allowed to conduct each, what each covers and what happens when they are skipped.

The question boards ask

A director joins a listed board, or a bank board, or the board of a parastatal, and within a year is asked to approve a governance audit, a board evaluation and a legal audit, often in the same quarter and sometimes from the same supplier. The natural questions are whether all three are required, whether they are the same thing under different names, and whether the company secretary, the external auditor or the firm’s advocates should be doing them. The answers are yes, no and it depends on which one, and the detail is worth knowing because the regulator now scores boards on it and publishes the results.

Where the requirements come from

The Companies Act, 2015 says nothing about governance audits or board evaluations. It sets the duties of directors and the contents of the annual report and leaves the rest to codes and regulators. The requirements come from four places, and which of them binds your board depends on what the company is.

The Code of Corporate Governance Practices for Issuers of Securities to the Public, 2015, issued by the Capital Markets Authority under the Capital Markets Act, applies to every company which has been approved to issue securities to the public, whether or not those securities are listed, and has been fully in force since March 2017. It operates on an apply or explain basis. A company applies the Code in full or explains in its annual report why it has not, and the Authority has said in terms an unsatisfactory explanation, or a failure to do what was explained, leads to enforcement under the Act. Since 2016 the Authority has scored every issuer each year against a weighted scorecard and published the results, ranking companies from leadership down to weak, and a board which has skipped its audits finds itself named in the bottom band.

Mwongozo, the Code of Governance for State Corporations, applies to every state corporation and parastatal and carries its own requirements for annual board evaluation and governance audit, administered through the State Corporations Advisory Committee. The Central Bank’s Prudential Guideline on Corporate Governance requires every bank’s board to evaluate its performance every year and to submit the results to the Central Bank. The Insurance Regulatory Authority, the Retirement Benefits Authority and the SACCO Societies Regulatory Authority each carry equivalent requirements in their guidelines for insurers, pension scheme trustees and deposit-taking SACCOs. And the Capital Markets Authority’s Draft ESG Code for Issuers, published in July 2026, proposes to move the listed company regime from apply or explain to apply and explain, with mandatory provisions to take effect within a year of publication, which will make the exercises described here harder to explain away.

The three exercises, and who must do which

Exercise	Who must do it	How often	Who conducts it
Board evaluation	Issuers of securities to the public, banks, insurers, pension schemes, deposit-taking SACCOs, state corporations	Every year	The board itself, usually facilitated. Banks submit results to the Central Bank. State corporations are evaluated through the State Corporations Advisory Committee
Governance audit	Every issuer of securities to the public under the CMA Code, and state corporations under Mwongozo	Every year	A professional accredited as a governance auditor by the Institute of Certified Secretaries, reporting to the board with an opinion for the annual report
Legal and compliance audit	Every issuer of securities to the public under the CMA Code	At least once every two years	An advocate in good standing with the Law Society of Kenya

The board evaluation

The board evaluation is the board holding a mirror to itself. The CMA Code requires the board of an issuer to evaluate, every year, its own performance, the performance of its committees, of the chairperson, of the chief executive, of the company secretary and of each individual director, and to disclose in the annual report how the evaluation was done and, in general terms, what it found. The Central Bank and Mwongozo require the same of banks and state corporations, with the added discipline of a regulator reading the result.

A serious evaluation covers the board’s composition and skills against the company’s strategy, the quality and timing of the information it receives, the conduct of meetings, the effectiveness of each committee against its charter, the relationship between the board and management, the chairperson’s leadership, the contribution and attendance of each director, and the company secretary’s support. The method is a mix of structured questionnaires, confidential interviews and a review of board papers and minutes, and it ends in a written report with an action plan the board adopts and revisits the following year. The Code does not insist on an external facilitator, but a board which evaluates itself by circulating a form and averaging the scores has done something which satisfies the letter and nothing else, and most listed boards now bring in an independent facilitator at least every third year so the exercise is taken seriously and the findings are candid.

The governance audit

The governance audit is a different thing, and the distinction matters because the Code fixes who is allowed to do it. It is an independent assessment of the extent to which the company’s governance structures, policies and practices comply with the Code, conducted every year by a competent and recognised professional accredited for the purpose by the Institute of Certified Secretaries. The Institute maintains the register of accredited governance auditors and has issued the standards and toolkit under which they work, and an audit conducted by anyone else, however experienced, is not the audit the Code requires. The auditor examines the board’s structure and independence, the committees and their charters, the appointment and induction of directors, remuneration policy, risk management and internal controls, the ethics framework, stakeholder relations, disclosure and transparency, and the board’s own compliance with its charter, and issues an opinion on the company’s level of compliance which is disclosed in the annual report. The Authority’s scorecard is built to line up with the governance audit, so the audit report is in practice the document on which the company’s published ranking rests.

The legal and compliance audit

The third exercise is the one boards most often confuse with the governance audit, and the Authority has drawn the line itself. A legal and compliance audit establishes the level of the company’s adherence to the laws, regulations and standards which apply to it, and the Code requires it at least once every two years, conducted by a legal professional in good standing with the Law Society. It is principally about compliance with the law applicable to the entity, where the governance audit is about compliance with the Code. In practice it covers the company’s statutory filings and registers, its licences and permits, its contracts and their renewal dates, its employment and immigration compliance, tax and levy obligations, data protection, competition, sector regulation, litigation and contingent liabilities, and the beneficial ownership and contact person requirements which have caught out more than one board since 2023. It ends in a report which lists each area, the position found, the gap and the remedy, and it is the document a board relies on when it certifies compliance in the annual report.

Boards outside the Code

A private company, a family business, a foreign subsidiary or a non-profit is under no statutory obligation to do any of this. Two things change the position in practice. The first is the lender or investor who asks. Banks lending to a mid-sized company, development finance institutions and private equity funds now ask for a governance audit or a legal and compliance audit as a condition, and a company which has one to hand closes faster. The second is the board’s own liability. Directors of every company owe the duties in sections 140 to 147 of the Companies Act, and a director who has never seen a compliance audit is a director who does not know what he is certifying when he signs the accounts. For those boards the exercises are chosen rather than required, and they are usually run every two years on a lighter scale.

What happens when they are skipped

For an issuer, the consequence arrives in two stages. The company explains in its annual report why it has not applied the Code, the explanation is scored, and a weak or absent explanation places the company in the lowest band of the Authority’s published assessment, which institutional investors read. Where the explanation is unsatisfactory or the promised measures are not taken, the Authority has stated it will bring enforcement proceedings under the Capital Markets Act, and its enforcement against directors of listed companies in recent years shows the statement is not decorative. For a bank, a missed evaluation is a supervisory finding. For a state corporation, it is a matter for the parent ministry and the Advisory Committee. For everyone, the practical consequence is the one which matters most. The board finds out about the problem from the regulator, the lender or the plaintiff rather than from its own audit.

How the firm runs them

We conduct legal and compliance audits for issuers and for private boards, as advocates in good standing with the Law Society, and deliver the report the Code contemplates, with a gap register the board tracks to closure. We facilitate board evaluations, running the questionnaires and confidential interviews and presenting the findings to the board with an action plan. For the governance audit we work alongside an accredited governance auditor so the three exercises share one evidence base, one timetable and one set of recommendations, rather than three suppliers asking the company secretary for the same minutes three times. Each engagement is quoted as a fixed fee on the size of the board and the complexity of the business, and the three together cost less than the three apart.

Questions we are asked every week

Is a governance audit the same as a board evaluation?

No. A board evaluation is the board assessing its own performance. A governance audit is an independent assessment of the company’s compliance with the Code, conducted by an accredited governance auditor. Issuers need both, every year.

Who is allowed to conduct a governance audit in Kenya?

Only a professional accredited for the purpose by the Institute of Certified Secretaries. The company secretary, the external auditor and the company’s advocates are not able to do it unless they hold the accreditation themselves.

How often is a legal and compliance audit required?

At least once every two years for issuers of securities to the public, conducted by an advocate in good standing with the Law Society of Kenya. Many boards run it annually alongside the governance audit.

Does a private company have to do any of this?

No, unless a regulator, lender or shareholder agreement requires it. Most private boards which do it are responding to a bank, an investor or a director who wants to know what he is signing.

Must the board evaluation be done by an outside facilitator?

The Code does not insist on it. An independent facilitator every second or third year is now the norm on listed boards because it produces candid findings and it reads well in the annual report.

What does a governance audit cost?

It depends on the size of the board, the number of subsidiaries and the state of the records. We quote a fixed fee once we have seen the board charter, the committee structure and the last annual report.

What changes under the Draft ESG Code?

The proposed move from apply or explain to apply and explain, with mandatory provisions on ESG disclosure, board diversity and independent director tenure. The audits described here become the evidence the board relies on to show it has applied the Code rather than merely explained.

Next step

If your board is due an evaluation, a governance audit or a legal and compliance audit, or is not sure which of the three it owes, send us the board charter and the last annual report by e-mail to peter@pmlaw.co.ke or WhatsApp through +254 714 644 080. We reply within one working day with what the board is required to do, when, and a fixed fee. Nothing is charged until you instruct us.

Peter Maina is a Partner of Peter Maina & Company Advocates, Hazina Towers, Nairobi. He is an Advocate of the High Court of Kenya practising in corporate governance, capital markets, corporate and commercial, and real estate law, and advises boards of listed companies, regulated institutions and private groups on governance and compliance.