The briefing is the risk

Briefing the board and audit committee during a live fraud investigation, in Indonesia's palm-oil sector.

When a serious fraud surfaces inside a company, the instinct of a good board is to act. Call the executives in, put the evidence on the table, confront the person the finger points at, and be seen to have moved decisively. It feels like leadership, and in most places it does little harm.

In Indonesia's palm-oil sector it is close to the worst thing a board can do. Confronting a suspect before the evidence is secured gives the documents time to vanish. Briefing the full board when one of its members is implicated passes information to the subject of the inquiry.

The real risk in a live fraud investigation is not the fraud. The fraud is an event, often containable. The risk is the governance response: who is told, in what order, on whose advice, and how fast.

Since 2 January 2026 the stakes have changed in kind. The company itself can be prosecuted under the new Criminal Code (Law 1/2023), and the corporation's cooperation in handling the offence is a sentencing factor (KUHP Article 56). The briefing is no longer only how the board learns what happened. It is part of the record a court can weigh. The subject here is the meeting, not the crime.

Five mistakes, ranked by how badly they bite

When fraud surfaces at an Indonesian palm-oil company, the danger is rarely the fraud. It is how the board is briefed about it. These are the five ways boards get that briefing wrong, worst first.

1. Briefing the full board when a director is implicated. The highest-severity error under Indonesia's two-tier board structure, because it passes information to the subject of the inquiry. The audit committee, which a listed company's board of commissioners establishes under POJK 55/POJK.04/2015, is usually the correct first recipient, and getting this wrong at the outset is very hard to undo.

2. Confronting the suspect before securing the evidence. The decisive-looking move that ends the case. Devices, servers and documents are preserved before anyone is put on notice; the confrontation, if it comes at all, comes last, not first.

3. Mishandling Indonesia's two-day disclosure clock. For a listed company, material litigation and any auditor change must be reported to the regulator, OJK, by the end of the second business day (POJK 31/POJK.04/2015). Under-disclosure is a separate breach of POJK 31/2015; early disclosure of an immature probe names individuals publicly and can move the share price.

4. Assuming privilege protects the forensic file. In Indonesia it may not. An advocate's duty of confidentiality rests on the Advocates Law (Law 18/2003, Article 19) rather than a robust evidentiary privilege, and law-firm guidance (Baker McKenzie) notes that it can yield to anti-corruption, anti-money-laundering and tax laws. Practitioners structure such work through external Indonesian advocates and treat the file as potentially readable by a prosecutor.

5. Treating it as an audit finding, and not documenting the response. A live investigation is adversarial and time-critical from the first hour, not a management-response cycle. Because the corporation's cooperation in handling the offence is a sentencing factor (KUHP Article 56), a decision taken verbally and left unminuted leaves no record of that cooperation.

The fraud is the event; the briefing is the risk

The reframing comes first, because everything follows from it. A fraud inside a palm-oil group, a misclassified export cargo, an overstated plantation valuation, a redirected supplier payment, has a known shape and a bounded cost. What decides whether it stays that size is the sequence of governance decisions taken in the hours after it surfaces: they preserve or destroy privilege, trigger or defer a disclosure duty, and shield or expose the directors in the room. None is about the fraud itself.

This is not how most boards treat it. The reflex is to handle fraud as an accounting or personnel matter, escalated through management and resolved with a confrontation and a dismissal. In Indonesia that misreads the terrain on every axis: it routes sensitive information through the people who may be implicated, acts before evidence is locked down, and treats a matter that may already be criminal as internal. The subject here is the meeting, not the misconduct.

Who is told first can pass information to a suspect

Indonesia does not use a single unitary board. Companies run a two-tier structure: an executive board of directors that manages, and a supervisory board of commissioners that oversees it. A listed company's audit committee is established by, and reports to, the board of commissioners (POJK 55/POJK.04/2015). That architecture, easy to treat as a formality in normal times, becomes the most important feature of a fraud briefing the moment the conduct touches management.

The reason is blunt. If a director may be within the scope of the allegation, briefing the full board first means briefing a potential suspect, who can then move evidence, align stories or apply pressure before the inquiry has secured anything.

The audit committee, because it reports to the commissioners rather than the executives it is examining, can supervise an investigation at arm's length from implicated management. It is usually the correct first door and the full board the wrong one.

The discipline that follows is to treat the distribution list as a control, not a courtesy. Findings are held to the audit committee and named investigators, not circulated to line management to build consensus.

The briefing: defensible standard vs the common failure

Dimension	Defensible standard	Common failure
Who is told	Held to the audit committee and named investigators	Circulated to line management, including possible suspects
Sequence	Evidence secured before anyone is confronted	Suspect confronted first, evidence then destroyed
Disclosure	Materiality assessed against a defined trigger	Silence until a leak, or panic disclosure
Record	Every decision minuted with its rationale	Verbal decisions, no audit trail
Privilege	External counsel instructs the forensic work	Internal email trail, later discoverable

Note. The table sets the defensible standard against the common failure for each dimension. Each failure listed is a decision taken for a good reason under pressure.

The instinct that destroys the case

Indonesian law-firm guidance (Kusuma Law Firm) describes a recurring failure pattern: companies act too late, confront suspects before securing evidence, or file a police report with no strategy behind it. Each is a briefing failure before it is an investigative one. A board briefed loosely, or one that authorises an early confrontation, is the mechanism by which documents are destroyed and stories coordinated. The confrontation feels like progress and is the thing that ends the case.

The moves that preserve options are narrow and mostly protective. The opening steps practitioners describe are securing devices and records, instructing forensic work through external counsel, identifying the disclosure trigger and excluding any director within scope. The first briefing is about control, not conclusions.

The value of that restraint has risen, because the response is now assessed after the fact. A board that preserved evidence and instructed counsel before confronting anyone has a defensible record. One that called the meeting, named the suspect and demanded an explanation has damaged both the investigation and its own account of how it behaved.

The first 24 hours: who leads and the critical opening call

How it arrives	Who leads first	The critical opening call
Dawn raid by prosecutors	Audit committee chair and external counsel	Instruct counsel before engaging investigators
Whistleblower tip	Audit committee chair	Restrict knowledge; do not tip the subject
Lender finds collateral gap	Board and counsel	Whether to self-report
Redirected supplier payment	CFO and digital forensics	Bank recall within hours
Listed-group disclosure trigger	Board and corporate secretary	What is material, against the two-day clock

Note. The trigger changes; the opening moves barely do. Whoever chairs the response is deciding, in the first day and often before the facts are in, who leads, what evidence to lock down, and whether to instruct counsel, and those calls are harder to reverse than any that follow.

A clock is running before the facts are in

For any group listed on the Indonesia Stock Exchange, a fraud investigation is not a private matter. Material information, including material litigation against the company or its directors and commissioners, and any replacement of the auditing accountant, must be reported to the regulator and announced publicly no later than the end of the second business day after the event (POJK 31/POJK.04/2015, Articles 2(3), 6(p) and 6(q)). The board briefing is often the moment materiality has to be assessed, which locks the timing of the briefing and the disclosure decision together.

That duty collides with the investigative need for confidentiality. The board wants the facts before it speaks; the rule imposes a short fixed deadline once an event crosses the materiality line. Under-disclosure is a separate breach of POJK 31/2015; early disclosure of an immature probe names individuals publicly and can move the share price. A materiality test agreed before a crisis removes the need to set one inside the two-day window.

The compressed clock is also what makes the jurisdiction harder than its peers. The negotiated resolutions a multinational board expects to reach for, plea agreements and deferred prosecution, arrived in Indonesia only with the new Criminal Procedure Code (KUHAP, Law 20/2025) on 2 January 2026 and remain largely untested, so a route that looks familiar on paper cannot yet be modelled with confidence.

Resolving a corporate case: Indonesia against its peers

Jurisdiction	Corporate settlement route	Disclosure clock, listed firms
Indonesia	Plea-bargain and deferred-prosecution concepts from Jan 2026, untested	Material litigation to OJK by the end of the 2nd business day
Malaysia	Corporate offence under section 17A of the MACC Act 2009, with an adequate-procedures defence	Bursa Malaysia continuous disclosure
UK / US	Mature regimes with published codes and precedent	Established market-disclosure rules

Note. A board used to English or American practice expects to model a negotiated outcome against known precedent. Indonesia's settlement machinery arrived only in January 2026 and is largely untested, so a route that looks familiar on paper is, in practice, a possibility rather than a plan.

The privilege boards assume, and do not have

Boards used to English or American practice assume that hiring external lawyers wraps an investigation in privilege, so the forensic work can proceed candidly behind a legal shield. In Indonesia that assumption is unsafe. Confidentiality rests on the advocate's statutory duty (Advocates Law, Law 18/2003, Article 19) rather than a robust evidentiary privilege, and law-firm guidance (Baker McKenzie) notes that it can yield to the anti-corruption, anti-money-laundering and tax laws. Those are precisely the laws in play in a palm-oil fraud.

The same guidance identifies three further limits. In-house counsel are weakly protected, their communications generally not privileged at all. There is no discovery-style protection for work product. And there is no common-interest doctrine, so sharing findings with a co-defendant or a lender does not keep them confidential.

External counsel's role in this setting is to structure how findings are recorded, held and shared. The common mistake is to assume the shield exists and to write as if it does.

The sector is already under enforcement

None of this happens on neutral ground. A palm-oil board is briefed inside a sector in which the state actively pursues recovery of what it counts as state losses.

The recovered sums are not theoretical. When a matter is framed as corruption rather than ordinary commercial fraud, the state pursues compensation for state losses. In the CPO export-permit case, the Supreme Court ordered five Wilmar subsidiaries to pay Rp 11.9 trillion in compensation for state losses (Wilmar SGX announcement, 26 September 2025).

An investigation therefore does not begin from a blank page. It begins inside a sector under active enforcement at national and provincial level, so a company with estates across several provinces can face more than one prosecutor at once.

Why the fraud survives the audit

A recurring question from directors is how a large fraud sat undetected through routine assurance. The answer is usually that it lives exactly where documents and physical reality diverge, and document-only assurance cannot see it. In one export-financing case heard in the Jakarta corruption court, a state forensic auditor testified that the planted area found on the ground was a fraction of what had been pledged as security.

It defeats a first-pass audit because every document is plausible. The valuation exists, the title exists, the appraisal is signed. The gap only appears when someone walks the plantation and measures it against the map.

For the briefing this has a direct implication. An audit committee briefed only on documents is shown the half of the picture the fraud was designed to survive. The controls that catch these schemes are physical: independent verification of every hectare pledged, and a segregated sign-off on export classification.

The response is now part of the defence

The legal ground shifted when a new Criminal Code (Law 1/2023), a new Criminal Procedure Code (Law 20/2025) and Law 1/2026 on criminal penalty adjustment took effect on 2 January 2026. The company itself, not only the individuals who acted, can now be prosecuted, and liability can reach management, controllers and beneficial owners under KUHP Articles 46 and 47. A court may add a fine of up to 10 per cent of annual profit where the statutory maximum is insufficient, which for a large producer links potential exposure to the size of the business as well as the size of the fraud.

The counterweight is that the corporation's cooperation in handling the offence is a sentencing factor (KUHP Article 56). How the board minutes its decisions, and the rationale it records for each, becomes evidence.

And then it gets personal

The most under-priced consequence of a live investigation is that it reaches the people in the room. Directors and commissioners are personally accountable for losses flowing from a failure to meet their obligations (Company Law, Law 40/2007, Articles 97(3) and 114(3)), and exposure sharpens where bad faith is alleged, so a director who interferes with an inquiry converts a corporate problem into a personal one.

Beyond liability the machinery is physical: an exit ban can be placed on a director at a prosecutor's request, renewable within limits set by the Constitutional Court, and homes as well as offices are searched.

Directors' and officers' insurance is real protection, but only for the honest director caught in the response. A standard policy can fund defence costs during a government investigation, including for someone ultimately cleared, but it excludes claims once fraud is proven and does not touch the corporate fines or restitution.

What a live investigation triggers, on six fronts at once

Channel	What the investigation triggers
Financial	Asset seizure, corporate fines and compensation for state losses
Legal	Corporate criminal liability, extending to those who control the corporation under KUHP Articles 46 and 47
Regulatory	Disclosure to OJK by the end of the second business day
Operational	Document and device seizure; supplier and export freeze
Insurance	D&O funds defence but excludes proven fraud, fines and restitution
Personal	Exit bans and detention for named individuals

Note. The cost of the fraud and the cost of the response to it are two different budgets, and the second can reach the directors personally.

What it comes down to

The fraud is usually survivable. What decides whether it stays contained or becomes existential is the governance around it, almost entirely within the board's control in the first hours. The outcome turns on which body is briefed, whether evidence is secured before any confrontation, how forensic work is structured, how the disclosure clock is assessed and whether decisions are minuted.

None of that is the instinct of a board that wants to look decisive, which is why it has to be a discipline rather than a reflex. The decisive-looking meeting, the one that calls everyone in and demands answers, is the one that loses privilege, tips the suspect and starts the disclosure clock in the worst possible way.

The governance questions are who is told, in what order, on whose advice, and what the minutes record.

Drawn from TheRiskAgent's risk briefing on briefing a board during a live fraud investigation in Indonesian palm oil (August 2026). Figures were checked against the issuing official sources in October 2026. Reference material, not advice.