INTERNAL AUDIT & CONTROLS

Introduction

Internal audit and internal controls are not administrative functions—they are the immune system of a well-governed organisation. In Nigeria, the stakes have never been higher. The Financial Reporting Council of Nigeria (FRC) now requires Public Interest Entities (PIEs) to report on the effectiveness of their internal control over financial reporting (ICFR). The Securities and Exchange Commission (SEC) mandates similar reporting for public companies. Boards of directors bear personal responsibility for ensuring the integrity of their entities’ financial controls and reporting .

Yet many Nigerian organisations still treat internal audit as a compliance afterthought and internal controls as paperwork to satisfy auditors. This mindset is costly. Research on Nigerian deposit money banks found that control activities and monitoring activities have the largest negative and statistically significant effects on fraud occurrence, while risk assessment alone has no significant effect . The operational and oversight dimensions of internal control prevent fraud; merely identifying risks does not.

This comprehensive guide examines internal audit and controls in Nigeria, covering the regulatory framework, the role of internal audit, the COSO control framework, control activities, fraud prevention, and how Qeeva Advisory helps organisations build robust governance and control systems.

The Pain Points: Why Internal Audit and Controls Matter Now More Than Ever

The Fraud Epidemic

Weak internal controls are driving multi-million naira fraud across corporate Nigeria. In 2025, a midstream oil and gas services company suffered a ₦900 million fraud that built over 22 months. The board repeatedly received internal audit findings flagging procurement control weaknesses, but management dismissed them as procedural inefficiencies. When the EFCC intervened, shareholders lost 42% of company value. Firms with solid internal controls slashed their losses by half, and surprise investigations spotted trouble twice as fast as scheduled checks .

The Regulatory Mandate

In Nigeria, ICFR has shifted from practice to legal requirement. The amended Investments and Securities Act (ISA) requires that public companies establish a system of internal controls over financial reporting and security of assets. The board of directors is responsible for ensuring the integrity of the company’s financial controls. The CEO and CFO must personally certify the accuracy of financial statements. The external auditor must issue a statement on the existence, adequacy, and effectiveness of the internal control system .

The Misunderstanding of Internal Controls

In far too many cases, businesses in Africa still see internal controls as a compliance burden—something to survive rather than something to build on. That mindset needs to change. Internal controls are more than policies and approvals. They are the invisible architecture behind a business’s resilience. They determine how confident investors feel, how accurate financial reports are, how easily fraud can be detected or prevented, and how much control leadership really has over the business .

The SME Gap

One of the biggest misconceptions is that internal controls are only for large corporations or listed entities. In reality, small and medium-sized businesses need them even more. They operate in leaner environments, often with fewer checks and balances, and are disproportionately affected by cash flow issues, delayed reconciliations, and manual processes. One small fraud or one misstep can derail years of growth .

The Trust Deficit

Trust is a currency. Auditors trust what they can verify. Investors trust what they can trace. Boards trust what they can explain. Internal controls are the foundation of that trust. One company lost a major investment opportunity because they couldn’t produce consistent financial statements over a three-year period. It wasn’t that the business wasn’t profitable. It was simply unstructured. There were no standardised reconciliation processes, no audit trails, no fixed asset register. The numbers changed every time the investor asked a question. That’s all it took to walk away .

What Is Internal Audit?

The IIA Definition

Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes .

The Purpose of Internal Auditing

Internal auditing strengthens the organisation’s ability to create, protect, and sustain value by providing the board and management with independent, risk-based, and objective assurance, advice, insight, and foresight .

Internal auditing enhances the organisation’s:

• Successful achievement of its objectives

• Governance, risk management, and control processes

• Decision-making and oversight

• Reputation and credibility with its stakeholders

• Ability to serve the public interest

Core Principles of Internal Auditing

The Global Internal Audit Standards articulate ten core principles that should all be present and operating effectively :

1. Demonstrates integrity

2. Demonstrates competence and due professional care

3. Is objective and free from undue influence (independent)

4. Aligns with the strategies, objectives, and risks of the organisation

5. Is appropriately positioned and adequately resourced

6. Demonstrates quality and continuous improvement

7. Communicates effectively

8. Provides risk-based assurance

9. Is insightful, proactive, and future-focused

10. Promotes organisational improvement

The Internal Audit Charter

All effectiveness of internal auditing depends upon the authority given to the internal audit activity by the Board or Audit Committee, and that authority is written in the internal audit charter. It all depends upon the decision-makers of the organisation whether they actually provide authority to the internal audit function through its charter and demonstrate trust, authority, and respect given to internal audit through implementing the recommendations conveyed by the Chief Audit Executive .

The IIA Global Internal Audit Standards

The Institute of Internal Auditors (IIA) released the 2024 Global Internal Audit Standards on January 9, 2024. Internal audit functions were required to adopt the 2024 IPPF Global Internal Audit Standards as of January 9, 2025 .

The 2024 International Professional Practices Framework (IPPF) includes:

• Global Internal Audit Standards (mandatory)

• Topical Requirements (mandatory)

• Global Guidance (recommended)

What Are Internal Controls?

Definition

Internal control means policies, procedures, and practices put in place by management to ensure the safety of assets, the accuracy of financial records and reports, achievement of corporate objectives, and compliance with laws and regulations .

Internal control over financial reporting (ICFR) is the subset of internal controls that pertains to financial reporting objectives. The definition encompasses the controls designed to provide reasonable assurance that:

• Transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles

• Receipts and expenditures are made only in accordance with authorisations of management and directors

• Unauthorised acquisition, use, or disposition of assets that could have a material effect on the financial statements is prevented or timely detected

The COSO Framework

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control—Integrated Framework is the most widely used framework for internal control. The FRC highly recommends the COSO Framework, stating that it satisfies the criteria for a suitable framework .

The COSO Framework consists of five components:

Types of Internal Controls

Preventive Controls

Preventive controls are deployed to prevent the occurrence of an event that might affect the achievement of organisational objectives. Examples include employee background checks, employee training and certifications, password-protected access to asset storage areas, physical locks on inventory stores, security camera systems, and segregation of duties .

Detective Controls

Detective controls seek to identify when preventive controls were not effective in preventing errors and irregularities, particularly in relation to safeguarding assets. Examples include bank reconciliations, control totals, physical inventory counts, reconciliation of the general ledger to detailed subsidiary ledgers, and internal audit functions .

Corrective Controls

Corrective controls put a new system in place to fix already established issues. Examples include data backup used to restore lost data after a fire or other disaster, data validity tests requiring users to confirm data inputs if amounts are outside a reasonable range, and insurance utilised to replace damaged or stolen assets .

Categories of Control Activities

Control activities are the practices and procedures used to ensure that the entity’s objectives are achieved. They are the application of internal controls—specific procedures designed to prevent errors that may arise in processing information, or to detect and correct errors that may arise in processing information .

Authorisation Controls

All significant transactions must be authorised by a manager at an appropriate level in the organisation .

Physical Controls Over Assets

Controls for safeguarding assets from unauthorised use, theft, or damage. An example is limiting access to inventory areas to a restricted number of authorised personnel .

Arithmetic Controls

Checks on the arithmetical accuracy of processing. An example is checking invoices from suppliers to make sure that the amount payable has been calculated correctly .

Accounting Controls

Controls provided within accounting procedures to ensure the accuracy or completeness of records. An example is the use of control account reconciliations to check the accuracy of total trade receivables or total trade payables .

Management Controls

Controls applied by management, including supervision of the work of subordinates, management review of performance, and control reporting including standards setting, variance analysis, budgeting, and budgetary control .

Segregation of Duties

Segregation of duties means dividing the work to be done between two or more individuals, so that the work done by one individual acts as a check on the work of the others. This reduces the risk of error or fraud. If several individuals are involved in the completion of an overall task, this increases the likelihood that errors will be detected when they are made. It is more difficult for a person to commit fraud because a colleague may identify suspicious transactions .

The Audit Committee: Roles and Responsibilities

Statutory Duties Under CAMA 2020

The statutory duties and role of the Audit Committee are encapsulated in Section 404(7) of CAMA 2020. The various Codes of Corporate Governance, including the CBN and FRCN Codes, set out the roles and responsibilities of the Audit Committee, which are to :

• Ascertain whether the Company’s accounting and reporting policies are in accordance with legal requirements and agreed ethical practices

• Review the scope and planning of audit requirements

• Review the findings on Management matters in conjunction with the external auditor and departmental responses thereon

• Keep under review the effectiveness of the Company’s system of accounting and internal control

• Make recommendations to the Board regarding the appointment, remuneration and removal of the external auditor, ensuring the independence and objectivity of the external auditor and ensuring there is no conflict of interest which could impair the independent judgement of the external auditor

• Authorise the internal auditor to carry out investigations into any activity of the Company that may be of interest or concern to the Committee

• Assist in overseeing the integrity of the Company’s financial statements and establishing and developing the internal audit function

Reviewing Internal Audit

The Audit Committee is responsible for reviewing the work of internal audit. This ensures that the internal audit function is operating effectively and that its findings are being addressed .

Internal Control and Fraud Prevention

Research Findings

Research on Nigerian deposit money banks investigated the effect of internal control systems, conceptualised through the five components of the COSO Integrated Framework, on fraud prevention. The results show that control activities and monitoring activities have the largest negative and statistically significant effects on fraud occurrence. Control environment and information and communication also have significant negative effects, although of smaller magnitude, whereas risk assessment has no statistically significant effect .

The findings indicate that the operational and oversight dimensions of internal control are more effective in preventing fraud than risk identification alone. Bank boards should therefore prioritise transaction-level controls and continuous monitoring, while regulators should assess the operational effectiveness, rather than merely the existence, of disclosed controls .

Another study found that information and communication and control activities significantly influence fraud prevention, while risk assessment does not show a positive effect on fraud prevention .

Practical Implications

These findings have important implications for Nigerian organisations:

1. Focus on Control Activities: Transaction-level controls—authorisations, reconciliations, segregation of duties—are the most effective fraud prevention measures.

2. Invest in Monitoring: Continuous monitoring activities detect fraud faster than periodic reviews.

3. Don’t Rely on Risk Assessment Alone: Identifying risks is not enough. Controls must be designed and operated effectively.

4. Assess Operational Effectiveness: Regulators should evaluate whether controls actually work, not just whether they exist.

Internal Audit and ICFR Compliance

The ICFR Documentation Pack

The ICFR Documentation Pack is the collection of documents that supports management’s assessment of ICFR effectiveness. It includes :

1. Overall ICFR Evaluation Strategy Memorandum – Establishes the evaluation approach, procedures, and basis for conclusions

2. Process Documentation – Process narratives, flowcharts, and process maps

3. Risk and Control Matrix (RCM) – Maps financial reporting risks to controls

4. Control Testing Documentation – Testing of design and operating effectiveness

5. Entity-Level Controls Documentation – Controls over management override, risk assessment, control environment

6. IT General Controls Documentation – Access to programs and data, program changes, program development, computer operations

7. Management’s Annual Assessment Report – Statement of responsibility, framework used, assessment of effectiveness

8. CEO/CFO Certification – Certification of accuracy and effectiveness of internal controls

9. Auditor Attestation Report – External auditor’s opinion on management’s assessment

Management’s Annual Assessment

The board of directors of a PIE shall report on the effectiveness of the entity’s internal control system in its annual report. An entity’s annual report should include an internal control report of management that contains :

• A statement of management’s responsibility for establishing and maintaining adequate ICFR

• A statement identifying the framework used by management to conduct the required evaluation

• Management’s assessment of the effectiveness of ICFR as of the end of the most recent fiscal year, including disclosure of any material weaknesses

• A statement that the registered public accounting firm has issued an attestation report on management’s assessment

Critical Rule: Management is not permitted to conclude that ICFR is effective if there are one or more material weaknesses that have not been fully addressed or mitigated .

CEO/CFO Certification

The CEO and CFO must certify that the signing officer has reviewed the report, the report does not contain any untrue statement of a material fact, and the financial statements fairly present the financial condition and results of operations of the entity. The certification must also state that the signing officers :

• Are responsible for establishing and maintaining internal controls

• Have designed such internal controls to ensure that material information is made known to them

• Have evaluated the effectiveness of the entity’s internal controls as of a date within 90 days prior to the report

• Have presented their conclusions about the effectiveness of internal controls

• Have disclosed to the auditors and audit committee all significant deficiencies and material weaknesses

• Have identified whether there were significant changes in internal controls

How Qeeva Advisory Helps with Internal Audit and Controls

At Qeeva Advisory, we understand that effective internal audit and controls are essential for organisational resilience, regulatory compliance, and stakeholder trust. Our team of experienced professionals helps Nigerian businesses build robust governance and control systems.

Our Core Services

Internal Control Advisory Service – We help you build robust internal controls across cash and treasury, procurement, inventory, IT, and other critical domains. Our services include internal control review, internal control testing, and control components including risk assessment, control activities, information and communication, and monitoring. Our team of professionals helps you build, test, and improve your internal controls through internal control review and internal control testing .

Corporate Governance, Risk and Compliance (GRC) – Explore how effective governance, risk management, and compliance frameworks are essential for organizational success, including enterprise risk management and internal control frameworks. Our GRC services help you build governance frameworks that ensure effective board oversight, transparent decision-making, and accountability.

Advisory Services Nigeria – Our advisory professionals help you understand internal audit and control requirements, assess your current compliance posture, and develop implementation strategies.

Regulatory Compliance – We ensure your internal control and governance practices meet all regulatory requirements under the FRC and SEC guidance. Our regulatory compliance services include regulatory mapping to identify all applicable regulations, agencies, and requirements for your business.

Bookkeeping Services – Accurate records are the foundation of effective internal controls. Our bookkeeping services ensure your financial data is accurate and complete.

Risk Management – We help you identify and manage risks associated with internal audit and controls, including fraud risks and control effectiveness risks. Our risk management services help you develop early warning systems and monitor key risk indicators.

Our Service Methodology for Internal Audit and Controls

At Qeeva Advisory, we follow a structured, collaborative process to deliver high-impact internal audit and control solutions.

Phase 1: Internal Control Readiness Assessment

Objective: Understand your current internal control posture and identify gaps.

What We Do:

• Review your current internal control environment and documentation

• Assess compliance with FRC and SEC ICFR requirements

• Evaluate your risk assessment processes and control activities

• Assess your IT general controls and application controls

• Identify gaps in your internal control framework

Deliverables:

• Internal Control Readiness Assessment Report

• Gap analysis and priority action plan

• Implementation roadmap

Related Services: Internal Control Advisory Service and Advisory Services Nigeria

Phase 2: Internal Control Framework Design

Objective: Develop a tailored internal control framework and documentation structure.

What We Do:

• Design your internal control evaluation strategy and methodology

• Develop process documentation (narratives, flowcharts, process maps)

• Build your Risk and Control Matrix (RCM)

• Design control testing procedures and documentation templates

• Develop entity-level and IT general controls documentation

Deliverables:

• Internal Control Evaluation Strategy Memorandum

• Process documentation

• Risk and Control Matrix

• Control testing templates

Related Services: Internal Control Advisory Service and Corporate Governance, Risk and Compliance (GRC)

Phase 3: Implementation Support

Objective: Implement internal control frameworks and build organisational capability.

What We Do:

• Train finance and business process teams on internal control requirements

• Support control testing and evidence gathering

• Assist with documentation of control operation

• Support management’s assessment process

• Coordinate with external auditors

Deliverables:

• Training programs for staff

• Control testing support

• Documentation support

• Management assessment support

Related Services: Bookkeeping Services and Regulatory Compliance

Phase 4: Monitoring and Continuous Improvement

Objective: Ensure sustained compliance and continuous improvement.

What We Do:

• Monitor regulatory changes and update documentation accordingly

• Conduct periodic internal control reviews

• Support internal and external audits

• Provide ongoing advisory support

Deliverables:

• Regulatory update alerts

• Periodic internal control review reports

• Ongoing advisory support

Related Services: Risk Management and Regulatory Compliance

Frequently Asked Questions

Q: What is internal audit?
A: Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes .

Q: What is the difference between internal audit and internal controls?
A: Internal controls are the policies, procedures, and practices put in place by management to ensure the safety of assets, the accuracy of financial records, and compliance with laws and regulations. Internal audit is the independent function that evaluates and improves the effectiveness of those controls .

Q: What is the COSO Framework?
A: The COSO Internal Control—Integrated Framework is the most widely used framework for internal control. It consists of five components: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring Activities. The FRC highly recommends the COSO Framework for ICFR evaluation .

Q: What are the key findings on internal controls and fraud prevention in Nigerian banks?
A: Research shows that control activities and monitoring activities have the largest negative and statistically significant effects on fraud occurrence. Control environment and information and communication also have significant negative effects, while risk assessment has no significant effect. The operational and oversight dimensions of internal control are more effective in preventing fraud than risk identification alone .

Q: What is segregation of duties?
A: Segregation of duties means dividing the work to be done between two or more individuals, so that the work done by one individual acts as a check on the work of the others. This reduces the risk of error or fraud .

Q: What are the responsibilities of the Audit Committee?
A: The Audit Committee is responsible for ascertaining whether accounting and reporting policies comply with legal requirements, reviewing the scope and planning of audit requirements, reviewing findings on management matters, keeping under review the effectiveness of internal control, making recommendations on the appointment and removal of external auditors, and reviewing the work of internal audit .

Q: Can management conclude ICFR is effective if material weaknesses exist?
A: No. Management is not permitted to conclude that ICFR is effective if there are one or more material weaknesses that have not been fully addressed or mitigated .

Q: What must the CEO and CFO certify?
A: They must certify that they have reviewed the report, it contains no untrue statements, financial statements are fairly presented, they are responsible for internal controls, they have evaluated effectiveness within 90 days, and they have disclosed all significant deficiencies and material weaknesses to auditors and the audit committee .

Q: How can Qeeva Advisory help with internal audit and controls?
A: We provide internal control readiness assessment, framework design, implementation support, and ongoing monitoring. Our services include internal control review, testing, Risk and Control Matrix development, control testing templates, management assessment report templates, and training. Our internal control services help you safeguard assets, improve the reliability of financial information, and establish and maintain compliance measures.

The Bottom Line

Internal audit and controls are the foundation of organisational resilience, regulatory compliance, and stakeholder trust. In Nigeria’s evolving regulatory environment, where ICFR is now a statutory requirement for PIEs and public companies, the cost of weak controls is higher than ever.

Key Takeaways:

Understand the Regulatory Requirements: The FRC requires PIEs to report on ICFR effective for annual periods ending 31 December 2024. The SEC requires public companies to report from December 2023 .

Use the COSO Framework: The FRC highly recommends the COSO Framework, consisting of five components .

Focus on Control Activities and Monitoring: Research shows these are the most effective fraud prevention measures .

Build the Core Documents: The ICFR Documentation Pack includes the Risk and Control Matrix, control testing documentation, entity-level controls documentation, IT general controls documentation, management’s annual assessment report, and CEO/CFO certification .

Material Weaknesses Preclude Effectiveness Conclusion: If material weaknesses exist and are not remediated, management cannot conclude ICFR is effective .

Your job is to be prepared. Assess your internal control environment. Build your documentation. Test your controls. Document your conclusions. Seek professional guidance.

With the right approach and the right partner, you can turn internal audit and controls from a compliance burden into a foundation for reliable financial reporting and stakeholder trust.

Suggested Reading from Our Blog

ICFR Documentation Packs: Complete Guide for Nigerian Businesses – Learn about the collection of documents that supports management’s assessment of ICFR effectiveness, including the Risk and Control Matrix, control testing documentation, and management’s annual assessment report.

Practical ICFR Guide for Nigerian Companies – Complete practical guide to ICFR implementation, covering COSO framework, scoping, documentation, control testing, and FRC/SEC compliance.

Internal Control Advisory Service – Learn how to build robust internal controls across cash and treasury, procurement, inventory, IT, and other critical domains. Our internal control services help you safeguard assets, improve the reliability of financial information, and establish and maintain compliance measures.

Corporate Governance, Risk and Compliance (GRC) – Explore how effective governance, risk management, and compliance frameworks are essential for organizational success, including enterprise risk management and internal control frameworks.

Regulatory Compliance Service – Comprehensive overview of regulatory compliance requirements for Nigerian businesses, including regulatory mapping, compliance audits, risk assessment, and cybersecurity compliance.

Reference Links / Sources

FRC Nigeria – Guidance on Management Report on ICFR – ICFR definition, management’s annual assessment requirements, COSO Framework recommendation, material weakness considerations, and auditor attestation requirements

FRC Nigeria – Guidance on Management Report on Internal Control over Financial Reporting (ICFR) – CEO/CFO certification requirements, duty of directors on internal controls, and management’s annual assessment report contents

IIA – Global Internal Audit Standards – Purpose of internal auditing, core principles, and the 2024 IPPF framework

EconPapers – Effect of Internal Control Systems on Fraud Prevention in Nigerian Deposit Money Banks – Research showing control activities and monitoring activities have the largest negative and significant effects on fraud occurrence

ICAN – Advanced Audit and Assurance Study Text – Categories of control activities, segregation of duties, and monitoring of controls

BusinessDay – Internal controls that build trust: Why African businesses must treat compliance as strategy – Cost of neglect, trust dividend, and practical steps for strengthening internal controls

EconPapers – Internal Control System and Fraud Prevention in Nigerian Deposit Money Banks – Research showing information and communication and control activities significantly influence fraud prevention

First HoldCo Plc – 2025 Annual Report – Audit Committee statutory duties under Section 404(7) of CAMA 2020

Chambers – Corporate Governance 2026 Nigeria – External auditor independence, board responsibility for risk management and internal controls

NJI – Fraud Prevention and Internal Controls – Preventive, detective, and corrective controls, conditions for good internal control systems

ECOSAI Circular Spring 2025 – Internal auditors as the eyes and ears of the Board, VUCA and BANI realities, and the internal audit charter

Ellah Lakes Plc – Financial Statements – COSO Internal Control—Integrated Framework 2013 application, entity-level controls, and general controls

UAC of Nigeria Plc – Financial Statements – Management’s assessment using COSO framework, CEO/CFO certification, and auditor attestation report

Qeeva Advisory – Internal Control Advisory Service – Internal control review, testing, and control components including risk assessment, control activities, information and communication, and monitoring

Qeeva Advisory – Corporate Governance, Risk and Compliance (GRC) – Enterprise risk management, internal control advisory, risk management services, and GRC methodology

Let’s Talk About Your Internal Audit and Controls Needs

Building effective internal audit and controls is essential for compliance, fraud prevention, and stakeholder trust. At Qeeva Advisory, we understand the challenges faced by Nigerian businesses in meeting internal control requirements.

Whether you need help with internal control assessment, framework design, or documentation support, we are here to support you.

📞 Call us: (+234) 802 320 0801, (+234) 807 576 5799

📧 Email: info@qeeva.com

📍 Visit us: 5, Ishola Bello Close, Off Iyalla Street, Alausa, Ikeja, Lagos, Nigeria

Contact us today to schedule a consultation. Let us help you navigate internal audit and controls with confidence.

Your journey to reliable financial reporting starts with a conversation. Let’s talk.