Before the Verdict: Five Control Questions Two 2026 Fraud Cases Should Put to Every Board
Published October 7, 2026
Nigeria's EFCC says it recovered more than ₦1.23 trillion and secured 10,872 convictions in 34 months. Two pending 2026 prosecutions raise a different question for boards: if a transaction carrying similar risks came through your organisation today, which controls would have to work before the money moved?
By Joe Adinma — Managing Partner, Joe Adinma & Co. (Chartered Accountants)
Last updated: 19 September 2026. Both cases discussed below remain pending. The defendants have pleaded not guilty and are presumed innocent unless and until proven guilty.
BOARD TAKEAWAY |
A criminal charge is not a conviction.
It does not establish that the conduct alleged by a prosecutor actually occurred, and it certainly does not establish that a particular internal control failed.
But for a board, that does not make a pending fraud case irrelevant.
Read carefully, an allegation can still pose a useful question:
If a transaction carrying these characteristics came through our organisation tomorrow, what would have to happen before the money could move — and what would tell us quickly if something had gone wrong?
That is the question behind this article.
It is not an attempt to decide two cases that Nigerian courts have yet to decide. It is an attempt to use publicly reported allegations as control stress tests.
Good forensic analysis separates what the evidence establishes from what merely seems plausible. Boards should demand the same discipline from their control systems.
The Backdrop: ₦1.23 Trillion and 10,872 Convictions in 34 Months
At a media briefing on 31 August 2026, EFCC Chairman Ola Olukoyede reported that between October 2023 and July 2026 the Commission received 49,673 petitions, conducted 39,615 investigations, filed 14,476 cases in court and secured 10,872 convictions.
The Commission described that as a 75.1% conviction-to-filing ratio. In the first half of 2026 alone, it reported 1,370 convictions from 1,889 court filings.
Recoveries were equally substantial. The EFCC reported approximately ₦1.233 trillion and $684.48 million recovered during the period, alongside recoveries in other currencies.
Those numbers tell boards something about the scale of enforcement activity. They do not answer a more immediate corporate question:
How much misconduct should an organisation be capable of preventing or detecting before an investigator, regulator, customer, lender or prosecutor becomes involved?
Two pending cases provide a useful framework for thinking about that question.
Enforcement is only part of the picture.
The Association of Certified Fraud Examiners' Occupational Fraud 2026 study, covering 2,402 cases across 143 countries and territories, again reports that 43% of occupational fraud cases were initially detected through tips. The median scheme lasted 12 months before detection; schemes detected within six months had a median loss of $40,000, compared with more than $1.1 million for schemes continuing beyond five years.
The implication for a board is not that whistleblowing is unimportant. It is that prevention, detection and escalation should not depend on somebody eventually speaking up. The two pending Nigerian cases below provide useful stress tests for the questions a board should be asking before and after material transactions.
Case One: A $1.5 Million Investment, a Term Sheet and a Disputed Transaction
In March 2026, the managing director of a Nigerian investment holding company and the company itself were arraigned before the Lagos State Special Offences Court on two counts relating to alleged obtaining by false pretence and forgery.
According to the prosecution, another investment company paid $1.5 million between April 2022 and October 2023 in connection with proposed investments involving a group of related entities. The prosecution alleges that representations surrounding the transaction included reimbursement of the investment amount, payment of a $2.25 million development capital fee and the allocation of approximately 22.4% of the shares in the holding company.
A second count alleges forgery of a Term Sheet said to have been used in connection with the transaction. The defendants pleaded not guilty.
Subsequent prosecution testimony makes the factual picture more nuanced than the charge alone might suggest. A prosecution witness testified that the parties negotiated an equity structure and that a legal practitioner prepared a term sheet following their agreement.
That testimony does not determine whether the prosecution's forgery allegation is true or false. Nor does it resolve the wider dispute. Those are matters for the court.
What evidence would our organisation require before committing $1.5 million to a transaction of this nature?
That question is very different from asking whether somebody committed fraud.
Imagine the same transaction arriving at your organisation. There is an investment opportunity. Several entities are involved. There are representations about reimbursement, future economic benefits and equity participation. There is legal documentation. A substantial amount is about to leave the bank.
Before payment, could the board or investment committee produce a file demonstrating:
who independently verified the counterparties and their authority;
who verified the underlying commercial opportunity;
who reviewed the legal documentation;
who tested the material representations on which the investment decision depended;
which conditions had to be satisfied before disbursement;
whether the payment should be made in full, through escrow or in stages against independently verified milestones; and
who would monitor compliance after the money was released?
The public record does not establish the complete due-diligence process undertaken in the transaction now before the court. That is precisely why the governance question should be asked of your own organisation, rather than answered speculatively about somebody else's.
Control map: Case One primarily stress-tests Question 1 (independent verification before money leaves) and Question 3 (whether transaction value and risk should change the control).
Case Two: ₦336.99 Million Allegedly Converted from a Bank
In June 2026, the head of a Nigerian oil and gas services company and the company itself were arraigned before the Lagos State High Court on an amended three-count charge relating to conspiracy, stealing and retention of proceeds of criminal conduct.
The EFCC alleges that the defendants, together with another person named in the charge as being at large, conspired in 2022 to steal money belonging to a Nigerian bank and, between 2022 and 2023, dishonestly converted ₦336,993,863.35 belonging to the bank to their own use.
The defendants pleaded not guilty. The matter was adjourned to 7 October 2026 for commencement of trial.
At the time of writing, the publicly available reports reviewed for this article do not disclose enough about the alleged transaction mechanics to diagnose responsibly which particular control, if any, failed.
Was a banking facility involved? Were payment instructions manipulated? Was documentation false? Was an internal process allegedly exploited? Was there another mechanism entirely? The available record does not yet give us a sufficient basis to say.
A forensic accountant should be as disciplined about what the evidence does not show as about what it does.
But a board does not need to know the eventual mechanism in this particular case to ask a powerful question about its own organisation:
If a material transaction were improperly processed through our organisation today, which control would identify it — and how quickly?
Would it be caught by a bank reconciliation? An exception report? Transaction monitoring? Independent review? Internal audit? A whistleblower? Or an external party asking why the money moved?
That is the control question.
Control map: Case Two primarily stress-tests Question 4 — how quickly the organisation would identify an abnormal material transaction, without assuming which mechanism is alleged in the pending case.
The Lesson Is Not That These Controls Failed
Nothing in this article establishes that a particular internal control at any of the organisations involved in these proceedings failed.
The cases are pending. The publicly available evidence is incomplete. And the courts, not commentators, will determine the criminal allegations.
Material transactions create predictable categories of risk. Boards can test their controls against those risks without deciding whether somebody else is guilty of anything.
That is what turns a news story into a governance exercise.
Five Questions I Would Put to the Board
The COSO/ACFE Fraud Risk Management Guide treats fraud risk management as more than a policy document. Its framework encompasses governance, fraud-risk assessment, preventive and detective controls, investigation and corrective action, and continuing monitoring.
The Institute of Internal Auditors' refreshed Three Lines Model, issued in July 2026 with the board as its primary audience, similarly emphasises accountability across management, specialist risk and compliance functions, and independent internal audit assurance.
There is also a Nigerian statutory and regulatory anchor for this discussion. Section 305 of CAMA 2020 places directors in a fiduciary relationship with the company and requires them to act in its best interests, including preserving its assets; section 308 separately addresses the standard of care, diligence and skill expected of directors. For entities within its scope, the Financial Reporting Council's guidance on Internal Control over Financial Reporting requires management to establish and maintain ICFR, assess it on a top-down, risk-based basis and retain evidential documentation supporting that assessment. These requirements are not identical to a full enterprise fraud-risk framework, but they reinforce the same governance principle: responsibility for control cannot be reduced to signatures on a policy.
1. What must be independently verified before material money leaves?
For significant investments, acquisitions, loans, advances and unusual payments, approval should not mean merely obtaining enough signatures. The evidence underlying the decision must itself be challenged. Who is the counterparty? Who has authority to bind it? What material representations are we relying on? Have those representations been independently verified? Are the bank details independently confirmed? Have the legal and commercial conditions precedent actually been satisfied?
A beautifully prepared document is evidence of a document. It is not necessarily evidence that every assertion inside it is true.
“A beautifully prepared document is evidence of a document. It is not necessarily evidence that every assertion inside it is true.” |
2. Can the same person originate, validate and effectively approve a transaction?
Segregation of duties is not bureaucratic inconvenience. It is friction deliberately introduced into a system so that one person's error, pressure or dishonesty cannot automatically become the organisation's transaction.
The person championing an opportunity should not be its sole source of verification. For material or unusual transactions, somebody with sufficient independence, competence and authority should be required to challenge the assumptions before approval.
3. Does the amount of money at risk change the control?
A ₦500,000 routine payment and a ₦500 million unusual transaction should not travel through identical governance architecture merely because both fit within somebody's nominal approval limit.
High-value or unusual transactions may justify enhanced due diligence, board or investment-committee approval, escrow arrangements, staged disbursement, verified milestones or additional independent confirmation. Control intensity should respond not only to transaction value, but also to risk.
4. If money moved incorrectly this morning, when would we know?
This may be the most revealing question in the article.
Not: “Do we reconcile our bank accounts?”
But: “How quickly would our current system identify this specific abnormal transaction?”
Daily? At month-end? During the annual audit? When the bank calls? When a customer complains? When an employee reports it? Or when an external investigator asks for the records?
Preventive controls matter. Detective controls matter too, because no preventive system is infallible.
5. Who is responsible for challenging management?
The answer cannot simply be “the board.” Governance works when responsibilities are sufficiently clear to operate in practice.
Management owns and manages risk. Specialist functions such as finance, compliance and risk can support, monitor and challenge. Internal audit can provide independent assurance over whether governance, risk management and controls are functioning as intended. The board oversees the architecture.
If everybody is responsible in theory but nobody can explain what he or she must actually do when a red flag appears, the organisation does not have a control framework. It has an organisational chart.
The Control File Test
There is a practical exercise boards can perform without waiting for the next audit.
Select the five largest or most unusual transactions your organisation approved during the past twelve months.
For each one, ask management to produce the complete control file:
What was proposed? Who originated it? What evidence supported it? What was independently verified? Who challenged it? Who approved it? What conditions preceded payment? Where did the money go? What happened afterwards? And which control would have identified a problem if the transaction had not performed as represented?
Do not begin with the accounting entry. Begin with the transaction.
If the organisation cannot reconstruct the answer convincingly from contemporaneous evidence, the weakness exists regardless of whether fraud has ever occurred.
That is the point of preventive governance: you do not wait for misconduct to discover that your controls were inadequate.
Before the Verdict
The two prosecutions discussed here may eventually end in convictions, acquittals or some other judicial outcome. That outcome matters enormously to the defendants and other parties involved.
But a board does not need to predict it.
If a transaction carrying similar risk characteristics arrived at your organisation tomorrow morning, what would stop an improper payment before it happened — and what would detect it quickly if prevention failed?
If the answer depends primarily on trust, familiarity, hierarchy or somebody eventually noticing, the control environment deserves another look.
The strongest internal controls are rarely the ones described most impressively in a policy manual. They are the ones that operate when a transaction is urgent, commercially attractive, introduced by somebody senior and apparently supported by convincing documentation.
That is when a control earns its name.
“That is when a control earns its name.” |
Related Reading
This article builds on our earlier discussion, “43% of Fraud Is Caught by a Tip-Off. Is Yours Being Caught at All?”, which examines fraud detection, whistleblowing and the gap between controls that exist on paper and controls that operate in practice.
How Joe Adinma & Co. Can Help
Joe Adinma & Co. assists boards and management teams in testing whether critical controls work in practice. Depending on the organisation's needs, this may include a facilitated Control File Test over major transactions, a fraud-risk assessment against recognised frameworks, and a segregation-of-duties and approval-workflow review focused on where material transactions can enter, move through and leave the organisation.
The objective is straightforward: identify control gaps before they become investigation files.
Disclaimer
This article discusses two real and pending criminal prosecutions solely for the purpose of examining general internal-control and governance questions. All references to alleged conduct are allegations drawn from publicly reported court proceedings and prosecution materials. The defendants in both cases have pleaded not guilty and are presumed innocent unless and until proven guilty by a court of competent jurisdiction.
Nothing in this article expresses or implies a conclusion regarding the guilt, innocence, conduct or internal-control environment of any defendant, complainant, financial institution, company or other person connected with either proceeding. The article does not purport to identify the actual control processes operating within those organisations, except where expressly established by cited public information.
This material is provided for general information only and does not constitute legal, audit, tax, investment or other professional advice. Organisations should obtain advice appropriate to their particular circumstances.
Sources and Further Reading
• EFCC 34-month enforcement record — PUNCH, 1 September 2026
• EFCC 34-month enforcement record — Premium Times, 31 August 2026
• Case One — Casefile Nigeria prosecution-witness report, 30 June 2026
• Association of Certified Fraud Examiners — Occupational Fraud 2026: A Report to the Nations
• The Institute of Internal Auditors — Statements of Position / refreshed Three Lines Model
• Financial Reporting Council of Nigeria — ICFR publications and guidance
