As assurance becomes more routine, it may be worth pausing to reflect on whether execution, scope, and reported assurance levels remain coherently aligned.
Sharing a governance reflection below.
Internal Control over Financial Reporting (ICFR) is now firmly embedded in Nigeria’s financial reporting framework under the oversight of the Financial Reporting Council of Nigeria (FRCN). As ICFR assurance becomes more routine, a natural governance question arises for Boards, CFOs, and Audit Committees: does the way ICFR assurance is being executed reflect the assurance level ultimately reported?
This is not a technical debate, but rather, it is a governance consideration that goes directly to proportionality, cost discipline and expectation setting between auditors and Boards, and the credibility of what ICFR assurance communicates to the market.
The Significance of the Limited Assurance Starting Point
From inception, ICFR assurance in Nigeria was deliberately framed as a limited assurance engagement under ISAE 3000 (Revised). That design reflected regulatory judgement balancing improved governance oversight against market readiness, implementation burden, and cost efficiency.
A limited assurance model is intended to:
- provide moderate assurance in negative form, using procedures less extensive than those required for reasonable assurance; and
- avoid conclusions that imply sustained operating effectiveness comparable to US SOX style regimes.
This starting logic is important, as it defines both what ICFR assurance is designed to achieve and what it is not.
What the Independent ICFR Attestation Report Signals
Independent ICFR attestation reports consistently emphasize three elements:
- negative form conclusions (“nothing has come to our attention…”).
- explicit acknowledgment that procedures performed are less extensive than those required for reasonable assurance; and
- clear differentiation between limited and reasonable assurance.
These disclosures are not incidental. They establish the boundary conditions of the engagement and shape market expectations about the level of comfort being provided.
From a governance perspective, this framing naturally prompts a simple question: should the experience of an ICFR review materially exceed what the final report itself can support?
Where Practical Tensions Arise
In practice, ICFR engagements often involve procedures that feel more extensive than what stakeholders typically associate with limited assurance. Operating effectiveness activities are frequently embedded within ICFR workstreams.
Such procedures are well understood and entirely appropriate when used deliberately to support audit reliance strategies under ISA 330. However, they serve a specific audit objective and are not intrinsically required to support a negative assurance of ICFR conclusion.
This raises a legitimate governance reflection:
If an ICFR engagement culminates in a limited assurance conclusion regardless of whether operating effectiveness exceptions are identified, how should Audit Committees interpret the role and necessity of those procedures?
The issue is not whether such work can be performed, but whether it is essential to the assurance outcome being reported.
Proportionality, Cost, and Clarity
As ICFR becomes more embedded, Boards and management increasingly bear the cost of ongoing assurance activity. With that comes a fiduciary obligation to ensure proportionality.
From a governance standpoint:
- assurance scope should be clearly traceable to stated objectives.
- methodology choices should be distinguishable from mandatory requirements; and
- cost should align with the level of assurance ultimately expressed to the market.
Where these lines blur, there is a risk that ICFR assurance evolves through habit rather than deliberate governance intent.
A Forward-Looking Question for the Nigerian Market
The evolution of practice also raises a broader policy question—one that may become unavoidable over time:
If ICFR execution increasingly resembles reasonable assurance behaviour in substance, should the assurance level remain limited in form?
Conversely, if limited assurance remains the intended endpoint, what additional discipline is required to ensure that execution remains consistent with that intent?
These are not questions for auditors alone. They fall squarely within the responsibility of regulators, Audit Committees, and Boards charged with safeguarding reporting integrity and cost efficiency.
Closing Reflection
ICFR assurance should mean exactly what it states in the report — no more, no less.
As ICFR practices mature, the real test of governance will not be how much work is performed, but how deliberately assurance scope, assurance level, and cost are aligned. When execution quietly exceeds what reporting can support, clarity is lost, accountability weakens, and value becomes harder to demonstrate.
For CFOs and Audit Committees, the task ahead is neither resistance nor automatic acceptance. It is intentional oversight returning to first principles, interrogating scope with precision, and ensuring that ICFR assurance evolves as a disciplined governance tool, not a matter of habit or momentum.
In that discipline lies both credibility and confidence.
Written by Akeem Taofik – Director, Governance, Risk and Compliance
