Introduction: The Deal That Should Have Been Caught
A foreign company acquired a local IT firm.
The buyer followed the process. They engaged one of Kenya’s most reputable accounting firms. The audited accounts were clean. The deal closed.
Months later, the buyer discovered the company was largely a shell. No meaningful operations. No sustainable revenue. The money was gone.
The question that follows is not whether the auditors were incompetent. The question is: why did due diligence not catch this?
Because due diligence is supposed to be the deeper investigation. It is supposed to look beyond the financial statements. It is supposed to answer the question the buyer actually needs answered: is this business what it appears to be, and what is it truly worth?
When a shell company survives due diligence, the problem is not the audit. The problem is that the due diligence was not deep enough.
This article is about due diligence — what it is for, where it falls short, and what it must cover if it is to protect investors and produce a valuation they can rely on.
What Due Diligence Is For
Due diligence is an investigation. Its purpose is to establish, with evidence, the truth about a business before capital is committed.
For valuation purposes, due diligence must answer three questions.
First, are the historical financials reliable? Can the reported revenue, costs, and profits be independently verified?
Second, are the earnings sustainable? What is the run-rate profit that a buyer should actually pay for?
Third, what is the true risk profile? What hidden liabilities, contingent exposures, or integrity issues could affect future cash flows?
An audit does not answer these questions. It was never designed to. The audit asks whether the financial statements are fairly presented. Due diligence asks whether the business is real, whether the numbers can be trusted, and what it is worth.
These are different exercises with different scopes, different timeframes, and different objectives.
Why Due Diligence Often Falls Short
If due diligence is supposed to be the deeper investigation, why does it so often miss the problems that later destroy value?
The first reason is that it is scoped too narrowly. Too many due diligence exercises are essentially a re-read of the audited accounts with a few questions attached. The scope is limited to financial review, and the financial review is limited to what the auditor already looked at.
Deloitte notes that financial due diligence provides a thorough analysis of a target company’s financial health, its historical operating performance, and its potential for future growth. It serves as a diagnostic tool that helps buyers and investors identify the true value of a company and detect potential risks. That is the standard. Too often, the practice falls short.
The second reason is that it relies on the same evidence the audit relied on. If due diligence relies on management representations, management-prepared schedules, and the same documents the auditor reviewed, it inherits the same limitations. It does not independently verify. It does not test. It does not challenge.
A due diligence exercise that asks management for explanations and accepts them is not due diligence. It is a conversation.
The third reason is that it is rushed. Due diligence is often compressed into a few days or weeks. In that time, there is limited opportunity to contact customers, trace cash, visit sites, or investigate red flags. The result is a superficial review that gives comfort without giving assurance.
The fourth reason is that it does not test the quality of earnings. At the heart of valuation due diligence is the quality of earnings analysis. This is a structured analysis of the sustainability and reliability of a company’s earnings, with a focus on the income statement and the adjustments required to arrive at a run-rate view of profitability that a buyer can underwrite.
A due diligence exercise that does not normalise earnings — stripping out one-off gains, related-party favours, and non-recurring items — is not a valuation-grade exercise. It is a review of reported numbers.
The fifth reason is that it stops at the financial statements. Due diligence must go beyond the numbers. It must test the operations, the people, the legal position, the market, and the integrity of the sellers. A financial-only review will miss the shell company, the hidden liability, and the key-person risk.
Why the Audit Cannot Fill This Gap
It is worth understanding why due diligence cannot simply rely on the audit, because the two are often confused.
An audit is designed to give an opinion on financial statements. It tests transactions, confirms balances, and challenges management. It is rigorous within its scope.
But its scope has limits.
Confirmation can be defeated by collusion. If a company invents customers or uses related parties to create fake sales, the “customer” receiving the confirmation may simply confirm the balance. ISA 505 recognises that all confirmation responses carry some risk of interception, alteration, or fraud.
Confirmation is sample-based. Auditors do not contact every customer. Accounts below the sampling threshold may never be independently verified.
And the purpose is different. The audit asks whether the financial statements are fairly presented. It does not ask whether the business will continue to generate those earnings under new ownership.
The IAASB itself has acknowledged that the lack of well-executed external confirmation procedures has been highlighted in some high-profile financial reporting frauds. The standard-setter is not pretending the gap does not exist.
But the answer to that gap is not to demand more from the audit. The answer is to recognise that due diligence is a separate discipline with a separate purpose — and to resource it accordingly.
The Kenyan Context: Cases That Should Have Been Caught
Kenya has seen corporate failures that raise uncomfortable questions about the depth of due diligence performed before investment.
The Uchumi Supermarkets Rights Issue
In 2014, Jamii Bora Bank acquired a significant stake in Uchumi Supermarkets. The bank’s management later told shareholders they were duped into buying the shares. Chief executive Samuel Kimani said the information memorandum used to entice the tier-II lender into the Sh500 million acquisition did not show the true position of the retail chain.
Jamii Bora Bank sued Ernst & Young, claiming millions in losses from buying Uchumi shares on the strength of a report produced by the audit firm. Ernst & Young argued that the information memorandum and the accountant’s report did not recommend the purchase, and that each investor had a duty to carry out due diligence before participating.
The case makes a critical point: relying on a third party’s report without independent verification is not due diligence. It is delegation.
The Chase Bank Bond Issue
In 2015, Chase Bank Kenya issued a Sh10 billion Medium-Term Note. The Capital Markets Authority later found that former chairperson Zafrullah Khan failed to provide effective board oversight and approved financial statements that misrepresented the bank’s position.
The CMA imposed fines and multi-year disqualifications on former Chase Bank managers after finding they misled bond investors through inaccurate financials and withheld material information tied to the bank’s 2015 medium-term note.
Deloitte was fined KES 10 million for failing to detect errors contained in financial statements presented for audit.
The Chase Bank case shows that even when audits are performed, material misstatements can go undetected. And when they do, the consequences fall on investors who trusted the audited accounts.
The KUSCCO Forensic Audit
A forensic audit of the Kenya Union of Savings and Credit Cooperatives (KUSCCO) uncovered an estimated KES 12 billion financial hole. The audit, by PricewaterhouseCoopers, revealed that by December 2023, KUSCCO had accumulated non-performing loans of Sh5.3 billion.
The audit revealed systemic issues, including falsified financial statements, fund diversion, and non-viable investments that masked KUSCCO’s insolvency.
KUSCCO was a member-based organisation. Its members relied on audited accounts and management representations. The forensic audit was only commissioned in October 2023 — after the damage was done.
The Rivatex Deal
An audit by the Auditor General exposed how Moi University was sidelined in a Sh2.6 billion Rivatex deal. The lease arrangement introduced uncertainty over the company’s future because key legal and regulatory processes had not been concluded during the audit period. No detailed documentation was provided to corroborate or clarify the full terms of the deal.
The lack of documentation prevented auditors from determining the full impact of the deal on the company’s future operations, financial reporting, and going-concern status.
The Horizon Hills Shell Company
In a case that reads almost exactly like the IT shell story, the Kenyan courts dealt with a company called Horizon Hills Limited (C.110776). The court found that this entity “was not a legitimate incorporation but a fraudulent contrivance intended to secure and transfer the suit property to unsuspecting third parties”.
The fraud involved reconstruction of a company file using unverified documents, falsifying company records, and cancelling legitimate entries including a caveat. A director of one of the companies involved denied ever purchasing shares, saying the alleged sale was fictitious.
The Horizon Hills case is a textbook example of what happens when due diligence stops at the paperwork. The company existed on paper. The file looked complete. But the entire structure was a sham.
The National Oil Insolvency
By the end of the 2023/24 financial year, National Oil was in technical insolvency, with liabilities KES 11.6 billion higher than its assets.
This is a state corporation. It had auditors. It had oversight. And yet it was technically insolvent for years before the situation was formally recognised.
The Lesson Across All Cases
In every one of these cases, the pattern is the same:
The numbers were presented. The audit was performed. The opinion was issued. And the problems were missed.
None of this means the auditors were incompetent. It means the audit was never designed to answer the questions that mattered.
What Valuation-Grade Due Diligence Must Cover
If due diligence is to protect investors and support a reliable valuation, it must go deeper than the audit.
Financial Due Diligence
Revenue verification means contacting top customers independently, matching invoices to bank receipts, and reviewing credit notes and returns. It is not enough to accept a schedule from management.
Cash tracing means obtaining bank statements directly from the banks, reconciling them to sales and purchases, and looking for round-tripping. Money that moves in circles between connected companies can make sales look bigger than they are.
Related-party transactions must be mapped comprehensively. This means identifying all directors, shareholders, and their other entities, and reviewing every transaction with them. If the director’s cousin owns the main supplier and charges double the market rate, that is a cost that will rise after the sale.
Receivables require ageing analysis, confirmation with debtors, and review of subsequent receipts. A receivable that never gets paid is not an asset. It is a write-off waiting to happen.
Payables must be confirmed with suppliers. Undisclosed liabilities are one of the most common surprises in acquisitions.
Inventory requires physical counting, valuation review, and identification of slow-moving stock. Inventory that does not exist, or cannot be sold, is not worth what the balance sheet says.
Fixed assets must be physically verified. Ownership documents must be checked. Encumbrances must be identified. An asset that is pledged to a lender is not available to the business.
Tax compliance requires a review of KRA filings, assessments, disputes, and pending audits. Unpaid payroll taxes, VAT disputes, and misclassified contractors can become the buyer’s problem after closing.
Payroll must be tested for ghost employees, statutory deductions, and PAYE compliance.
Loans and guarantees must be searched for diligently. Board minutes should be reviewed for guarantees that never made it to the balance sheet.
Quality of Earnings
The quality of earnings analysis is where due diligence meets valuation. It is not an audit. It answers a different question: what earnings level should we pay for, and how risky is that earnings base?
This means normalising EBITDA for non-recurring items. It means adjusting for owner compensation and related-party transactions. It means assessing revenue recognition and cut-off. It means identifying aggressive addbacks that are actually recurring costs. And it means establishing the sustainable run-rate earnings base that a buyer can underwrite.
Without this, the valuation is built on reported numbers that may never repeat.
Forensic Due Diligence
Forensic due diligence is designed to find what conventional review misses.
This includes integrity and reputation checks on directors and shareholders. It includes background verification of key management. It includes data analytics to identify anomalies, round-tripping, and unusual transaction patterns. It includes related-party mapping to uncover hidden connections. It includes third-party verification of customers, suppliers, and counterparties. And it includes site visits, including unannounced visits, to verify that operations exist as represented.
As EY notes, forensic professionals experienced at identifying red flags should be called in. Without them, acquirers risk having to explain flawed deals to shareholders and financiers alone.
Legal and Regulatory Due Diligence
Litigation searches must be conducted. Regulatory compliance must be reviewed. Contracts must be examined for change-of-control clauses, exclusivity provisions, and termination rights. Intellectual property must be verified. Corporate structure and beneficial ownership must be established.
A company may look healthy on the numbers while carrying a legal exposure that will destroy value after closing.
Operational and Commercial Due Diligence
Customer concentration and churn must be analysed. Supplier dependence must be assessed. Key-person risk must be evaluated. IT systems and data integrity must be reviewed. Market size and growth claims must be independently verified. Competitive position must be assessed.
Management’s growth story must be stress-tested. If the projections assume 20% annual growth, what evidence supports that? What happens if growth is 10%? What happens if a major customer leaves?
From Findings to Valuation
Due diligence is not just for comfort. It must change the price.
If profits are inflated by one-off gains, they must be stripped out. A KES 5 million adjustment at an 8x multiple is a KES 40 million change in valuation.
Working capital must be adjusted to reflect the normal level required to run the business.
Risk must be adjusted. Where uncertainty is higher, the discount rate should be higher.
Conditions must be set. Certain issues must be resolved before closing.
Protections must be structured. Warranties, indemnities, escrow, earn-outs, and insurance allocate risk between buyer and seller.
As Lexology notes, due diligence influences the negotiation process between buyers and sellers. By uncovering potential risks and inconsistencies, it provides buyers with the information needed to negotiate protections in the contract, such as indemnities, escrow arrangements, and purchase-price adjustments.
Conclusion: Due Diligence Is the Answer, Not the Audit
When a shell company survives due diligence, the failure is not in the audit. The failure is in the due diligence.
An audit provides assurance that financial statements are fairly presented. It does not confirm that the business is real, that the earnings are sustainable, or that the assets exist. It was never designed to.
Due diligence is designed to do those things. It is the deeper investigation. It is the independent verification. It is the exercise that answers the question the buyer actually needs answered: is this business what it appears to be, and what is it truly worth?
Kenya has seen this pattern repeat too many times. Uchumi. Chase Bank. KUSCCO. National Oil. Horizon Hills. In each case, the paperwork looked right. The audit opinion was clean. And the reality was different.
If due diligence is scoped narrowly, rushed, reliant on management representations, and limited to the financial statements, it will miss what matters. And a valuation built on it will be wrong.
The lesson for investors is simple. Insist on due diligence that goes beyond the audit. Ask what was checked. Ask what was verified independently. Ask what red flags were found. Ask what protections are in place.
The lesson for valuation practitioners is equally simple. Your valuation is only as good as the evidence behind it. Due diligence is how that evidence is obtained.
A shell company should never survive competent due diligence.
If it does, the due diligence was not competent.
Sources
- Business Daily Africa, Jamii Bora says Sh500m Uchumi buyout was a con, 12 December 2020
- Business Daily Africa, Jamii Bora Bank sues EY in Sh451m Uchumi shares row, 12 December 2020
- Capital Markets Authority (Kenya) enforcement actions, November 2025
- The Kenyan Wallstreet, CMA Fines and bars Former Chase Bank Executives, 20 November 2025
- The Standard, How Kuscco accumulated Sh5.3 billion bad loans, 9 March 2025
- AllAfrica, Kenya: KUSCCO Audit Reveals Billions Lost in Mismanagement, 15 May 2025
- The Kenyan Wallstreet, National Oil’s KSh 11.6Bn Insolvency Laid Bare In Audit, 8 August 2025
- The Star, Audit exposes how Moi University was sidelined in Sh2.6 billion Rivatex deal, 5 June 2026
- Kenya Law Reports, Williams & Kennedy Limited & 3 others v Gicharu & 10 others [2026] KECA 130 (KLR)
- Deloitte / Lexology, Financial due diligence and its impact on valuation and contractual negotiations, 2025
- EY, How boards can manage integrity risks in M&As and investments
- IAASB, ISA 500 Series Issues Paper, 2025
- International Standard on Auditing (ISA) 505, External Confirmations
- Thomson Reuters Institute, M&A due diligence blind spots, 2026
- Windsor Drake, Quality of Earnings Report: What Founders Need to Know
Disclaimer: This article is for general information and discussion only. It is not legal, financial, or investment advice. Seek independent professional advice before making any business or investment decision.
