What is a legal compliance audit?

Legal has something to do with the laws of a country. According to Collins English Dictionary Reference Edition, the word ‘legal’ means (1) established by or permitted by law; lawful (2) of or relating to law (3) relating to or characteristic of lawyers.

From the definition above, we shall use the word legal in the second sense. The same dictionary defines the word ‘audit’ as follows: (1) an official inspection of business accounts, conducted by an independent qualified accountant (2) any thoroughgoing assessment or review (3) to examine (business accounts) officially.

Black’s Law Dictionary Eighth Edition defines a compliance audit as “an audit conducted by a regulatory agency, an organization, or a third party to assess compliance with one or more sets of laws and regulations.

We can thus define the term legal compliance audit as “a thoroughgoing assessment or review of an organization’s processes, policies, documents, records, practices and acts with a view of assessing compliance with one or more sets of laws regulations to which the organization is subject”.

What stands out from the definition of a legal compliance audit?

A legal audit is systematic, objective, impartial and evidence-based.

• A legal compliance audit is systematic because it follows a fixed plan and is done in an efficient and methodical way.
• It is objective & impartial because it relates to actual facts as opposed to thoughts, feelings or bias, it does not favour one side or the other.
• Lastly, a legal audit is evidence based because the auditor’s findings have to be supported or grounded in something tangible-evidence. The audit evidence could include internal documents, policies, procedures, logs, emails, contracts and this evidence is used by an auditor to assess how well an organization is adhering to the laws, regulations, policies, standards and systems. The evidence is what will either support an organization’s claim of being compliant or disapprove this claim.

What are the objects of a legal compliance audit?

The aim or purpose of a legal compliance audit is to assess whether or not an organization is complying with the Constitution, statutory laws, international laws & regulations as applicable to it and internal rules and policies of the organization. Thus, the objectives of a legal audit can broadly be summarized as:

• Prevention (legal risk management)-one will often find in the public or private sector that the reason for downfall of organizations can easily be traced to some form on non-compliance with laws, regulations, policies or best practices. It is therefore important for any organization keen on minimizing legal risk to undertake a legal compliance audit in order to prevent contravention of laws, regulations or policies that may impact the performance of an organization.
• Fault-finding. A legal compliance audit may uncover intentional or unintentional deficiencies. This is in appreciation of the fact that there are many ever-changing laws, regulations or policies that an organization must comply with.
• Punishment -certain laws, regulations or policies have a penalty attached where there is none compliance. The non-compliance could also be an offence with a penalty attached.

Fault-finding and punishment are however not the main objectives of a legal compliance audit, the main objective is:

• To assess the overall effectiveness of an organization’s compliance practices;
• To ensure, at all times the organization complies with the spirit and letter of the Constitution;
• To ensure that an organization’s policies, institutional framework, administrative procedures effectively support implementation of the Constitution;
• To ensure that laws, rules, regulations, codes and standards which are applicable to the organization are identified, documented and observed; and
• To improve an organization’s efficiency in the business environment.

Is there a legal basis for a legal compliance audit?

• Unlike a financial audit which is anchored in Article 229 (4) of the Constitution, section 68 (2) (k) of the Public Finance Management Act, section 14 of the Public Audit Act, section 14 (3) of the States Corporations Act and section 709 (1) of the Companies Act, legal compliance audits are not an express requirement under the laws of Kenya.
• However, the Code of Governance for State Corporations (Mwongozo 2015) which applies to everyone in State Corporations in Kenya-that is every board member, employee and also to contract staff, requires under clause 8.4 (a) that a comprehensive and independent legal audit be carried out at least once every two (2) years.
• Mwongozo was issued as a Regulation under section 30 of the State Corporations Act pursuant to an Executive Order (Executive Order No. 7 of 2015) by the Former President of the Republic of Kenya, Hon. Uhuru Kenyatta. Section 30 of the States Corporations Act provides “The President may make regulations generally for the better carrying into effect of the provisions of this Act and the powers conferred by this section may be assigned in accordance with…. the Constitution.”
• The Capital Markets Authority pursuant to the powers granted under section 11 (3) (v) of the Capital Markets Act (Cap. 485A) issued the Code of Corporate Governance Practices for Issuers of Securities to the Public, 2015. Clause 2.10 of this Code requires a board of a listed company to subject the company to a legal audit.
• The basis for a legal compliance audit is local/regional/international laws & regulations, business related framework and regulations and an organization’s policies, procedures and processes.

What are compliance obligations and where do there arise from?

According to ISO 14001:2015, compliance obligations are legal requirements that an organization must comply with and other requirements that an organization has to, or chooses to comply with.  Compliance obligations can arise from mandatory requirements, such as applicable laws and regulations, or voluntary commitments, such as organizational and industry standards, contractual relationships, codes of practice

Organizations have various legal duties (obligations) that they should comply with. These legal duties may vary depending on the nature of the organization i.e. whether a public or private entity.

Why should an organization carry out a legal compliance audit?

Does your organization want:

• To be up to date with the ever-changing legal terrain including the Constitution, statutory laws, amendments and repeal of laws, new enactments which affect legal rights and obligations, decisions of the courts?
• To keep up with advances worldwide (best practices)?
• To maximize its productivity?
• To align with new business prospects e.g. endeavor into a new product or service and wants to ascertain the legal requirements?
• To do away with outdated systems, standards & procedures?
• An in-depth examination of the legal and regulatory environment in order to be conscious of the obligations incumbent upon it?
• To update its registration records, licences or other requirements in conformity with the laws?
• To identity weaknesses in its internal policies and procedures, standards & systems for the purpose of taking steps to redress them?
• To pre-empt litigious proceedings and save on the related legal expenses?To avoid criminal prosecution of its management and senior staff?

If your answer to all or some of the questions above is ‘YES’, then you know ‘WHY’ your organization should carry out a legal compliance audit.

Who carries out a legal compliance audit?

A legal compliance audit can be an internal audit or an independent audit. An internal audit is carried out by an organization’s personnel while an independent audit is carried out by an outsider or a person not connected with the organization being audited.

What is required of the auditor?

When carrying out a legal compliance audit, the auditor will examine and interrogate an organization’s policies, operations, practices, activities and documents to determine whether the organization is compliant with the existing laws, regulations and policies.

Ultimately the auditor will seek to:

• Identify what an organization is required to comply with;
• Examine what the organization is actually doing/does;
• Identify the legal risks of non-compliance
• Review laws, regulations and policies; and
• Propose reforms/make improvement recommendations to the organization.

Please contact us on legal@gerivia.co.ke if you would like to conduct a legal compliance audit of your organization.

HKM Associates, Advocates is a cutting-edge full-service law firm that is client oriented with a view to providing innovative legal solutions to clients’ complex legal and business issues across diverse and specialized practice areas. The firm’s Head Office is situated in the heart of Westlands and staffed with a vibrant team committed to ensuring delivery of quality legal services to our clients while maintaining professionalism and dignity to both our clients and the profession.

HKM Associates has a reputation of offering reliable legal advice to businesses and individuals that are grounded and creative to fulfil and exceed client needs. The firm believes in adapting to the changing legal landscape in Kenya and beyond thus continues to respond where necessary to improve service delivery. This is why the firm opened Meru Office as part of expanding its footprint and bring its legal services near where clients need them.

Practice areas

The firm’s practice areas of focus are: – Conveyancing and Real Estate Law, Corporate Law and Commercial Transactions, Company Secretarial Services, Banking and Securities Law, Family Law and Succession, Civil Litigation, Intellectual Property Law and Arbitration and Dispute Resolution.

Conveyancing and Real Estate Law

HKM continues to adapt to the new developments to enable them provide unrivalled real-estate solutions including but not limited to;

• Negotiating agreements for clients;
• Preparing Long and Short-Term Leases;
• Drafting of Tenancy Agreements, Transfer Instruments, Licenses, Cautions, Prohibitions, Restrictions, Easements and Powers of Attorney;
• Drafting of Charges, Discharges, Replacement Charges and Mortgages as well as perfecting of securities;
• Sub-Division, Amalgamation, Change and extension of Use over properties;
• Preparation and Interpretation of Construction Service Level Agreements;
• Procuring payments of Land Rates and Rents clearances on behalf of clients;
• Applying for and obtaining on behalf of our clients Various Consents and development Approvals from the National government, County governments, Land Control Board, Kenya Railways Corporation and Kenya Airports Authority as required under the Law;
• Regularly updating Clients on Changes in Land Laws and Procedures;
• Transmission of properties from administrators to beneficiaries;
• Conversion of title numbers issued under the old regime into new title numbers in accordance with the new Government directives;
• Preparation of Extension and renewal of Leases.

Corporate Law and Commercial Transactions

At HKM, they aspire to be part of Kenya’s as well as Africa’s development by aiding in the facilitation of commercial transactions. The firm is comprised of a highly skilled and trained advocates who possess expansive expertise in negotiations and drafting of commercial agreements in accordance with Kenyan laws and International regulations. The firm is fully equipped to meet the following commercial needs of local, regional and international companies: –

• Preparation and Interpretation of Commercial Agreements such as Royalty Agreements, Equipment Leasing Agreements, Service Level Agreements and Hire Purchase Agreements;
• Drafting of Supply and/or Sale of Goods Contracts;
• Mergers, Acquisitions and Corporate Restructuring;
• Drafting Joint Venture Agreements;
• Advising Clients on Tax and Labour Laws;
• Preparation of Employment Service Agreements, Contracts of Employment and Termination Letters;
• Preparation of Trust Deeds;
• Preparation of powers of attorney to manage personal affairs and property;
• Immigration Legal Services;
• Company Secretarial Services
• Intellectual Property Services.

Litigation and Alternative Dispute Resolution

The firm offers comprehensive dispute resolution mechanisms such as ADR or negotiation alive to the fact that court litigation is often costly and time consuming. The firm has a very proficient litigation team is devoted to providing legal advisory and representation on matters before courts, tribunals, and statutory bodies with a commitment to finding swift, innovative, and cost-effective solutions to our clients in matters of;

• Civil and Commercial Litigation;
• Debt Management;
• Land and Environment Disputes;
• Employment and Labour Disputes;
• Family Law and Succession;
• Intellectual Property Disputes;
• Enforcement and Appeals;
• Judicial Reviews; and
• Constitutional Petitions.

The Data Protection Act of 2019 (DPA) is an extensive legislation that regulates the collection, processing and storage of personal data by the private and government sector. This summary outlines the key features, including obligations of data controllers and processors and mandatory registration and renewal.

Data controller refers to an entity or individual that determines the purpose and means of processing of personal data. If your company or organisation determines the ‘why’ and ‘how’ of personal data processing, it is the data controller. A data processor is an entity or individual which processes personal data on behalf of the data controller.

Obligations of Data Controllers and Data Processors

Data controllers and processors have specific obligations under the law. Personal data processed for a lawful purpose must only be kept for as long as reasonably necessary. and regularly review the data held, deleting or anonymizing it when no longer needed. Data subjects can request anonymous or pseudonymous processing of their data, particularly to enhance privacy or avoid direct marketing. The purpose and method must be determined when sharing personal data with other controllers, processors, or third parties.

Controllers and processors are also required to develop, publish, and update a data protection policy detailing their personal data handling practices. This policy should cover aspects such as types of personal data collected, access rights for data subjects, complaint handling mechanisms, lawful processing purposes, and data transfer requirements. Written contracts between controllers and processors must include key safeguards, and processors must obtain authorization before engaging third parties for data processing. Data related to state strategic interests must be processed or stored on servers located in Kenya.

Registration

To register as a data controller or processor, entities must submit form DPR 1, including but not limited to details about the personal data processed and the purpose for processing these data, data subject categories, contact information, and descriptions of risks and safeguards.

Additionally, the application must be accompanied by a copy of the establishment documents or proof of registration (such as CR12, partnership deed or copy of an ID of individuals required to register).

The registration fees are categorized based on the size of the data controller or processor. Micro and small entities with annual revenue up to Kshs. 5 million and 1 to 50 employees are required to pay Kshs. 4,000. Medium entities with revenue between Kshs. 5 million and Kshs. 50 million and 51 to 99 employees pay Kshs. 16,000. Large entities with revenue over Kshs. 50 million and more than 99 employees pay Kshs. 40,000. Public entities, charities, and religious organizations pay Kshs. 4,000 regardless of size.

Individuals or entities that act as both data controllers and data processors are required to submit two separate applications (which will also incur two separate fees).

Penalty for non-registration:

The DPA provides that a data controller or processor who fails to comply with the registration requirements commits an offence. The penalty for this offence is a fine not exceeding Kshs 3,000,000 (about US$23,000) or imprisonment for a term not exceeding ten years, or both.

License and Renewal

Registration certificates are valid for 24 months from the date of issuance and must be renewed at least 30 days before expiration. The renewal fees are Kshs. 2,000 for micro and small entities, Kshs. 9,000 for medium entities, and Kshs. 25,000 for large entities. Public entities, charities, and religious organizations are required to pay Kshs. 2,000 for renewal.