The Ghosts Have Passwords: Jogoo House Headcount Misses 4.7 Million Untimed Payroll EditsThe Ghosts Have Passwords: Jogoo House Headcount Misses 4.7 Million Untimed Payroll Edits

That is the gap this analysis sets out. The government is answering a suspected KSh 6.2B ($47.76M) payroll fraud with the oldest tool it has, counting bodies, while the evidence it has published suggests the problem is who can type into the system and whether anyone can see them do it. Until that changes, the figures suggest, every headcount will clean the payroll for a season and leave the door open behind it.

Jogoo House Headcount Checks Faces, Not Keystrokes

A Ministry of Education memo dated 16 October tells every employee on its payroll, including those on leave or in hospital, to report in person between 19 and 22 October with an original national ID, a KRA PIN certificate and their first and current appointment letters. Staff who do not verify risk having their salaries stopped.

The exercise follows Public Service Cabinet Secretary Geoffrey Ruku's decision to sideline 84 HR officers over the suspected fraud, cutting their access to the payroll system for 30 working days while detectives investigate. No one has been charged, and the losses remain suspected irregularities rather than proven theft.

A headcount answers one question well: does this person exist? It is a good tool against the classic ghost worker, a name on the payroll with nobody behind it. It is a poor tool against a real employee whose pay was quietly raised, whose arrears were inflated or whose deductions went missing, because that person will walk into Jogoo House with a valid ID and pass.

KSh 4.34B in Special Salaries Points to Edits, Not Ghosts

The audit that started this, a joint exercise by the Auditor General and the State Department for Public Service covering 12 of the government's 53 state departments, was handed to the Directorate of Criminal Investigations on 8 July. Its breakdown matters more than its headline.

Of about KSh 5.9B ($45.44M) in irregular earnings it flagged, the largest single item was KSh 4.34B ($33.40M) paid as "special salary". Arrears paid within six months came to KSh 712.6M ($5.49M) and arrears older than six months to KSh 555.1M ($4.28M). Those three items add up to about KSh 5.6B, and the published summaries do not explain the remaining gap.

The figures suggest the bulk of the money flowed through payment categories that someone has to authorise inside the system, not through invented employees. A special salary or a back-dated arrears payment needs a keystroke, an approval and a bank account. Read that way, the leak is a permissions problem dressed up as a ghost-worker problem.

720 Editors, 4.7 Million Changes and No Timestamps

The audit's findings on the Human Resource Information System, the government payroll platform known as HRIS-K, are blunter still. About 720 users altered 4,732,082 payroll records without system-generated timestamps. On Mwenendo's arithmetic, that is an average of roughly 6,572 changes per user, none of them dated by the system itself.

The same audit found 77 employees had edited their own payroll records. It recorded 5,778 staff as posted before their hire date and three employees hired in 2023 with birth years between 2046 and 2049. It flagged shared bank accounts, invalid KRA PINs and multiple IDs.

On security, the system lacked multi-factor authentication (a second check, such as a code sent to a phone, before a user can log in), rate limiting, database logging and monitoring, and had not been tested by outside hackers hired to find weaknesses for more than a year. When records change by the million and the system cannot say when, a detective has to rebuild the timeline from bank statements. That is slow and expensive work.

Kenya Has Promised This Fix Before

None of this is new as a promise. The Cabinet, in its September 2024 despatch, announced a unified personnel identification system "to eradicate 'ghost worker' payroll fraud across all levels of Government".

A month later Treasury Cabinet Secretary John Mbadi said the Ministry of Education, with the biggest wage bill, would be first in line for a payroll overhaul. The new platform was meant to be fully running across state departments by 30 June 2025.

It was not. In May 2026 Ruku gave HR managers two months to finish moving onto the platform. On 30 June the Cabinet ordered every ministry, agency and state corporation to migrate, alongside data cleansing, stronger cybersecurity and a disaster recovery site. Yet by the time the audit reached the DCI, more than 300 state corporations had still not migrated.

The cheapest part of the fix also stalled. The National Treasury asked for KSh 138M ($1.06M) to strengthen the HRIS-K infrastructure, and Parliament did not approve it during the supplementary budget review. That request is about 2.2% of the suspected KSh 6.2B in irregularities found in a sample of fewer than a quarter of state departments.

The KSh 1.29T Wage Bill Is the Real Exposure

The stakes run well beyond 12 departments. The Salaries and Remuneration Commission estimates the public wage bill will reach KSh 1.29T ($9.91B) in 2025/26, covering about 1.07 million public employees. Mwenendo has reported on how the public wage bill is structured and why it crowds out spending on everything else.

Every shilling lost on the payroll is a shilling not spent on a hospital drug order, a road or a pending bill owed to a supplier. It also distorts the argument over taxes: Kenyans are asked to pay more while the government cannot show, line by line, who changed whose pay.

The Public Service Commission has already signalled where it thinks responsibility lies. Its chairperson, Francis Meja, told HR directors in August that its latest compliance report had flagged salaries paid outside the payroll system, and warned: "ensure that you don't just sign off the payroll".

Heads of HR, he said, would be held personally liable for failing to act on Commission decisions.

Three Signals That Would Show the Leak Is Closing

The headcount is not useless. It will catch any ghost names in Education and give investigators a clean list to compare against. But on the evidence the government itself has released, three things would matter more, and readers can track each one.

First, whether every change to a payroll record now carries a timestamp and a named user, and whether that log can be read by the Auditor General without asking the department that made the change. Second, whether the number of people allowed to edit payroll records falls sharply from 720, with two-step logins for all of them. Third, whether the 300-plus state corporations outside the platform are moved on a published date, rather than another deadline that passes in silence.

The DCI has promised periodic updates on its investigation. If the next one reports arrests but no change to who can edit the payroll, the likely outcome is a familiar one: the queue at Jogoo House ends on Thursday, and the keyboard stays open.