Risk & Compliance
A Nigerian-context examination of how organisations identify uncertainty, design controls, meet obligations and build governance systems that work in practice.
Risk management is most useful when it is connected to strategy, operations and accountability. Compliance is most useful when it is embedded in the way an organisation makes decisions rather than treated as paperwork after the fact. This discourse explores the relationship between risk, internal control, governance and organisational performance in Nigeria.
Risk is an organisational issue
A risk register by itself does not make an organisation resilient. Effective risk management connects material risks to owners, controls, indicators, decisions and escalation. In Nigerian organisations, this may include financial, regulatory, operational, technology, cyber, fraud, people, reputation, supply-chain, foreign-exchange and business-continuity risks.
Internal control that works
Controls should answer a practical question: what prevents, detects or corrects an unacceptable outcome? Strong control environments combine segregation of duties, authorisation, reconciliations, access controls, documentation, exception reporting, independent review and clear accountability. Controls also need to reflect how work is actually performed, especially where businesses rely heavily on manual processes and multiple approval layers.
The Nigerian regulatory environment
Companies operate within overlapping legal and regulatory expectations. Corporate governance, financial reporting, sector regulation, tax obligations, data and technology requirements, anti-money-laundering controls and employment obligations can all affect risk. The Corporate Affairs Commission administers the corporate registry and compliance framework under CAMA, while the Financial Reporting Council oversees important aspects of financial reporting and corporate governance. The right response is not to create disconnected compliance silos but to build an integrated obligations-and-controls architecture.
Board and management responsibilities
Boards should understand the organisation's material risks, risk appetite, control weaknesses and remediation priorities. Management must translate that direction into operating procedures, resources, monitoring and accountability. Internal audit and assurance functions then provide independent insight into whether the system is operating as intended.
Questions for professional inquiry
Which risks could prevent the strategy from being achieved? Which controls are critical and which are merely habitual? Where does management rely on spreadsheets or informal approvals? Which regulatory obligations lack a named owner? How quickly would the board know about a significant control failure? These questions turn risk and compliance from a reporting exercise into a management discipline.
Professional perspective
This discourse is intended to support informed professional conversation. It does not present unpublished opinions, client-confidential information or unverified claims as established fact. Where a topic depends on current regulation, economic data or a specific transaction, the relevant primary source and date should be checked before relying on the analysis.
Bring the question into the professional room.
For advisory, professional knowledge, research or executive discussion, begin with the issue you are trying to understand or solve.