INTERNAL CONTROL OVER FINANCIAL REPORTING (ICFR) – THE COSO WAY.

What are the critical building blocks required of the organizations to achieve corporate goals and objectives?

The Business Operating Model below depicts the critical building blocks that every organization should be intentional and prioritize to reinforce the organization’s ability to sustain the achievement of the corporate goals and objectives. These building blocks are anchored on commitment to business excellence demonstrated by understanding what the company stands for and doing the proper things to making the company stand tall and test of time. Presented in figure 2 below is an overview of the critical building blocks for the success of any organization.

Stakeholders and Stakeholders’ Communication are part of the critical building blocks required by the organizations to pay serious attention across all levels as any serious issues in the management, governance or assurance may spring up very serious surprises for the organization.

The Financial Reports which include the Financial Statements are the critical tools for communicating financial performance of the organizations to the stakeholders who need the information to gain timely insight to make risk-informed decisions, make strategic business plans and execute actions timely. For the stakeholders to rely on the financial reports to make right decisions and take proper actions, the credibility of the financial reports must be assured across all levels. The three lines of defense assurance providers which include executive management committees, interdepartmental focus groups and review committees, internal control, internal audit, enterprise risk management, Operational risk management functions and HSEQ provide the assurance.

Who Is Responsible for the Certification of The Financial Statements Credibility?

Generally, everyone in the organization that has input to the production of the financial and non-financial reports emanating from any organization right from transactions origination, approvals, processing and reporting has the responsibility for the certification of the credibility of the reports. Credible financial reports are reports that meet the financial statements or management assertions principles namely: Existence/Occurrence, Completeness, Accuracy, Classification, Rights and Obligations, Valuation and Allocation. Credible financial reports also meet the information processing objectives namely: Completeness, Accuracy, Validity and Restricted Access.

The detailed description of the financial statements or management assertions and information processing objectives will be discussed further in the upcoming ICFR Part 2 blog – Control Activities Design, Operation, Effectiveness Testing and Stakeholders Reporting.

In most jurisdictions across the globe, companies are required to make available a copy of their audited annual financial statements prepared by qualified independent accountants to the members of the organizations in general meetings and file the same with the regulators in accordance with the applicable laws and regulations. Some require that the credibility of the audited financial statements should be certified by the company and attested by the statutory auditor before the filing with the regulatory authority, communication to the members of the company in a general meeting and release to the public.

In Nigeria, the certification and attestation of the credibility of the financial statements are mandatory compliance requirement as stipulated by the Companies and Allied Matters Act (CAMA) 2020 (cac.gov.ng), Investment and Securities Act (ISA) 2007 (The Securities and Exchange Commission, Nigeria), and the Financial Reporting Council Act (FRC Act) 2011 (FRC-Rules-Updated-Original-Rule-4-Inclusive.pdf (frcnigeria.gov.ng). CAMA 2020 section 386 requires that the audited financial statements (balance sheet and the profit and loss account annexed to it) shall be approved by the board of directors and signed on their behalf by two directors authorised to do so. CAMA 2020 requires that the Chief Executive Officer and Chief Financial Officer of all companies with shares registered with the Corporate Affairs Commission (CAC) to make the same certifications on the audited annual financial statements for filing with the Commission and reporting in the company’s annual general meeting. The small companies registered with CAC are exempted from this CAMA 2020 requirements. The enforcement of the relevant sections in CAMA 2020 relating to ICFR commences from the first-year end on commencement of business operation and completion of CAC registration. CAMA 2020 states that where a managing director, chief financial officer or person performing similar functions fails to discharge the duty imposed on him under the section, he commits an offence and is liable on conviction to a penalty as the Commission shall specify in its regulations.

The Financial Reporting Council Act (FRC Act) 2011 section 7(2g) requires the Chief Executive Officer and Chief Financial Office of the Public Interest Entities (PIE) to make certifications on their audited financial statements for filing with the Council. The enforcement of the compliance to the relevant sections of the FRC Act 2011 relating to ICFR is December 2024 Year End. The FRC Act 2011 further states that the relevant entities who fail to comply with the relevant sections shall be liable to civil, administrative and criminal sanctions within the latitude of the Financial Reporting Council of Nigeria Act 2011.

Similarly, the Investment and Securities Act section 60 requires that the Chief Executive Officer and Chief Financial Officer or officers or persons performing similar functions in a public company filing periodic or annual reports shall certify the audited financial statements and filed with the Securities and exchange commission. The enforcement for the compliance of the relevant sections of ISA 2007 relating to ICFR was initially December year end 2021 and later shifted to December 2023 Year End. Section 65 of the ISA Act 2007 states that Penalties for a public company who contravenes the provisions of sections is liable to a penalty of not less than N1,000,000 and a further penalty of N25,000 per day for the period the violation continues. An Auditor who contravenes the provisions of sections is liable to a penalty of N100,000 and a further penalty of N5,000 per day for the period the violation continues.