Internal Control Automation
ICFR in Nigeria: what the FRC requires, and how to prove your controls
Public Interest Entities in Nigeria must now assess their internal control over financial reporting (ICFR). The CEO and CFO certify it personally, and the external auditor attests to it. Under the FRC's guidance this applies to annual reports for periods ending on or after 31 December 2024.
The hard part is proving, a year later, that the controls you described actually ran: that reconciliations were reviewed, journals approved by someone other than the poster, and exceptions followed up. Here is what the FRC and SEC Nigeria require, and how to collect the evidence as you go.
What ICFR means
ICFR is the set of controls that give reasonable assurance that the financial statements are reliable: controls over cash and bank, revenue, payables, payroll, journals, the close and IT access. An assessment asks three questions:
- Design: is there a control for each significant risk?
- Operation: did it run as designed through the year?
- Deficiencies: where it didn't, how serious is the gap, and what is being done?
What the FRC requires
The FRC Guidance on the Management Report on ICFR (version dated November 2022; checked November 2026) is the main reference.
| Point | What the guidance says |
|---|---|
| Legal basis | FRC Act 2011, sections 7(1), 7(2)(f) and 50(f) |
| In scope | Public Interest Entities |
| Excluded | Small companies under CAMA 2020, unit microfinance banks, insurance brokers, non-tertiary educational and health institutions |
| Applies to | Annual reports for periods ending on or after 31 December 2024 |
| Certification | CEO and CFO certify they evaluated controls within 90 days of the report, and disclosed significant deficiencies, material weaknesses and management fraud to the auditors and audit committee |
| Framework | COSO "highly recommended", not mandated |
| Attestation | The external auditor's report is filed with the annual report |
Listed entities that apply the SEC guidance are treated as compliant. Two FRC notices followed. On 20 March 2024, the FRC said FY2023 reports were filed separately with the SEC and FRC, and later years go in the annual report. On 30 April 2025, government agencies got a one-year waiver, so their first report, with the FY2025 audited accounts, is due in 2026.
What SEC Nigeria requires
SEC Nigeria's guidance on sections 60 to 63 of the Investments and Securities Act 2007 (8 March 2021) applies to public companies. The CEO and CFO each sign a personal certification, the board reports on ICFR effectiveness and names its framework, and the auditor reports on the "existence, adequacy and effectiveness" of internal controls. The compliance date was moved to 31 December 2023, as Nairametrics reported.
The 2007 Act has since been replaced by the Investments and Securities Act 2025; we have not confirmed whether the SEC has reissued its guidance. Separately, CAMA 2020 s.405(b) and the Nigerian Code of Corporate Governance 2018 have the audit committee report each year on ICFR, according to Forvis Mazars. Check the current position with your auditor or legal adviser.
How to prove your controls
- Map risks to controls. For each significant account and process, list the risks to the numbers and the control for each, with its owner, frequency and the evidence it leaves.
- Pick your key controls: the ones that, if they failed, could let a material misstatement through. Bank reconciliation review, journal approval, user access reviews and the close review are usually among them.
- Test design and operation. Operating tests check a sample from the year; keep a record of the sample so the test can be repeated.
- Track deficiencies with what happened, the severity and the fix, through to remediation. Severity is management's judgement.
- Certify in stages. Control owners first, then the CFO and CEO.
| Control (example) | Risk | Evidence it leaves | How often |
|---|---|---|---|
| Bank reconciliation, reviewed | Cash misstated or misappropriated | Signed reconciliation, preparer and reviewer | Monthly or daily |
| Journal approval | Unauthorised journals | Approval by someone other than the poster | Each journal |
| Clearing and suspense review | Balances hiding errors | Aged schedule with owners | Monthly |
| User access review | Inappropriate ledger access | Signed access list | Quarterly |
The gaps auditors find most often: reconciliations not reviewed, or reviewed without a date; self-approved journals; old reconciling items with no owner; and no record of the sample. The evidence usually exists, scattered across email. For the audit side, see year-end audit in Nigeria.
How Brillrec helps
Brillrec is the finance operations platform for Nigerian businesses, with three products: Reconciliation, Internal Control Automation and Financial Close Management. They share one record, so when a reconciliation is signed off, its close task completes and its control shows as operating, with who did the work and when.
- Controls register in Internal Control Automation, built from a Nigerian library of 16 controls. Each control has an owner, a reviewer, a frequency and the evidence it needs (30 active controls on Close and Essential, unlimited on Close Professional, Professional and above).
- Status from the work. A control shows Operating, Late, Not performed or Exception from the work linked to it. Nobody ticks it as done, and the controls dashboard shows every control's status by owner and by area.
- On every plan: segregation-of-duties findings, a quarterly user access review, and long-outstanding items, with an explanation required once reconciling items pass the age you set: 60, 90, 120 or 180 days.
- Unusual journals, on Essential and above. Rules flag weekend and holiday postings, round amounts, rarely used accounts, self-approval, posting after close, quick reversals and vague descriptions, in imported journal listings and Brillrec journals. Someone other than the poster reviews each flag.
- ICFR testing and certification, on Professional and above. Risks mapped to controls; key controls tested on items Brillrec selects; deficiencies tracked, with severity set by a person; certification by owners, then the CFO, then the CEO; and a management assessment report for auditors, the FRC and SEC Nigeria.
- For auditors, on Professional and above: a control evidence pack and read-only guest auditor access, with everything they open logged. An internal auditor role, on every plan, manages the register but never prepares, approves or signs off.
- Period evidence packs, on every plan. Each close period exports as a PDF and Excel file of every task, who prepared and reviewed it and when, plus a zip of the attached files.
- Sign-off and approvals in Reconciliation: sign-off can require a reviewer who is not the preparer, and segregation of duties is checked. A preparer's write-offs and matches with a difference go to an approver before they apply. Reopening needs a reason and is logged, and the audit log is tamper-evident.
Internal Control Automation uses no AI to decide whether a control operates. Brillrec records the process; the company and its auditors decide the conclusions.
Clients have reported 50% less audit preparation time. Results depend on your records and how your team works; see client results and pricing.
Frequently asked questions
Who must file an ICFR report in Nigeria?
Public Interest Entities, for periods ending on or after 31 December 2024, under the FRC guidance. The exclusions are in the table above.
Is COSO mandatory for ICFR in Nigeria?
No. The FRC calls it "highly recommended". SEC Nigeria asks the board to name the framework it used.
Who signs the ICFR certification?
The CEO and CFO, after evaluating control effectiveness within 90 days of the report.
Can I try ICFR in Brillrec before buying?
Yes. The 14-day trial includes every Professional feature, ICFR included.
Start your free 14-day trial, no card needed, or book a 20-minute demo.