84 HR officers linked to Sh6.2 billion payroll fraud sent on forced leave

The government removed 84 human resource officers from their duties for 30 days after a payroll audit pointed to suspected fraud. Public Service Cabinet Secretary Geoffrey Ruku said the officers came from Medical Health, Public Health, Professional Standards, the Kenya Police Service and the Kenya Prisons Service. The action matters because HR officers can help administer payroll records and user access.

The officers are suspected of involvement in suspicious payroll transactions linked to a possible Sh6.2 billion loss. Statements reportedly indicated that some beneficiaries were recruited by colleagues or HR officers. Those beneficiaries then acted as conduits for irregular payments, with some allegedly sending part of the money to recipient accounts.

The relevant principal secretaries and accounting officers were ordered to withdraw the officers' payroll user rights immediately. Replacement HR officers will continue payroll administration in the affected departments. The ministry also expects arrests before the leave period ends, especially within the Kenya Prison Service.

Payroll fraud generally means deliberately manipulating employee-payment records or processes to obtain money without authorization. It can involve invented beneficiaries, inflated payments, unauthorized allowances or diverting funds to other accounts. It matters because payroll systems handle public money, so repeated manipulation can create large losses and undermine trust.

An ordinary payroll error is different because it is accidental. A wrong account number, duplicate entry or incorrect allowance may result from a mistake rather than a plan to steal. The article describes suspected fraud because beneficiaries were allegedly recruited, irregular transactions were processed, and some recipients allegedly remitted proceeds to other accounts. Those details suggest an organized arrangement rather than a simple entry error.

The reported prison-service case illustrates the distinction. A rogue accountant initiated allowance transfers for almost 1,000 officers in one day. Payments ranged from Sh30,000 to Sh140,000, creating an irregular payout of Sh41,346,895. Investigators are examining how the transactions were arranged.

The suspected nationwide payroll fraud was estimated at Sh6.2 billion, according to a February 2025 State payroll audit handed to the Director of Criminal Investigation. That figure represents the possible cost to taxpayers and explains why the government imposed immediate administrative measures. It also shows that the investigation extends beyond one department or one isolated payment.

The prison-service case involved Sh41,346,895, reported in rounded form as Sh41.3 million. A rogue accountant initiated allowance transfers for almost 1,000 officers on December 19, 2025. Individual payments ranged from Sh30,000 to Sh140,000. The money went to officers across ranks, including senior prison leaders, creating immediate red flags.

Using the article's figures, Sh6.2 billion is about 150 times Sh41.3 million. The prison payment therefore represents only a small fraction of the suspected total. It is nevertheless important because it provided a concrete example of how irregular payroll transactions could be processed and distributed.

The reported mechanism began with recruitment. Statements recorded during the ministry's inquiry indicated that some beneficiaries were recruited by colleagues and, in certain cases, by HR officers. The beneficiaries were then allegedly used as conduits through which irregular transactions were processed in the payroll system. This matters because the people receiving money may not have been the final recipients.

The article gives a prison-service example. A rogue accountant logged into the system and initiated allowance transfers for almost 1,000 officers on one day. The transfers ranged from Sh30,000 to Sh140,000. The ministry says some beneficiaries later remitted part of the resulting payments to other recipient accounts, suggesting that money was shared after it entered the payroll system.

Investigators are sampling people whose details appeared in suspicious transaction data and recording statements at county headquarters. The process is ongoing. The government has withdrawn suspected HR officers' payroll rights, while replacement officers administer payroll in affected departments.

When officers are sent on leave and their payroll rights are withdrawn, they can no longer use the affected system accounts to administer or alter payroll. This is an immediate containment step. It limits further access while investigators examine suspicious transactions and record statements from people whose details appeared in the data.

The article says the relevant principal secretaries and accounting officers must withdraw the suspected officers' user rights. It also says the State Department of Public Service and Human Resource Development will deploy HR officers to affected departments. Those replacements will continue administering the payroll, so the operational function is intended to continue despite the suspensions.

The investigation remains active at county headquarters where the identified officers work. The ministry is examining the alleged recruitment of beneficiaries and the movement of proceeds to recipient accounts. Ruku said arrests are expected before the 30-day leave ends, especially in the Kenya Prison Service. The final impact will depend on what investigators establish.

The Director of Criminal Investigation is responsible for a central investigative role in the account given. On July 7, the DCI handed over a February 2025 State payroll audit showing a possible Sh6.2 billion fraud. The Public Service Ministry then began examining suspicious transaction data and recording statements from identified individuals.

Public Service Cabinet Secretary Geoffrey Ruku ordered the 84 officers onto forced leave. He also directed relevant principal secretaries and accounting officers to withdraw their payroll user rights. The State Department of Public Service and Human Resource Development is deploying replacement HR officers to keep payroll administration running. These bodies provide investigation, oversight and operational control.

The inquiry is taking place at county headquarters where the identified officers are deployed. Statements are being used to understand how beneficiaries were recruited and how payments allegedly moved to other accounts. The article also reports expected arrests, particularly in the Kenya Prison Service. It does not identify a separate anti-fraud agency or prosecution body.

As a general safeguard, public payroll systems use separation of duties. Different people should create employee records, approve changes and authorize payments. Access is limited by role, and strong authentication, audit logs and regular reviews help show who changed what. These controls matter because one unchecked account could otherwise create beneficiaries and move money.

A safer process would require independent approval for new employees, allowances and bank-account changes. Payroll records should be matched regularly with authorized staff lists, and unusual patterns should trigger review. Examples include many payments on one day, transfers to senior officers without explanation, or repeated payments with similar amounts. The article's prison case contained several such warning signs, including almost 1,000 transfers in one day.

The article specifically reports that suspected officers' payroll rights were withdrawn and that an audit and interrogation process began. Those are containment and detection steps. It does not list every safeguard used in the system, so the wider controls described here are standard public-payroll practices, not additional facts about this case.