Recent audit findings in Nigeria have once again highlighted the importance of financial controls and accountability within organisations. Recent audit reports have highlighted issues related to procurement procedures, revenue management, payments, and compliance with financial regulations. Such findings reinforce the need for organisations to maintain effective systems that safeguard resources, support accurate financial reporting and ensure compliance with applicable requirements.
An audit query, by itself, does not establish wrongdoing. It raises a question that requires an explanation, supporting evidence, and, where necessary, corrective action. For directors, the issue is whether governance arrangements provide reasonable assurance that organisational resources are properly managed, risks are addressed, and identified weaknesses receive timely corrective attention.
This distinction matters for corporate governance. Audit queries are not merely accounting observations to be resolved by finance teams. They can reveal weaknesses in the systems through which an organisation authorises expenditure, protects assets, manages risks, complies with regulations and reports financial information. Where such weaknesses are material, persistent or repeatedly overlooked, they become matters for the board.
An audit query arises when an auditor identifies a transaction, process, or control that requires clarification, evidence, or corrective attention. A query may relate to inadequate documentation, an approval not properly obtained, an unexplained payment, a procurement process that did not follow the required procedures, or a failure to comply with an applicable rule.
An audit query should therefore not automatically be treated as proof of fraud or misconduct. Management may provide documents or explanations that resolve the matter. A governance concern arises when queries remain unresolved, recurring or exposing weaknesses that management has failed to correct.
For boards, the critical question is what an audit query says about the effectiveness of the organisation’s control environment. A recurring finding may indicate a poorly designed policy, an ineffective control or inadequate corrective action.
The Board’s Responsibility
Management is responsible for the day-to-day operation of financial controls, but the board remains responsible for oversight. This means directors should have sufficient information to understand material financial and control risks and should ask whether appropriate systems are in place to manage them.
Where audit findings identify weaknesses in procurement, revenue collection, payments or financial reporting, directors should seek to understand the cause, financial exposure, management response and proposed remedy. Board accountability does not mean that directors personally perform management’s control activities. It means ensuring that management operates effective controls and addresses deficiencies. Delegating implementation does not eliminate the board’s responsibility for oversight.
The Role of the Audit Committee
The audit committee is particularly important in this process. It should scrutinise material audit findings, assess management’s responses and monitor the implementation of agreed corrective measures.
Effective audit committee oversight requires independence, financial competence and willingness to challenge management when explanations are inadequate. The committee should have access to internal audit, external audit and relevant management information.
An audit committee that repeatedly receives the same unresolved findings should treat recurrence as a warning signal. It should ask why earlier recommendations were not implemented, who was responsible, what prevented resolution, and when the matter will be closed. This follow-up function can help prevent small control weaknesses from becoming larger financial or reputational problems.
Lessons for Organisations
The first lesson is that audit findings should lead to action, not simply acknowledgement. Management responses should identify specific corrective measures, responsible officers and reasonable completion dates.
Second, repeated audit queries deserve greater board attention. Recurrence may indicate that an organisation is treating symptoms without addressing the underlying weakness.
Third, internal controls must operate in practice. A policy manual may prescribe approvals, reconciliations, segregation of duties, and documentation, but these safeguards offer little protection when routinely bypassed.
Fourth, accountability for corrective actions must be clear. Each material finding should have an owner responsible for resolving it and reporting on progress.
Fifth, management should provide timely explanations and evidence in response to outstanding queries. Delayed responses can weaken confidence and make it harder to establish whether a transaction was properly authorised or supported.
Finally, boards should maintain visibility over material outstanding audit issues. A regular register of unresolved findings, risk levels, responsible officers, and status can support oversight and identify recurring weaknesses.
The Nigerian Governance Perspective
These expectations are consistent with the Nigerian Code of Corporate Governance 2018, which emphasises responsible board leadership, effective risk management, internal control, accountability, and appropriate oversight. The Code applies across sectors, while the Securities and Exchange Commission also requires public companies to comply with the NCCG and relevant corporate governance guidelines.
The governance principle is straightforward: boards should create conditions in which risks and control weaknesses are identified, reported, and addressed. Management implements controls and responds to findings. Internal audit assures controls and risk management, while external auditors assure financial reporting. The audit committee connects these assurance functions with the board.
The Code should not be viewed as a compliance requirements that end with policy approval. Its value is realised when directors use governance structures to question management, monitor risk and demand evidence that controls are working.
From Queries to Stronger Governance
Audit queries should be treated as early warning signals. They provide an opportunity to identify weaknesses before they lead to financial losses, sanctions, litigation, or reputational damage. The appropriate response is neither automatic acceptance nor dismissal, but rather an evidence-based review followed by corrective action when weaknesses are established.
For boards, this requires curiosity, independence and persistence. Directors should ask whether management has responded adequately, whether recommendations have been implemented, and whether similar weaknesses could arise elsewhere. Audit committees should maintain effective follow-up mechanisms, while internal and external auditors should communicate material concerns clearly and promptly.
Audit queries, ultimately, go beyond the numbers and accounting records. They signal how an organisation is governed. A board that receives repeated findings without demanding resolution may allow control weaknesses to become embedded in organisational practice. Conversely, a board that responds promptly, asks difficult questions, and monitors corrective action can turn audit findings into opportunities for stronger governance.
The real test of accountability is therefore not whether an organisation receives audit queries. It is whether the board ensures that the weaknesses behind those queries are properly investigated, addressed, and prevented from recurring. That is where financial control becomes corporate governance, and where board oversight becomes meaningful accountability.