NGO audit findings Kenya: the recurring issues and how to fix them
If you are running finance for a Kenyan NGO, you have probably opened an audit management letter and felt your stomach drop. The same NGO audit findings Kenya auditors raise year after year are remarkably predictable – and almost entirely avoidable. This article unpacks the recurring issues we see in PBO and NGO audits, explains why they matter to donors and the regulator, and shows finance managers, executive directors, and treasurers how to build a “no surprises” audit posture, drawing on our NGO financial management and special purpose audits experience.
Key takeaways
- The most common NGO audit findings Kenya practitioners report involve documentation gaps, weak segregation of duties, and ineligible costs – not outright fraud.
- A clean audit opinion can still come with a damaging management letter; donors read both.
- Many of these NGO audit findings Kenya teams face can be closed by tightening day-to-day routines rather than buying new software.
- The PBO Authority, KRA, and major donors increasingly cross-check audit findings against grant reports.
- Building a quarterly internal review habit prevents most year-end surprises.
Why NGO audit findings Kenya matter beyond the audit room
A Kenyan NGO audit produces two outputs: the audit opinion (clean, qualified, adverse, or disclaimer) and the management letter detailing control weaknesses. The opinion goes into your annual report and to the PBO Authority; the management letter goes to the board and, increasingly, to donors who request it as part of grant compliance. The professional standards underpinning these reports sit with ICPAK and the Kenya Revenue Authority for tax-related lines.
Recurring NGO audit findings Kenya practitioners flag damage your funding pipeline. Donors share due diligence intelligence. A USAID, FCDO, GIZ, or Gates-funded programme that sees the same finding in three consecutive audits will quietly downgrade your risk rating, shorten grant cycles, or move to direct payment of suppliers. The cost of unresolved findings is rarely a fine – it is the next grant you do not win.
NGO audit findings Kenya 1: Weak segregation of duties
What we see: The same staff member raises the requisition, approves it, processes payment in the bank portal, and posts the journal. In small NGOs with three to five finance staff this is almost universal.
Why it matters: Segregation of duties is the single most fundamental internal control. Its absence enables both fraud and innocent error.
How to fix it: You do not need a large team. You need a compensating controls matrix. Where the same person must initiate and process, require an independent reviewer (the executive director, programme manager, or treasurer) to approve before release. Document who can do what in an authorisation matrix and review it quarterly. For bank payments, use dual authorisation in your bank portal – most Kenyan banks (KCB, Equity, NCBA, Stanbic) support maker-checker workflows at no extra cost.
Finding 2: Missing supporting documentation
What we see: Payments without invoices, payments with pro-forma invoices instead of tax invoices, missing delivery notes, no signed receipt vouchers, training attendance lists with photocopied IDs only.
Why it matters: Auditors must be able to trace every shilling from the bank statement back to the source document. Missing documents force a qualification or, at minimum, a finding.
How to fix it: Adopt a payment voucher pack standard: requisition + quotations + LPO + invoice + delivery note + GRN + bank advice + eTIMS-compliant invoice where applicable. Scan and file by month. For training and workshop expenses, the attendance register, signed per diem schedules, and venue invoices form the standard pack.
Finding 3: Unauthorised budget reallocations
What we see: Spend on Activity 3.2 has overrun by KES 800,000, paid from savings on Activity 1.4, with no donor approval, no board minute, no budget revision.
Why it matters: Most donor agreements cap reallocations at around 10% between budget lines without prior approval. Exceeding this turns the overrun into an ineligible cost that the donor can claw back.
How to fix it: Run a monthly Budget vs Actual review at programme manager level. Any line projected to exceed the donor’s variance threshold triggers a written reallocation request to the donor before spending. Keep approvals on file with the voucher.
Finding 4: Ineligible costs
What we see: Alcohol on workshop bills, KRA penalties and fines, bank charges on prohibited accounts, foreign exchange losses charged to restricted grants, entertainment beyond approved per diems.
Why it matters: Donors will demand refunds. We have seen NGOs forced to repay several million shillings from unrestricted reserves because of small but persistent ineligibility issues across a multi-year grant.
How to fix it: Build an ineligible cost screen into the payment voucher review. Train every finance officer on what is prohibited under each donor’s standard terms. For workshop bills, require itemised invoices and have finance line out alcohol items before settlement.
Finding 5: Unsupported per diems
What we see: Per diem payments without travel authorisation, without back-to-office reports, paid in cash without acknowledgement, paid at rates above the approved schedule.
Why it matters: Per diems are the most-audited line in NGO budgets. They also have PAYE implications if paid above approved rates – the excess is taxable income.
How to fix it: Maintain a per diem policy with approved rates by location (Nairobi, county capitals, rural, regional travel). Require pre-trip authorisation, post-trip back-to-office reports, and signed per diem acknowledgements. Pay by bank transfer or M-Pesa (with statement evidence), not cash. See our statutory deductions checklist for PAYE treatment of allowances.
NGO audit findings Kenya 6: Payroll and PAYE inconsistencies
What we see: Staff on the payroll without contracts, statutory deductions not remitted on time, NSSF/SHIF/AHL miscalculated, casuals paid through “consultancy” to avoid PAYE.
Why it matters: KRA cross-checks payroll data with iTax PAYE returns. NGOs are not exempt from employer obligations even where corporate income is exempt. Misclassifying staff as consultants creates significant withholding tax and PAYE exposure on assessment.
How to fix it: Reconcile payroll to the PAYE return monthly. Maintain a contract file for every paid person. Use the consultant test rigorously – short engagement, defined deliverable, own tools, multiple clients. Read our PAYE, NHIF, NSSF and SHIF employer guide and the SHIF employer obligations deep-dive.
Finding 7: Fixed asset register gaps
What we see: Donor-funded laptops, vehicles, and equipment not on the register; assets not tagged; no annual physical verification; disposed assets still on the books; depreciation policy inconsistent across donors.
Why it matters: Donors retain title to grant-funded assets in many cases. Loss of asset control is a finding that travels – donors share asset registers with successor implementers.
How to fix it: Maintain a single fixed asset register (FAR) coded by donor and project. Tag every asset on receipt. Conduct an annual physical verification with two independent staff. Document disposals with board approval and (where required) donor approval.
Finding 8: Advances and imprests not retired
What we see: Staff advances outstanding for six to twelve months, programme imprests rolled over without acquittal, ex-staff with unrecovered advances.
Why it matters: Outstanding advances are a current asset on your balance sheet that may not actually be recoverable – a classic provision-for-bad-debts issue. Donors view large advance balances as control weakness.
How to fix it: Set a retirement window in your policy – typically seven days from return from travel, fourteen days for activity imprests. No new advance until the previous one is acquitted. Run a monthly aged advances report and chase items over thirty days.
Finding 9: Weak procurement (no three quotes)
What we see: Single-source procurement above the threshold without justification; quotations from suspiciously similar vendors (same printer, same address, same handwriting); no LPOs; no procurement committee minutes.
Why it matters: Procurement is the highest-risk area in NGO operations and the most scrutinised by donors and the EACC.
How to fix it: Adopt a procurement policy with thresholds: under KES 50,000 – petty cash with receipt; KES 50,000 to 500,000 – three written quotes; above KES 500,000 – sealed bids with procurement committee evaluation. Maintain a vendor master file with KRA PIN, tax compliance certificate, and bank details.
Finding 10: VAT ineligibility issues
What we see: VAT charged on goods that should be zero-rated under donor-funded import exemptions; VAT input claimed where the NGO has no taxable supplies; failure to obtain DA1 / pro-1B exemption certificates for project imports.
Why it matters: VAT exemption is project-specific and document-driven. Missing the exemption certificate at importation means paying VAT that is rarely refundable.
How to fix it: Build VAT planning into project procurement. For grant-funded imports, secure the exemption certificate before shipment. Track which projects qualify and which do not. See our VAT registration guide.
Finding 11: Donor cost-share miscalculations
What we see: Co-funding ratios applied incorrectly (e.g., charging 100% of a salary to one donor when policy requires 60/40 split); shared overheads allocated without a documented basis; indirect cost recovery exceeding the donor cap.
Why it matters: Cost-share errors lead to direct refunds. They also signal to donors that the finance system cannot handle multi-donor environments – fatal for institutional funders.
How to fix it: Document an allocation methodology for shared costs (typically by FTE, headcount, or square metres for premises) and apply it consistently. Reconcile cost-share monthly. Where staff work across projects, use timesheets approved by line managers.
Finding 12: Undisclosed related-party transactions
What we see: Office rent paid to a property owned by a board member; consultancies awarded to a director’s company; vehicles leased from a founder’s family business – none disclosed in the financial statements.
Why it matters: Related-party transactions are not prohibited but must be disclosed and conducted at arm’s length. Non-disclosure is a serious finding under both ISA 550 and the PBO Act governance requirements.
Worked example: a typical management letter of NGO audit findings Kenya teams see
A medium-sized health NGO with KES 280 million annual budget receives the following NGO audit findings Kenya auditors typically flag in its 2025 audit:
| Finding | Risk | Estimated cost to remediate |
|---|---|---|
| 14 payment vouchers without eTIMS-compliant invoices | KES 1.2m at risk of donor claw-back | KES 0 – process change |
| Per diem rates above policy on 8 trips | KES 180,000 PAYE exposure | KES 200,000 |
| FAR missing 23 IT assets | Control weakness | KES 50,000 staff time |
| Director consultancy of KES 600,000 not disclosed | Governance breach | Restate disclosures |
A clean audit opinion is still issued, but the management letter triggers a donor compliance review and delays the next tranche by six weeks. The lesson: opinion alone is not the goal.
Building a “no surprises” posture against NGO audit findings Kenya
The NGOs that consistently get clean audits and avoid recurring NGO audit findings Kenya practitioners report do four things:
- Internal quarterly health checks – a finance manager or external consultant runs a mini-audit each quarter against the prior year’s findings.
- Voucher pack discipline – every payment voucher is complete before posting, not after.
- Monthly close on a fixed calendar – bank reconciliations, payroll reconciliations, advance ageing, BvA review, all done by the 15th of the following month.
- Pre-audit walk-through – two weeks before fieldwork, the finance team runs an internal walk-through with sample transactions to test that documentation is intact.
For donor-facing reporting habits that complement this, see donor reporting best practices. For audit thresholds and frequency under the PBO Act, see NGO audit requirements.
Quick summary of NGO audit findings Kenya
If you remember nothing else from this guide, anchor your defence against NGO audit findings Kenya practitioners see most often on these five points:
- The recurring issues are documentation gaps, weak segregation of duties and ineligible costs – rarely fraud.
- A clean opinion can still hide a damaging management letter that donors will read.
- Most NGO audit findings Kenya regulators care about close with process discipline, not new software.
- Quarterly internal health checks and a strict monthly close prevent the bulk of year-end surprises.
- Donors share intelligence; remediating findings within the 6-12 month window is essential.
Frequently asked questions
What is the difference between the audit opinion and the management letter for NGO audit findings Kenya teams receive?
The opinion is a public statement on whether the financial statements give a true and fair view. The management letter is an internal communication to those charged with governance, detailing control weaknesses and recommendations. Donors increasingly request both.
Can we get a clean audit opinion and still have serious findings?
Yes. The opinion concerns whether the numbers are materially correct; the management letter concerns how you got to those numbers. Many NGOs have clean opinions with damaging management letters.
How long do we have to remediate findings?
Most donors expect a written management response within 30 days of the audit and remediation within 6 to 12 months. The next year’s audit will test whether remediation was effective.
Are findings shared between donors?
Increasingly yes. Through harmonised due diligence frameworks, joint funder mechanisms, and informal information-sharing, a finding raised in one audit can affect funding decisions across your portfolio.
What is the cost of a poor audit?
Direct: refund of ineligible costs, possibly several hundred thousand to several million shillings. Indirect: lost grants, shortened cycles, increased donor monitoring costs, reputational damage. The indirect costs typically dwarf the direct ones.
Should we change auditors after a difficult audit?
Generally no. Changing auditors to escape findings is a red flag to donors. Better to fix the findings with the same firm and demonstrate improvement in the next cycle.
How Njane & Company can help
Our NGO audit team works with PBOs, INGOs, and CBOs across Kenya, conducting statutory audits, donor-specific audits (USAID, FCDO, EU, UN agencies), and pre-audit health checks designed to surface NGO audit findings Kenya teams worry about before fieldwork. We also run training for in-house finance teams on management letter remediation and control design. Get in touch with our team via njanecompany.com/ to discuss your situation.
This article provides general guidance based on Kenyan law and practice as of 2026 and does not constitute legal, tax, or financial advice. Consult a qualified professional regarding your specific circumstances.