ICFR Documentation Service
Document Your Controls. Strengthen Confidence. Achieve Compliance.
Internal Control over Financial Reporting (ICFR) is the framework of controls that ensures the reliability of financial reporting and the preparation of financial statements in accordance with applicable standards. Regulators, investors, and boards increasingly expect organisations to demonstrate that they have designed, implemented, and tested robust controls over financial reporting. Yet many Nigerian organisations lack adequate ICFR documentation, leaving them exposed to material weaknesses, audit findings, and regulatory scrutiny. At Qeeva Advisory, we provide ICFR documentation services that help you document your controls, strengthen confidence, and achieve compliance.
Schedule Your Free Consultation
Why Nigerian Organisations Need ICFR Documentation
ICFR documentation is not merely a compliance exercise—it is the foundation of reliable financial reporting. Here are the most critical challenges we help you address.
Regulatory and Audit Expectations – Regulators, external auditors, and boards increasingly expect organisations to demonstrate that they have designed, implemented, and tested controls over financial reporting. Without adequate documentation, organisations cannot demonstrate that controls exist or that they are effective.
Material Weakness Risk – Without documented controls, organisations risk material weaknesses in financial reporting. Material weaknesses can lead to restatements, regulatory penalties, and loss of investor confidence.
Process Complexity and Fragmentation – As organisations grow, financial reporting processes become more complex and fragmented. Multiple systems, locations, and teams contribute to financial reporting, increasing the risk of errors and inconsistencies.
Key Control Identification – Many organisations do not know which controls are critical to financial reporting reliability. Without identifying key controls, organisations cannot focus testing and monitoring efforts effectively.
Segregation of Duties Gaps – Without documented controls, organisations cannot demonstrate that duties are properly segregated or that compensating controls exist where segregation is not possible.
IT General Controls – Financial reporting increasingly depends on IT systems. IT general controls (ITGCs) over access, change management, and operations are critical to financial reporting reliability, but are often undocumented.
Walkthrough and Testing Requirements – Auditors require walkthroughs and testing of controls. Without documentation, walkthroughs are inefficient and testing cannot be performed effectively.
Fraud Risk and Control Design – Fraud risk assessments inform control design. Without documented fraud risk assessments and controls, organisations are vulnerable to fraud.
The Solution: Professional ICFR Documentation Services
We provide ICFR documentation services that help you document your controls, strengthen confidence, and achieve compliance. Our approach combines deep expertise in internal controls, financial reporting, and regulatory requirements.
At Qeeva Advisory, we understand that ICFR documentation is not just about creating documents—it is about designing effective controls, documenting them clearly, and establishing a framework for ongoing testing and monitoring. Our team brings deep expertise in internal controls, risk management, and financial reporting.
Whether you need ICFR documentation for the first time, remediation of existing documentation, or ongoing control testing and monitoring, we provide the expertise and commitment to help you achieve compliance.
Our Comprehensive ICFR Documentation Services
We offer end-to-end ICFR documentation services tailored to the Nigerian business environment.
ICFR Scoping and Risk Assessment
We help you define the scope of ICFR and identify risks.
ICFR Scoping – We identify the accounts, disclosures, and processes that are significant to financial reporting. We determine which locations, business units, and processes should be included in ICFR scope.
Financial Statement Risk Assessment – We assess risks of material misstatement at the financial statement level and at the assertion level. We identify significant accounts, disclosures, and assertions.
Process Risk Assessment – We identify risks within financial reporting processes, including risks of error, fraud, and non-compliance.
Fraud Risk Assessment – We assess fraud risks related to financial reporting, including management override, revenue recognition, and asset misappropriation.
Risk Prioritisation – We prioritise risks based on likelihood and impact, focusing control efforts on the most significant risks.
Process Documentation
We document your financial reporting processes.
Process Mapping – We map financial reporting processes end-to-end, including inputs, activities, outputs, systems, and roles.
Process Narratives – We document process narratives that describe how processes work, who performs them, and what controls exist.
Flowcharts and Diagrams – We create flowcharts and diagrams that visually represent processes and controls.
Transaction Walkthroughs – We perform walkthroughs to validate our understanding of processes and controls. Walkthroughs confirm that controls exist and are designed effectively.
Role and Responsibility Documentation – We document roles and responsibilities for each process and control, ensuring clear accountability.
System and Application Documentation – We document the systems and applications involved in financial reporting, including their role in the control environment.
Risk and Control Matrices (RCM)
We document risks and controls in a structured format.
Risk and Control Matrix Development – We develop risk and control matrices that link financial statement risks to the controls that address them. RCMs provide a clear, auditable record of how risks are mitigated.
Control Identification – We identify controls that address each risk, including preventive, detective, and corrective controls.
Control Attributes Documentation – We document control attributes, including control owner, frequency, type (manual/automated), and nature (preventive/detective).
Key Control Identification – We identify key controls that are critical to financial reporting reliability. Key controls receive focused testing and monitoring.
Segregation of Duties Documentation – We document segregation of duties and compensating controls where segregation is not possible.
IT General Controls (ITGCs) – We document IT general controls over access, change management, and operations, ensuring they support financial reporting reliability.
Control Design Assessment
We assess whether controls are designed effectively.
Control Design Evaluation – We evaluate whether controls are designed to address the identified risks. We assess whether controls, if operating effectively, would prevent or detect material misstatements.
Control Gap Identification – We identify control gaps where risks are not adequately addressed. We recommend additional controls or enhancements.
Control Enhancement Recommendations – We recommend enhancements to existing controls, including automation, additional review, or improved segregation of duties.
Compensating Control Assessment – Where segregation of duties cannot be achieved, we document and assess compensating controls.
Control Remediation Planning – Where control gaps exist, we develop remediation plans to address them.
ICFR Testing and Monitoring
We test controls and establish ongoing monitoring.
Control Testing Programme – We develop control testing programmes that define testing procedures, sampling, and documentation requirements.
Control Testing Execution – We perform control testing, including walkthroughs, inquiry, observation, inspection, and reperformance.
Testing Documentation – We document testing procedures, evidence, and conclusions. Testing documentation supports management assertions and audit reliance.
Deficiency Identification and Assessment – We identify control deficiencies and assess their severity, including whether they constitute significant deficiencies or material weaknesses.
Remediation Support – We support remediation of deficiencies, including root cause analysis, action planning, and validation testing.
Continuous Monitoring – We establish continuous monitoring processes that provide ongoing visibility into control effectiveness.
ICFR Framework and Governance
We help you establish the governance framework for ICFR.
ICFR Framework Development – We develop the ICFR framework, including policies, procedures, and standards.
Roles and Responsibilities – We define roles and responsibilities for ICFR, including process owners, control owners, management, and the board.
ICFR Governance Structure – We establish governance structures, including an ICFR steering committee, to oversee ICFR implementation and ongoing operation.
Management Certification Support – We support management certification of ICFR, including documentation of management’s assessment and conclusions.
Board and Audit Committee Reporting – We support reporting to the board and audit committee on ICFR status and effectiveness.
Remediation and Improvement
We help you remediate weaknesses and improve ICFR.
Deficiency Remediation Planning – We develop remediation plans to address control deficiencies, including root cause analysis, action planning, and timelines.
Remediation Implementation Support – We support implementation of remediation actions, including control redesign, process improvement, and system enhancements.
Validation Testing – We perform validation testing to confirm that remediated controls are operating effectively.
Continuous Improvement – We help you establish processes for continuous improvement of ICFR, including regular risk assessment, control monitoring, and updates.
Training and Capacity Building
We help you build internal ICFR capability.
ICFR Training for Process Owners – We train process and control owners on their ICFR responsibilities, including control operation and evidence requirements.
ICFR Training for Management – We train management on ICFR oversight, deficiency assessment, and certification.
Board and Audit Committee Training – We train boards and audit committees on ICFR oversight responsibilities.
Documentation Standards Training – We train teams on documentation standards, ensuring consistent, high-quality documentation.
Tool and Template Training – We train teams on ICFR tools and templates, ensuring effective use.
ICFR Tool Selection and Implementation
We help you select and implement ICFR tools.
ICFR Tool Assessment – We assess your ICFR documentation needs and recommend appropriate tools.
Tool Selection Support – We support selection of ICFR documentation and testing tools, including GRC platforms and specialised ICFR software.
Tool Implementation Support – We support implementation of ICFR tools, including configuration, data migration, and training.
Template Development – We develop ICFR templates, including risk and control matrices, process narratives, testing templates, and deficiency logs.
Our ICFR Documentation Methodology
We follow a structured, risk-based methodology for ICFR documentation.
Phase 1: Scoping and Planning – We define ICFR scope, identify significant accounts and processes, and plan the documentation project.
Phase 2: Risk Assessment – We assess risks of material misstatement at the financial statement and assertion levels.
Phase 3: Process Documentation – We document processes, including narratives, flowcharts, and walkthroughs.
Phase 4: Control Identification and Documentation – We identify and document controls, including key controls, in risk and control matrices.
Phase 5: Control Design Assessment – We assess whether controls are designed effectively and identify gaps.
Phase 6: Testing and Monitoring – We test controls, document results, and establish ongoing monitoring.
Phase 7: Remediation and Certification – We support remediation of deficiencies and management certification of ICFR.
Frameworks and Standards We Apply
We apply recognised ICFR frameworks and standards, including:
-
COSO Internal Control – Integrated Framework – The most widely used framework for internal control, providing a structured approach to designing, implementing, and assessing internal control.
-
COSO Enterprise Risk Management Framework – Extends internal control concepts to enterprise risk management.
-
IFRS and Nigerian Financial Reporting Standards – Ensuring controls address financial reporting requirements.
-
ISA 315 – Identifying and assessing risks of material misstatement through understanding the entity and its environment.
-
SEC and CBN Requirements – Complying with Nigerian regulatory requirements for internal control over financial reporting.
-
SOX-Inspired Requirements – Applying best practices from Sarbanes-Oxley for organisations seeking enhanced ICFR frameworks.
Industries We Serve
We provide ICFR documentation services across multiple sectors in Nigeria.
Banking and Financial Services – We help banks, insurance companies, and financial institutions document ICFR that meets CBN, SEC, and NAICOM requirements.
Manufacturing – We help manufacturers document controls over inventory, production, procurement, and financial reporting.
Oil and Gas – We help energy companies document controls over revenue, joint ventures, procurement, and financial reporting.
Technology and Digital – We help tech companies document controls over revenue recognition, capitalised development costs, and financial reporting.
Retail and Consumer Goods – We help retailers document controls over revenue, inventory, and financial reporting.
Healthcare – We help healthcare organisations document controls over revenue, billing, and financial reporting.
Real Estate and Construction – We help real estate and construction companies document controls over project accounting, revenue recognition, and financial reporting.
Professional Services – We help professional service firms document controls over revenue, billing, and financial reporting.
Public Sector – We help government entities document controls over financial reporting and compliance.
Non-Profit and NGOs – We help mission-driven organisations document controls over grants, donations, and financial reporting.
Why Choose Qeeva Advisory for ICFR Documentation
Deep ICFR Expertise – We have deep expertise in internal control over financial reporting, including COSO framework application, risk assessment, control design, and testing.
Financial Reporting Knowledge – We understand IFRS and Nigerian financial reporting requirements, ensuring controls address relevant risks.
Practical and Actionable – We provide practical documentation that is clear, usable, and supports testing and monitoring.
Audit-Ready Documentation – We produce documentation that withstands audit scrutiny and supports management certification.
Risk-Based Approach – We focus documentation and testing on the risks that matter most, ensuring efficient and effective ICFR.
Technology-Enabled – We leverage ICFR tools and templates to deliver efficient, consistent documentation.
End-to-End Support – We provide comprehensive services from scoping to documentation to testing to remediation.
Training and Capacity Building – We build internal capability, ensuring your team can maintain ICFR documentation.
Long-Term Partnership – We build lasting relationships, providing ongoing support as your business evolves.
Confidentiality and Integrity – We treat your information with the highest level of confidentiality.
Related Services
Internal Control Advisory Services – Strengthen governance, prevent fraud, and drive operational excellence.
Learn More About Internal Control Advisory Services
Risk Management Services – We specialize in identifying and managing business interruption risks, including regulatory compliance and internal audit support.
Learn More About Risk Management Services
Audit and Assurance Services – We provide audit and assurance services to ensure your financial records are accurate and compliant.
Learn More About Audit and Assurance Services
IFRS Advisory Services – Achieve compliance, improve reporting quality, and build investor confidence.
Learn More About IFRS Advisory Services
Financial Liability Valuation Services – We provide IFRS-compliant valuations for debt instruments, derivatives, provisions, and employee benefits.
Learn More About Financial Liability Valuation Services
Forensic Accounting & Security Analysis Services – Detect fraud, quantify losses, and strengthen security.
Learn More About Forensic Accounting & Security Analysis Services
Fixed Asset Verification and Asset Control Services – Know what you own, protect what you have, and optimize what you use.
Learn More About Fixed Asset Verification and Asset Control Services
Financial and Management Training Services – Build financial literacy, strengthen management capability, and drive business performance.
Learn More About Financial and Management Training Services
Suggested Reading
Internal Control – An Overview – Internal control is the integrated process and procedures implemented by an organization to provide reasonable assurance that business objectives are achieved.
Common Accounting Errors That Affect Profitability in Nigeria – Accounting errors quietly drain profits, attract penalties, and limit growth.
Preparing a Business for External Audits in Nigeria – External audits can be daunting, but with the right preparation, they become an opportunity to demonstrate your business’s financial integrity.
Deferred Tax Asset Validation Burndown: Complete Guide for Nigerian Businesses – Deferred tax asset validation is a critical financial reporting discipline that has become even more important with the enactment of the NTA 2025.
Frequently Asked Questions (FAQ)
1. What is ICFR?
Internal Control over Financial Reporting (ICFR) is the framework of controls that ensures the reliability of financial reporting and the preparation of financial statements in accordance with applicable standards. ICFR includes controls over transactions, accounts, disclosures, and IT systems that support financial reporting.
2. Why is ICFR documentation important?
ICFR documentation demonstrates that controls exist and are designed effectively. It supports management certification, audit reliance, regulatory compliance, and board oversight. Without documentation, organisations cannot demonstrate control effectiveness.
3. What is a risk and control matrix (RCM)?
A risk and control matrix (RCM) is a document that links financial statement risks to the controls that address them. It provides a clear, auditable record of how risks are mitigated and is a key ICFR documentation tool.
4. What are key controls?
Key controls are the controls that are critical to financial reporting reliability. They are the controls that, if they fail, could result in material misstatement. Key controls receive focused testing and monitoring.
5. What is a walkthrough?
A walkthrough is a procedure where we trace a transaction through the process, confirming our understanding of the process and controls. Walkthroughs validate that controls exist and are designed effectively.
6. What are IT general controls (ITGCs)?
IT general controls are controls over IT systems that support financial reporting, including access controls, change management controls, and operations controls. ITGCs are critical to financial reporting reliability.
7. What is a material weakness?
A material weakness is a deficiency, or combination of deficiencies, in ICFR such that there is a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected on a timely basis.
8. What is the COSO framework?
The COSO Internal Control – Integrated Framework is the most widely used framework for internal control. It defines five components of internal control: control environment, risk assessment, control activities, information and communication, and monitoring activities.
9. Do you provide ICFR documentation for banks?
Yes. We help banks document ICFR that meets CBN, SEC, and NAICOM requirements, including controls over financial reporting, IT systems, and compliance.
10. Do you serve businesses outside Lagos?
Yes. While our head office is in Ikeja, Lagos, we serve businesses across Nigeria. Our ICFR documentation services are available to clients regardless of location.
11. How do I get started?
Contact us to schedule your free consultation. We’ll discuss your ICFR documentation needs, assess your situation, and provide recommendations for how we can help.
Contact Us
Document your controls, strengthen confidence, and achieve compliance. Let us build a partnership that helps you establish and maintain robust ICFR documentation.
Schedule Your Free Consultation to discuss your ICFR documentation needs and explore how we can help.
Phone: +234 802 320 0801, +234 807 576 5799
Email: info@qeeva.com
Address: 5, Ishola Bello Close, Off Iyalla Street, Alausa, Ikeja, Lagos, Nigeria
Business Hours: Monday to Friday, 8:00 AM – 6:00 PM WAT