₦1.34 Trillion in Reported Audit Lapses: What Would an Auditor-General Find in Your Company?

Inside the Auditor-General's 2024 Report — and the Internal-Control Test Every Nigerian Board Should Run Before Someone Else Runs It For Them

By Joe Adinma, FCA, FCTI — Managing Partner, Joe Adinma & Co. (Chartered Accountants)

Last updated: 22 September 2026 — the National Assembly's Public Accounts Committee review of this report was ongoing and the Federal Audit Service Bill remained unassented as at writing.

In the Nigerian Agricultural Insurance Corporation's 2023 asset register, there were vehicles carrying a book value of ₦117 million. By the time the 2024 register was drawn up, they weren't there. Not sold, not written off, not transferred — just absent. When the Auditor-General for the Federation's team went looking, they could not establish where the vehicles were, who had custody of them, or what had happened to them. There was no record of a disposal, no minutes of an auction, no explanation on file. The report's own words for it: “weaknesses in NAIC's internal control system.”

That single finding sits inside a much larger one. On 17 July 2026, Auditor-General Dr Shaakaa Kanyitor Chira transmitted his annual report on non-compliance and internal-control weaknesses for the 2024 financial year to the National Assembly, published in two volumes now available directly from the Office of the Auditor-General for the Federation's own website. According to Daily Trust's reporting on the report — corroborated by allAfrica's syndication and TheStar's rewrite of the same underlying figures — it named 25 MDAs, universities, embassies, hospitals and agencies across 31 categories of infraction, and put the reported financial lapses and control-related infractions at approximately ₦1.34 trillion.

That figure should not be read as ₦1.34 trillion proven stolen or lost. It aggregates very different categories of audit exception and non-compliance — from missing paperwork, to revenue never remitted centrally, to contracts awarded outside due process — some of which point to genuine loss, and many of which point to a paper trail that simply was not kept. Their causes will differ: incompetence, resource constraints, poor systems, and — in some unknown number of cases — deliberate misconduct. What they share is a common control question: what system should have prevented the exception, detected it, or produced the evidence needed to explain it? That is the point of this article.

Nigerian audit-lapse headlines are frequent enough to be background noise by now. This one is worth actually reading — not for the outrage, but for the blueprint it hands, almost by accident, to every private board and finance function in the country. Nothing in this report is exotic. Every category of failure it describes has a smaller, quieter, entirely plausible twin sitting inside a Nigerian SME or mid-size company's own books right now.

What the Report Actually Found

The available secondary reporting itemises ten of the thirty-one categories in detail — the ten largest by value. Together, these ten categories total approximately ₦203.9 billion: about 15% of the ₦1.34 trillion headline figure.

We tried to reconcile this ourselves directly against the Auditor-General's own published report — both volumes are now public, and we have linked them in the Sources section below rather than relying only on how the media summarised them. Both volumes exceeded the file size our research tools could process end-to-end, so we were not able to independently confirm the full 31-category breakdown or how these ten items relate to the remaining balance. That limitation matters: treat the ₦1.34 trillion figure as reported, not as a fully reconstructed schedule, unless you consult the primary volumes yourself.

The ten largest categories disclosed, as reported:

One Exception, or a Pattern?

Some of the named entities recur across more than one category. NEPAD and NICTM Uromi each appear twice in the top ten alone. That is worth pausing on, because it changes the question a board should be asking.

One exception, on its own, asks a narrow question: what failed, in this one instance? An unretired advance, a missing invoice, a contract awarded without competitive quotes — each could plausibly be a single process breaking down under ordinary pressure.

The same entity showing up across unrelated categories — cash advances, unsubstantiated payments, irregular contracts — asks a more serious question: not what failed, but what management tolerates. A control environment that repeatedly tolerates one class of exception may be vulnerable to others, because the underlying discipline — the expectation that rules apply, that exceptions get escalated, that “we'll sort it out later” is not an acceptable answer — is the same discipline across all of them. That is the difference between an isolated control deficiency and a wider control-environment problem.

This Is Not — Yet — a Fraud Story

It is worth being precise about what this report is and is not. It is a statutory audit finding: documented non-compliance with financial regulations and evidence of weak internal controls. It is not a set of fraud convictions, and in most of the categories above, the report does not allege criminal intent — it alleges a control gap. The NAIC vehicles may have been disposed of without proper documentation, transferred without the register being updated, or may simply be sitting somewhere undocumented. On the evidence presently available, we do not know which.

That distinction matters for the same reason we drew it in our earlier piece on fraud detection: not every irregularity is theft, and treating every control gap as proof of fraud is its own kind of sloppy thinking. But the distinction cuts both ways. A control weak enough to lose track of ₦117 million in vehicles is also a control weak enough to hide theft, should anyone with access decide to test it. Weak controls do not cause fraud on their own. But they remove the checks that make misconduct harder to conceal — independent review, reconciliation, exception reporting, physical verification and, sometimes, simply a second pair of eyes, checking, before the money or the asset is gone.

Why Controls Fail — In Government and In Your Business

Asked in an interview a few months before this report was tabled, the Auditor-General was candid about why these lapses keep recurring:

“One of the major challenges is the persistence of weak internal control systems in some public institutions. In certain cases, there are also capacity gaps, delays in responding to audit observations and inadequate appreciation of the importance of compliance with established regulations.”

“Another challenge is the scale of government operations relative to available resources for oversight. Nevertheless, we continue to engage MDAs, provide professional guidance and advocate stronger accountability mechanisms to improve compliance and safeguard public resources.” — Dr Shaakaa Chira, Auditor-General for the Federation

Strip out the word “government” and that diagnosis reads like an audit-committee memo for half the private companies we see. It maps almost exactly onto the five components of the COSO Internal Control framework that underpins most modern audit and governance standards:

• Control environment — does leadership actually treat compliance as non-negotiable, or as paperwork?

• Risk assessment — has anyone identified where cash, assets or revenue are most exposed?

• Control activities — are approvals, reconciliations and segregation of duties designed in, or improvised?

• Information and communication — do audit findings actually reach the people who can fix them, quickly?

• Monitoring — does anyone independently test whether the controls on paper are the controls in practice?

Every category in the table above is, at root, a failure of one or more of these five components. That is precisely why the report translates so directly to the private sector — the components are the same regardless of whether the entity is a federal ministry or a Port Harcourt manufacturing company. Mapped against the findings above:

These mappings are diagnostic rather than exclusive. A recurring failure may begin as a control-activity deficiency and, if repeatedly tolerated or left unremediated, become evidence of weaknesses in monitoring and, ultimately, the control environment itself.

Prevention Failed. Detection Should Have Caught It. Remediation Should Have Stopped It Recurring.

It is also worth naming a distinction the report illustrates without stating it directly. Excess cash advances, irregular contracts and unsubstantiated payments are largely preventive failures — approval limits, segregation of duties and pre-payment review that should have stopped the transaction before it happened. Unremitted revenue and unreconciled assets are more often detective failures — the bank reconciliation, the physical asset count, the exception report that should have caught the gap afterwards, even where prevention had already failed.

A mature control system does not assume prevention will always work. It builds in detective controls on the assumption that something will eventually get through — because in any organisation of scale, something always does.

But detection is not the end of the control cycle either. Once an exception is found, someone must own the remediation, set a deadline, verify closure, and determine whether the same weakness exists elsewhere. Skip that step and an audit finding becomes an annual ritual rather than a control improvement — the same NAIC-style gap, rediscovered, unfixed, year after year. The most revealing question about any organisation's controls may therefore not be “did internal audit find it?” but “what changed after internal audit found it?”

The Private-Sector Equivalent

Here is the same list, translated:

What Nigerian Boards Are Already Expected to Do About This

This is not a hypothetical obligation for every business. The Financial Reporting Council of Nigeria's Guidance on the Management Report on Internal Control over Financial Reporting (ICFR) states, in its own scope clause, that it applies to “managements of all Public Interest Entities (PIEs),” with a short list of exclusions: listed entities instead follow a separate SEC guideline, and small companies (as defined by CAMA 2020), unit microfinance banks, insurance brokers, and non-tertiary educational or health institutions are carved out. For everyone else caught by that definition — which, under the FRC Act's expanded 2023 criteria, can include unlisted companies with turnover above ₦30 billion or government contracts above ₦1 billion, among other categories we set out in more detail in “Is Your Auditor Even Allowed to Sign Your Accounts?” — the guidance states plainly that “every PIE shall establish a system of internal controls over its financial reporting and security of its assets,” with the board responsible for its integrity. Many boards within scope have still not operationalised this, and some may not realise they are within scope at all.

One boundary is worth being precise about: the FRC's guidance is specifically concerned with internal control over financial reporting, not every operational or compliance control in an organisation. Several of the Auditor-General's findings — procurement process, contract execution, day-to-day operational compliance — extend beyond ICFR narrowly defined. But where those weaknesses affect how transactions are recorded, how assets are safeguarded, or how reliable the resulting financial reporting is — which describes most of the findings in this article — the implications for ICFR can become direct.

The guidance also uses a word boards sometimes gloss over: evidence. It requires management to maintain “evidential matter, including documentation, to provide reasonable support for its assessment” of internal controls, and says explicitly that “inquiry alone generally will not provide an adequate basis for management's assessment.” It goes further still: management is not permitted to conclude that its internal control over financial reporting is effective if a material weakness has been identified and not fully addressed. A policy on paper, or a verbal assurance that “finance checks that,” meets none of this.

A control that leaves no evidence is very difficult to distinguish, after the fact, from a control that never happened at all.

Company law adds a second, more general layer. Section 305 of CAMA 2020 sets out directors' fiduciary duties: a director must act in what they believe to be the best interests of the company so as to preserve its assets, further its business, and act as “a faithful, diligent, careful and ordinarily skilful director would act in the circumstances.” Section 308 goes further, setting an explicit objective standard: every director must exercise the powers and discharge the duties of office honestly, in good faith and in the best interests of the company, and must exercise “that degree of care, diligence and skill which a reasonably prudent director would exercise in comparable circumstances.” Neither section is a stand-alone internal-control code, and CAMA does not itself spell out financial-control oversight as a distinct duty — that application is ours, not the statute's. But taken together, and applied to a board responsible for stewardship of company assets and financial reporting, they make sustained indifference to known control weaknesses increasingly difficult to reconcile with responsible directorship.

The 10-Question Control Stress Test

Forget, for a moment, what happened in the 25 public institutions above. Put your own organisation through the same test. Ten questions, adapted from exactly the categories the Auditor-General's report flags. For each one, do not answer yes or no. Ask for the evidence.

Directors often ask management “are reconciliations being done?” and accept “yes” as the answer. That is not control testing — it is taking someone's word for it. The sharper question is: show me the last three reconciliations, who prepared them, who reviewed them, what exceptions they found, and what happened to those exceptions afterward. Good governance does not ask whether a control exists. It asks whether the control operated, who performed it, what evidence remains, what exceptions it identified, and what happened next.

• Can management produce an up-to-date fixed asset register within 48 hours — and evidence of when those assets were last physically verified, and how any discrepancies were resolved?

• Does every cash advance in your business have a retirement deadline — and is anyone actually enforcing it?

• Are payment initiation, approval and release appropriately segregated — so that no one person can create and complete a payment without an independent control?

• Could a branch or department collect revenue and never report it to the finance office — and would anyone notice?

• Do contracts above a set value go through competitive quotes, or does “we've always used this supplier” count as policy?

• When was the last time someone outside the finance team tested whether your controls are actually followed, not just written down?

• If an asset went missing from your books today, would your controls catch it at the next audit — or the fifth one?

• If your organisation is a Public Interest Entity, can the board support its annual conclusion on the effectiveness of ICFR with documented testing and evidence — including any identified deficiencies and how they were remediated?

• Are critical financial processes concentrated in one person because it is “faster” — and has anyone formally assessed what happens when convenience overrides segregation of duties?

• If a regulator audited your business today with the rigour the Auditor-General just applied to 25 MDAs and universities, what would they find first?

What Happens After the Finding Matters

The Auditor-General has referred these infractions to the Public Accounts Committees of the National Assembly; as at writing, no PAC hearing outcomes on this specific report had been made public. Separately, the Federal Audit Service Bill — which would strengthen the Auditor-General's direct enforcement powers, including the power to surcharge officials, withhold emoluments for non-response within 30 days, and fine agencies ₦500,000 for missing financial-statement deadlines — has not yet received presidential assent, despite renewed public pressure for it in recent weeks.

That gap limits the Auditor-General's own direct enforcement toolkit; it does not mean the conduct these reports describe is immune from consequences under other applicable laws, procurement rules or administrative processes. For a private board, the more useful lesson is the one the Bill's absence obscures: a finding that is never remediated, owned or closed out is not really a finding — it is a recurring risk with a report number attached. Regulators, lenders and acquirers read these reports too, and “our controls are informal but everyone means well” has never survived a due-diligence exercise.

How Joe Adinma & Co. Can Help

For boards and management teams that want to know whether the controls described in policy documents are actually operating in practice, an independent internal-control review can test the evidence, identify recurring exceptions, and prioritise remediation before a weakness becomes an audit finding, a regulatory issue, or a loss event. Joe Adinma & Co. supports organisations with internal-control reviews, financial-reporting diagnostics, and related assurance and advisory work.

This article is for general information only and does not constitute professional, legal or audit advice specific to your organisation. It draws on the Auditor-General for the Federation's published FY2024 report volumes and secondary reporting available as at 22 September 2026. The ₦1.34 trillion aggregate and the detailed category-level figures discussed above should be read subject to the sourcing and reconciliation limitations expressly identified in the article. Legislative, regulatory and enforcement developments may change after publication; readers should verify the current position before relying on them.

Sources

• • Office of the Auditor-General for the Federation — Annual Report on Non-Compliance/Internal Control Weakness, FY2024, Volume I

• • Office of the Auditor-General for the Federation — Annual Report on Non-Compliance/Internal Control Weakness, FY2024, Volume II

• • Daily Trust — “25 MDAs, varsities, others flagged in N1.34trn audit lapses,” 3 September 2026

• • Daily Trust — “MDAs' weak internal controls hindering audit compliance – AuGF,” 15 June 2026

• • allAfrica (Daily Trust syndication) — 3 September 2026

• • TheStar.ng — “Audit uncovers N1.34trn financial lapses across federal agencies,” 3 September 2026

• • Financial Reporting Council of Nigeria — Guidance on Management Report on Internal Control over Financial Reporting (RR-1), Sections 1.1, 1.2, 1.4, 1.5, 1.8 and 1.9

• • COSO — Internal Control – Integrated Framework (five components)

Companies and Allied Matters Act 2020, sections 305 (directors' fiduciary duties) and 308 (duty of care and skill) — verified against independently sourced verbatim text; no single authoritative online copy was linked directly in this article.