Blog

The introduction of Management’s Assessment of Internal Control over Financial Reporting (ICFR) under the Financial Reporting Council of Nigeria (FRCN) regime represents a fundamental shift in governance accountability. At its core, ICFR is intended to strengthen governance, reinforce management ownership, and enhance the reliability of financial statements signed by those charged with preparing them.

Yet in practice, a subtle but significant scope creep has emerged.

Many organisations, often guided by auditors or ICFR consultants, define the scope of management’s ICFR assessment using external audit materiality thresholds and quantitatively driven, trial‑balance logic. What begins as a governance exercise gradually morphs into a compliance‑heavy process that closely resembles a substantive audit without delivering commensurate governance value.

This trend risks obscuring the true purpose of ICFR.

Management’s Assessment Is Not an Audit Extension

The FRCN framework is clear in its separation of responsibilities: ICFR is a management assessment, while the auditor’s role is to attest to management’s assessment—not to own, design, or redefine ICFR.

Management is responsible for designing, implementing, maintaining, evaluating, and certifying ICFR. The Board and Audit Committee provide oversight and challenge. The external auditor expresses an independent limited assurance conclusion on management’s assessment, without the engagement being positioned or understood as a reasonable assurance audit of internal controls, or being treated as equivalent to one.

Under the current Nigerian regime, external involvement in ICFR typically takes the form of a negative‑form, limited assurance conclusion, performed as at the reporting date. Evidence depth is scaled to the risk of a material weakness and not to demonstrate consistent operation of controls throughout the period.

The issue is role clarity: when external assurance considerations are allowed to define management’s ICFR scope by default, the distinction between management assessment and auditor attestation becomes blurred.

The Assurance Ceiling: More Effort, Same External Messaging

A critical concept for Boards and executive management is the assurance ceiling.

Under a limited assurance ICFR model, expanding management’s ICFR scope or increasing testing depth does not change the level of assurance communicated to users. The external conclusion remains limited assurance and continues to be expressed with reference to management’s assessment as at the reporting date.

Accordingly, where management elects to adopt more granular scoping or deeper testing, this should be a deliberate governance decision grounded in internal risk mitigation or decision‑useful insight rather than driven by an expectation of incremental assurance outcomes.

This distinction matters because the cost of ICFR should be justified by meaningful risk reduction, not by the volume of testing performed.

Reframing Materiality: Back to the Primary User (With Discipline)

ICFR scoping should be guided not by spreadsheets alone, but by the principles in IFRS Practice Statement 2: Making Materiality Judgements.

PS2 reminds us that information is material only if it could reasonably be expected to influence the decisions of primary users of financial statements. This introduces an essential qualitative dimension to ICFR scoping.

Management is required to ask a simple but powerful question:

If a control failure affected this line item, would a rational investor or lender change their assessment of our financial position or performance?

For many routine, high‑volume, mechanistic balances, the honest answer may be “not likely.” While such balances may be quantitatively significant, they may not be decision‑useful in the same way as judgment‑laden estimates, revenue recognition judgments, tax uncertainties, or complex transactions.

However, an inspection‑defensible ICFR approach requires management to confront a second, often overlooked question:

Even if this balance is not decision‑useful in isolation, could control failures in this process lead to accumulated misstatement risk?

Where management scopes out granular testing based on qualitative materiality, inspection discipline requires explicit evaluation and documentation of:

1. the risk of accumulation, and
2. the entity‑level or monitoring controls relied upon to mitigate that risk.

A top‑down, risk‑based ICFR methodology beginning at the financial‑statement level and cascading to significant accounts and relevant controls supports this judgment while remaining transparent to auditor challenge.

The Strategic Role of Entity‑Level Controls (ELCs)—With Precision

A Well‑designed entity‑level controls (ELCs), such as governance oversight and analytical review controls, can provide effective assurance over routine balances. However, defensible reliance on ELCs requires discipline: they must demonstrate sufficient precision, frequency, and documented follow‑up to detect material misstatements on a timely basis.

This is not an argument for weaker controls. It is an argument for smarter control architecture.

Where ELCs are precise, well‑documented, and consistently applied, management can legitimately reduce granular testing driven primarily by audit convention rather than risk relevance while remaining fully aligned with a top‑down, risk‑based ICFR approach.

Re‑centering Management Ownership

To meet the spirit of the FRCN framework, organisations must move from a compliance‑defensive mindset to a governance‑conscious one. Three practical resets are critical:

1. Define management’s own ICFR materiality and scoping framework, rather than defaulting to substantive audit thresholds.
2. Prioritise risk, judgment, and susceptibility to misstatement (including fraud and accumulation risk), not just balance size.
3. Use ELCs intelligently and only where they demonstrate the precision and evidence required to support inspection‑defensible reliance.

Conclusion: ICFR as Stewardship, Not Shadow Auditing

ICFR was never intended to be an extension of the external audit. It is a statement of management stewardship, ownership, and accountability for the integrity of financial reporting.

Ultimately, ICFR reflects how Boards and executive management discharge their fiduciary responsibility over financial reporting independent of the audit process. By grounding ICFR scoping in IFRS materiality principles and applying a disciplined top‑down, risk‑based methodology, management can focus effort where it truly matters, enhancing decision‑useful reporting for primary users while keeping audit‑driven clutter firmly in check.

The mandate is clear: reclaim ICFR as a governance tool, not an audit shadow.

---

Written by Akeem Taofik – FCA

Nigeria did not fail IFRS adoption. But the quality of IFRS reporting has not advanced at the same pace as compliance. IFRS adoption is largely complete, but IFRS maturity may now be the defining risk. The consequences of that gap are now becoming visible. What we have achieved in practice is compliance, while IFRS fundamentally requires judgment. 

The Promise vs Reality 

When IFRS was adopted, the expectation was clear: Better reporting should lead to better decisions. 

More than a decade later, a more fundamental question must now be asked: Have we improved how we report or primarily what we report? The answer to that question matters because it directly shapes our readiness for IFRS S1 and S2. 

A Simple but Revealing Test 

Recently, I reviewed the financial statements of 138 out of 146 listed entities on the Nigerian Exchange (NGX) across the Main and Growth Boards. 

The focus was deliberately narrow:
Material accounting policies. 

A consistent and observable pattern emerged: 

• Extensive use of standardised language across entities 

• Limited evidence of entity-specific articulation of accounting judgments 

• In some instances, wording that appeared largely unchanged from pre-IFRS reporting frameworks 

These are public interest entities, operating under full IFRS for over a decade. 

Yet: Entity-specific, judgment-driven disclosure yet the core principle of IFRS is still uneven in practice. 

This level of uniformity is fundamentally inconsistent with a principles-based, entity-specific reporting framework. It suggests that, in many cases, disclosure is being standardised where judgment should be differentiated. 

This matters beyond compliance and it directly affects how investors interpret the underlying economics of these entities. 

What This Signals 

This is not primarily a compliance issue. It reflects a structural reality: IFRS adoption is largely complete. But IFRS maturity may now be uneven and in some areas underdeveloped. 

This same maturity gap may now represent the central risk for IFRS S1 and S2 

A Broader Context 

This pattern is not unique, and similar concerns have been observed globally: 

• Financial statements often contain significant volumes of information without proportional insight 

• Disclosure requirements are frequently applied using a checklist mindset rather than a judgment-based approach 

• Boilerplate disclosures can reduce the clarity and usefulness of financial reporting 

Now Consider IFRS S1 and S2 

Nigeria is transitioning toward mandatory sustainability disclosure standards. 

IFRS S1 and S2 represent a step change in expectations: 

• Forward-looking information 

• Integration with strategy 

• Explicit articulation of risks and opportunities 

• Linkage to financial performance 

This is not a routine extension of financial reporting; it is a step change in expectation. It shifts reporting from explaining the past to demonstrating future resilience. In doing so, it brings financial reporting closer to business strategy than ever before. 

The Key Question 

Against current reporting practices, the critical question becomes: How prepared are we for disclosures that depend even more heavily on judgment than IFRS financial statements?  

A Likely Early Outcome 

If reporting practices do not evolve sufficiently, the early phase will likely exhibit familiar characteristics: 

• High-level policy statements 

• General sustainability commitments 

• Limited quantification or financial linkage 

In practical terms: 

There is a strong likelihood that at least in the early stages of transitioning from financial reporting boilerplate to sustainability reporting boilerplate. 

Why This Risk Exists 

This is not about intent; it reflects how systems and incentives operate. 

1. Compliance-Oriented Reporting

Reporting is often assessed based on: 

• Completeness 

• Alignment with standards 

Less emphasis is placed on: 

• Decision-usefulness 

This encourages reporting that meets requirements but not necessarily insight. 

2. Sensitivity Around Judgment

IFRS S1 and S2 require: 

• Assumptions 

• Estimates 

• Forward-looking analysis 

In high-scrutiny environments, entities tend to favor: Conservative and generalised disclosures 

3. Assurance Focus

Historically, assurance prioritises whether disclosures are present more than whether disclosures are decision-useful, entity-specific, and reflective of underlying economic realities 

An Important Shift 

Market evidence increasingly suggests a changing dynamic: 

• Investors are placing greater emphasis on understanding sustainability-related risks and opportunities 

• At the same time, concerns are growing regarding the credibility and consistency of sustainability disclosures 

The result is a widening credibility gap in sustainability reporting. Reliance without trust is a fragile foundation for capital allocation. This creates a structural tension: Greater reliance on sustainability reporting combined with increased scrutiny of its quality. 

Nigeria: Progress and Tension 

Nigeria is making measurable progress: 

• Advancing IFRS S1 and S2 implementation frameworks 

• Building institutional capacity 

• Aligning with global reporting developments 

However, adoption momentum currently exceeds reporting maturity. This raises a critical question: whether implementation timelines are moving faster than organisational readiness. 

This creates a fundamental tension: Accelerated adoption alongside evolving disclosure capability 

So, Are We Ready? 

Short answer: Not fully, not yet. 

A complete answer: Readiness will ultimately be defined by how quickly reporting practices evolve beyond compliance toward informed judgment. 

What Will Define Success 

This is where leadership and not standards will make the difference. The difference will lie in how organisations respond both strategically and operationally. The differentiator will not be adoption. 

It will be credibility. Organizations that succeed will demonstrate: 

1. Clear Linkage to Financial Impact

Not just: statements of intent, but: explicit articulation of how sustainability risks affect financial performance 

2. Stronger Governance of Narrative Reporting

Boards and Audit Committees will need to: 

• Engage deeply with disclosures 

• Challenge assumptions 

• Demand clarity and relevance 

3. Integration of Reporting

Sustainability disclosures must: 

• Connect to financial reporting 

• Be measurable and auditable 

• Support decision-making 

4. Evolution in Assurance

Assurance frameworks must evolve from: completeness checks, to assessment of relevance, coherence, and consistency.

Final Thought 

IFRS delivered important structural improvement. However, disclosure quality has not always advanced at the same pace. IFRS S1 and S2 provide a significant opportunity: Not just to report more but to report more meaningfully. 

The core risk is no longer non-compliance. It is replicating compliance-driven reporting without sufficient insight. And ultimately: Markets do not reward disclosure alone rather they reward clarity, consistency, and credible, decision-useful, and actionable insights. 

---

Written by Akeem Taofik – FCA

In modern governance, independence is often misunderstood as standing back—a polite distance maintained to avoid “interfering” with management. In reality, true governance excellence demands something much harder: Active Neutrality. 

Active Neutrality reframes independence from detachment to disciplined engagement without ownership, influence without control, courage without bias.

Risk Intelligence Is a Governance Asset

Internal Audit does not and should not make commercial or financial decisions; that responsibility rests with management. 

Active Neutrality recognises, however, that Internal Audit is uniquely positioned to assess whether the organisation’s current risk posture remains aligned with actual exposure, especially as conditions evolve. 

When Internal Audit uses data to challenge whether current caution (or lack thereof) remains proportionate, it is not directing outcomes; it is enhancing decision context. 

The distinction between ownership of decisions and transparency of risk is the foundation of Active Neutrality.

Timing: The Difference Between a Diagnosis and an Autopsy

Risk insight delivered after a scheduled audit may confirm history.
Risk insight delivered at the point of decision shapes the future. 

In high‑velocity environments, waiting for predetermined audit cycles means: 

• behavioral patterns harden, 

• value‑preserving adjustments are missed, and 

• remediation becomes a reactive cost rather than a preventive strategy. 

A perfect autopsy report doesn’t save the patient it only explains the funeral. 

Active Neutrality requires Internal Audit to engage at the speed of execution, providing timely, data‑driven challenge without assuming managerial authority.

Independence Through Clarity, Not Distance

There is a persistent Independence Trap where Internal Audit hesitates to provide real‑time insight to “protect” objectivity. This is a misunderstanding of the role. 

Independence is not a mandate for silence.
It is a shield that allows the auditor to speak truth to power while the risk is still manageable. 

Independence is strengthened not weakened when Internal Audit: 

• grounds challenge in objective data, 

• avoids ownership of outcomes, and 

• escalates concerns without waiting for the “proper” quarterly window. 

The Three Principles of Active Neutrality 

These ideas crystallise into three practical principles: 

• Zero Ownership of Decisions: Identifying that an initiative is drifting off‑track is not “managing” it. It is reporting on the health of the asset. 
• Zero Dilution of Facts: Independence means reporting facts as they are, not as they become comfortable. Filtering insight to preserve relationships weakens governance. 
• Zero Waiting for the “Window”: If a material risk is crystallising today, waiting for next quarter’s report is a governance failure and not prudence. 

The Bottom Line for the Board 

The Board’s oversight is strong when Internal Audit is neutral in judgment, but courageous in timing. 

An Internal Audit function practising Active Neutrality protects both downside risk and missed opportunity without compromising objectivity. 

If Internal Audit is staying quiet to “stay independent,” it is not protecting the process; it is hiding from it. 

A Final Reflection 

After decades of leading audit teams and managing complex audits, one truth remains: the most valuable independence is not found in the organisational chart. 

It is found in the willingness to be the first person in the room to say, “This doesn’t look right” long before the formal report is due. 

Is your Internal Audit team empowered to be that voice? 

---

Written by Akeem Taofik – FCA

Most Boards intuitively understand speed.  If the business is moving at 100 mph and Internal Audit is constrained by static annual planning cycles is moving at 20 mph, the Assurance Gap widens every day. 

This is not a capability issue; it is a velocity mismatch. 

The Execution Blind Spot 

Risks that emerge during execution, market shifts, operational shortcuts, or behavioral drift rarely wait for the next formal audit cycle. Yet, these are exactly the risks most likely to bypass assurance entirely. 

When Internal Audit is tethered to a “point-in-time” plan, they are essentially looking at a map of where the business was, while the business is already driving through new, unmapped territory. 

The Governance Reality Check 

In a high-velocity environment: 

• Accuracy without timeliness does not protect value; it merely explains losses after the fact. 

• Retrospective assurance provides a perfect autopsy, but the Board needs a diagnosis while the patient is still on the table. 

The real governance question for modern Boards is no longer: “Was the audit done well?” It is: “Did the insight arrive in time to matter?” 

The Bottom Line 

Modern assurance is not about auditing more. It is about auditing at the speed of the business. Governance excellence requires a shift from “periodic validation” to “continuous intelligence.” If your audit function isn’t moving at the speed of your strategy, you aren’t just independent, you’re out of the loop. 

A Final Reflection

As a professional who has led audit teams and managed complex statutory audits for decades, I’ve observed a consistent truth: the most valuable “independence” isn’t found in the organizational chart. It is found in the auditor’s willingness to be the first person in the room to say, “This doesn’t look right” long before the formal report is due. 

Is your Internal Audit team empowered to be that voice? 

---

Written by Akeem Taofik – FCA

In many Boardrooms, independence is rightly treated as the ultimate safeguard of Internal Audit.  Yet increasingly, independence is interpreted even within Internal Audit itself as a reason for detachment. 

When independence becomes a wall that delays engagement with emerging risks until a formal audit cycle begins, it does not strengthen governance. It creates a visibility lag one that Boards should care deeply about. 

Understanding the Visibility Lag 

The IIA Global Internal Audit Standards (2024) encourage agile and continuous auditing and explicitly align Internal Audit with enterprise objectives and risk. However, in practice, many Internal Audit functions still operate on rigid annual or semi‑annual “big‑bang” audit plans. 

What this means is that audit plans often reflect the risks management identified and embedded within enterprise objectives at the point of strategy setting. As execution unfolds, management pivots in real time but Internal Audit remains tethered to a point‑in‑time risk assessment. 

The consequence is a timing gap: while the business adapts at speed, Internal Audit insight arrives later, bound by planning cycles. This creates a governance blind spot, where the most dangerous risks those that emerge during execution are the least likely to be audited in time. 

Boards intuitively understand this challenge. If the business is moving at 100 mph and Internal Audit is constrained by planning cycles is moving at 20 mph, the assurance gap widens every day. 

Objectivity of Judgment ≠ Isolation of Timing 

Independence exists to protect objectivity of judgment, not to justify a wait‑and‑see posture. A perfect autopsy report doesn’t save the patient; it only explains the funeral. 

Accuracy without timeliness is a wasted investment. From a governance perspective, assurance that arrives too late may still be technically correct—but strategically irrelevant. 

Boards should therefore ask a simple but critical question: 

“Is our Internal Audit function staying silent on emerging risks to protect independence or providing the real‑time risk intelligence needed to protect the organisation?” 

Three Provocations for Audit Committees 

1. Risk Intelligence Is Not Management Interference

   Identifying an emerging exposure: such as operations scaling ahead of a signed contract is not an operational decision.
   It is risk intelligence. 

• The trap is viewing proactive signaling as encroachment.
• The reality is that objectivity is compromised when auditors decide, not when they highlight risk. 

2. The Danger of “Autopsy” Governance

   When Internal Audit limits itself to post‑event validation, Boards are left with explanations rather than protection. A perfect autopsy report doesn’t save the patient, rather it only explains the funeral. 

In high‑velocity environments, assurance that arrives months after risk emerges may be technically correct, but strategically irrelevant. 

• The provocation for Boards is simple:
  “Do we value retrospective accuracy more than independent foresight?” 

3. Reframing the Mandate

   Independence should be the shield that allows Internal Audit to:

• speak truth to power in real time, 

• challenge management assumptions before they harden into failures, 

• escalate concerns without hiding behind the “proper” quarterly window, and 

• practice active neutrality: independence is not passive neutrality; it is the fearless, factual reporting of risks as they develop. 

The Bottom Line 

Independence should be a shield, not a hideout.  An Internal Audit function that waits until risk manifests may remain independent in form
but risks becoming irrelevant in substance.

True governance excellence requires Internal Audit to be independent in mind but integrated in timing.

---

Written by Akeem Taofik – FCA

If you run a Nigerian subsidiary of a multinational and still think Section 57 of Nigeria’s updated corporate tax regime is just “one more calculation,” you’re already behind. Yes, Section 57 introduces a 15% minimum effective tax rate (ETR), neutralizing the benefit of incentives where they depress tax outcomes below the threshold. But the arithmetic is not the real story.

Section 57 is a governance signal

It marks the end of an era where local tax outcomes could be exceptional, lightly governed, and explained after the numbers were already consolidated.

The Comfort That Is Now Gone

For years, many Nigerian subsidiaries operated with quiet confidence. Incentives justified low ETRs. Group headquarters accepted Nigeria as a “special case.” Where questions arose, explanations typically came after the numbers were final.

 Section 57 disrupts that comfort

It now asks a tougher question, one that cannot be deferred: Can Nigeria’s tax outcome be clearly and credibly defended to Group Tax and the Audit Committee without relying on technical footnotes?

If the answer is no, the challenge is not tax complexity.

Why This Is a GRC Issue (Before It’s a Tax One)

From a Governance, Risk, and Compliance (GRC) perspective, Section 57 is not a tax rule; it is a stress test for control maturity, particularly Internal Control over Financial Reporting (ICFR).

Why?

The minimum tax threshold anchors directly to Profit Before Tax (PBT) as reported in audited financial statements. Once that linkage exists, tax is no longer a downstream calculation. It becomes a direct reflection of how disciplined or fragile the financial close process really is.

In practice:

• Weak controls become earnings risk: Volatile PBT caused by late adjustments, weak accrual discipline, inconsistent judgments, or provisioning gaps now creates immediate fiscal and reputational exposure.

• Tax risk moves upstream: Tax outcomes are no longer “managed” after close. They are shaped by how well financial reporting is governed in real time.

• ICFR maturity is exposed: Where tax has been treated as a compliance appendix rather than a governed outcome, Section 57 makes the deficiency visible.

This is how good regulation works. It reveals institutional weaknesses without prescribing the fix.

Audit Friction Is No Longer Tolerated

Historically, tax incentives could often survive scrutiny through post‑hoc explanations. In the Section 57 environment, credibility is defined by the audit trail.

Incentives that are not:

• clearly owned,

• embedded in control design, and

• supported by inspectable evidence

will struggle under Group‑level review or external audit scrutiny.

Persistent “audit friction” is no longer an irritation. It is a governance signal.

The Strategic Shift: From Compliance to Control

High‑maturity organisations are already pivoting. The change is subtle but decisive:

From: “Nigeria is compliant because our incentives are legal.”

To: “Nigeria is controlled because its ETR is deliberate, monitored, and explainable.”

This shift must happen before consolidation, not as a reconciliation exercise after Group questions arise. In a multinational environment, unexplained local volatility is not a local issue, it is an enterprise risk.

The Question That Now Defines Credibility

For CFOs and GRC leaders, the defining question has changed:

If Group Tax or the Audit Committee asked today, ‘Why is Nigeria’s ETR what it is?’ would the response be a spreadsheet model or a governance framework embedded in ICFR?

One signals calculation, the other signals control.

Final Thought

Section 57 is not asking Nigerian subsidiaries to be perfect, it is asking them to be credible.

Credibility does not come from technical explanations delivered after consolidation. It comes from discipline, alignment, and governance maturity.

If Nigeria is still being explained after the fact rather than positioned deliberately within the Group’s governance architecture, Section 57 isn’t the problem.

Your GRC maturity is.

Written by Akeem Taofik – FCA