Who Tells the Board? Continuous Assurance and the Information Problem in Zambian Boardrooms

Every board in Zambia, whether it governs a state-owned enterprise, or a privately-owned firm rests on a simple promise, that is, those who run the organisation will be held to account by people who do not. Economists have long treated this separation of management from control as the foundation of corporate oversight, and Zambian law gives it force. Under the Companies Act No. 10 of 2017, directors carry statutory duties of care and oversight, and the Act's corporate governance requirements apply to every company incorporated under it.

Yet the question rarely asked is where does the board's knowledge actually come from?

Independent in structure, dependent in knowledge

In most boardrooms the honest answer is, from management. Board packs are assembled, framed and timed by the executive the board is meant to oversee. The executive decides which indicators appear, how they are presented and when unwelcome news arrives. Research on board effectiveness treats this information asymmetry between directors and management as central to how boards function, and theoretical work by Adams and Ferreira shows that executives rationally calibrate how much they share with a board they expect to challenge them.

In developing economies, the gap is wider still. Boards typically meet quarterly, directors serve part-time, and the very performance figures by which management is judged are produced by management. Between meetings, a board knows little beyond what it is told. Zambian evidence points in the same direction. A study of state-owned enterprise governance identified weak supervisory systems and limited capacity as major problems. While locally board research has focused largely on board composition and financial performance less effort has been made on where directors' information originates.

The result is a paradox: a board can be independent on paper, with non-executive majorities and proper committees, yet almost entirely dependent for its evidence on the people it supervises.

Continuous assurance: a feed the board owns

Technology now offers a possible way out. Continuous auditing shifts assurance from periodic, backward-looking review to automated monitoring of transactions and controls as they occur. Pilot implementations described by Alles, Kogan and Vasarhelyi, and later reviewed by Chan and Vasarhelyi, showed that exceptions can be flagged as they arise rather than at year-end.

Most continuous auditing serves management; the novel proposition is to direct it to the board. Drawing on financial and operational systems, a board-directed feed could give non-executives a current reading of cash, control exceptions and key indicators between meetings, a view the executive did not compose. For a parastatal or bank board, that would materially change the quality of oversight.

Why this is not a simple switch

Raw data, however, is not self-interpreting, and four risks deserve attention.

The first is interpretive capacity. A part-time board without its own analysts may read a raw feed worse than a prepared pack. Where misreading is costly, Cynthia Rudin's argument for interpretable rather than black-box models applies with force, i.e., directors must be able to see why an alert activated.

The second is role boundaries. A board with live operational visibility may drift into management, collapsing the separation that gives oversight its meaning.

The third is liability. Once directors possess information, action is expected of them. In some jurisdictions, the United States as an example, the Caremark decision already expects directors to ensure that adequate reporting systems exist. Mark Bovens defines accountability as a relationship in which a forum can question, judge and impose consequences; a board that cannot read its own evidence cannot meaningfully question.

The fourth is pipeline control. If the feed runs on systems the executive configures, dependence survives behind an appearance of independence. Donald Campbell warned decades ago that indicators carrying consequences tend to be managed. Richard Heeks adds a further caution from developing countries: information systems fail most often where design assumptions diverge from local working realities.

What Zambian boards can do now

Zambia already has some of the scaffolding. For public bodies, the Public Finance Management Act No. 1 of 2018 requires ministries, departments and statutory corporations to establish audit committees, with internal auditors reporting to them as well as to the controlling officer. That reporting line is the natural home for a board-directed feed. The weakness lies in capacity. A study of Zambian public-sector internal audit found low technical proficiency and weak organisational independence, conditions in which any new pipeline could be captured or misread.

Boards can act on four fronts. First, ask who configures the data you receive, then commission five to seven indicators drawn from sources management cannot easily reshape such as bank-confirmed balances, payment-system exception logs and unresolved audit findings. Route them through internal audit or an independent provider answering to the audit committee, not the finance function. Second, agree escalation thresholds in advance. A feed that reports everything invites micromanagement. One that alerts the chair only when pre-agreed limits are breached preserves the line between monitoring and managing, which belongs in the board charter. Third, build interpretive capacity through director training and direct access to the head of internal audit. Fourth, take legal advice on what continuous access implies for directors' duties under Zambian law.

The question to this analysis is, can boards in developing economies ever own their evidence, and on what conditions? Until it is answered, board independence remains a matter of structure, not knowledge.
_____________________

**RIS Contributors are researchers and practitioners writing for CCET's Research Intelligence Service; views are the author's own.

Sources

Primary sources

•         Republic of Zambia (2017). Companies Act No. 10 of 2017

•         Republic of Zambia (2018). Public Finance Management Act No. 1 of 2018

•         Chambers and Partners (2024). Corporate Governance 2024: Zambia (practice guide)

•         Court of Chancery of Delaware (1996). In re Caremark International Inc. Derivative Litigation, 698 A.2d 959

Research

•         Adams, R.B. and Ferreira, D. (2007). A theory of friendly boards. The Journal of Finance, 62(1), pp. 217–250

•         Adams, R.B., Hermalin, B.E. and Weisbach, M.S. (2010). The role of boards of directors in corporate governance: A conceptual framework and survey. Journal of Economic Literature, 48(1), pp. 58–107

•         Alles, M.G., Kogan, A. and Vasarhelyi, M.A. (2008). Putting continuous auditing theory into practice: Lessons from two pilot implementations. Journal of Information Systems, 22(2), pp. 195–214 (listed via Rutgers Continuous Auditing papers)

•         Banda, Z. (2019). Corporate governance structures: The performance of Zambian listed companies. Thesis, University of the Free State

•         Bovens, M. (2007). Analysing and assessing accountability: A conceptual framework. European Law Journal, 13(4), pp. 447–468

•         Campbell, D.T. (1979). Assessing the impact of planned social change. Evaluation and Program Planning, 2(1), pp. 67–90

•         Chan, D.Y. and Vasarhelyi, M.A. (2011). Innovation and practice of continuous auditing. International Journal of Accounting Information Systems, 12(2), pp. 152–160

•         Fama, E.F. and Jensen, M.C. (1983). Separation of ownership and control. The Journal of Law and Economics, 26(2), pp. 301–325

•         Heeks, R. (2002). Information systems and developing countries: Failure, success, and local improvisations. The Information Society, 18(2), pp. 101–112

•         Kateshi, M.F. (2014). Governance of state-owned enterprises in Zambia. Master's research report, University of the Witwatersrand

•         Mwanza, O. and Kaira, B. (2022). The effectiveness of internal auditing in the public sector in Zambia. Journal of Accounting, 5(1), pp. 13–33

•         Rudin, C. (2019). Stop explaining black box machine learning models for high-stakes decisions and use interpretable models instead. Nature Machine Intelligence, 1(5), pp. 206–215