Internal Controls for Nigerian SMEs: Payments Approvals Inventory and Fraud Prevention

Internal Controls for Nigerian SMEs: Payments Approvals, Inventory, and Fraud Prevention

Introduction: Why Internal Controls Matter for Nigerian SMEs

If you run a small or medium enterprise in Nigeria, you already know that cash flow is king. But what happens when that cash disappears due to fraud, an unauthorised payment, or a missing inventory item? For many Nigerian SMEs, the answer is simple: the business closes.

The regulatory environment in 2026 makes internal controls more important than ever. The Central Bank of Nigeria (CBN) has introduced sweeping reforms that directly affect how SMEs handle cash, process payments, and manage fraud. Since 1 January 2026, individual weekly cash withdrawals are capped at ₦500,000 and corporate withdrawals at ₦5 million, with excess charges of 3% for individuals and 5% for corporates (CBN Reforms). From 1 July 2026, new instant payment fraud-control rules require multi-factor authentication and real-time monitoring, with a temporary ₦20,000 transaction limit for the first 24 hours after a mobile banking app is activated on a new device (CBN Reforms).

For Nigerian public companies, the stakes are even higher. Under Sections 60–63 of the Investments and Securities Act 2007, CEOs and CFOs must certify that financial reports fairly present the company’s financial condition and that they are responsible for establishing and maintaining internal controls. The board must include a report on internal control effectiveness in annual reports (SEC Nigeria Guidance).

Even if your SME is not a public company, adopting these principles — segregation of duties, documented approval workflows, and regular reconciliations — reduces fraud, builds investor trust, and keeps you compliant with CBN regulations. This guide covers everything you need to know about payments approvals, inventory checks, and fraud prevention, with specific Nigerian Naira costs, required documents (BVN, NIN, CAC), and CBN-specific rules.

What Are Internal Controls? (And How SOX Fits In)

Definition of Internal Controls

The Securities and Exchange Commission (SEC) Nigeria defines internal controls as “policies, procedures, and practices put in place by management to ensure safety of assets, accuracy of financial records and reports, achievement of corporate objectives, and compliance with laws and regulations” (SEC Nigeria Guidance). This definition is the foundation for Nigeria’s internal control over financial reporting (ICFR) regime.

Three Types of Internal Controls

Internal controls fall into three categories:

1. Preventive controls — Stop errors or fraud before they happen. Examples: dual authorisation for payments, segregation of duties, password-protected systems.
2. Detective controls — Identify errors or fraud after they occur. Examples: bank reconciliations, inventory counts, transaction monitoring.
3. Corrective controls — Fix problems once detected. Examples: refund policies, error-correction procedures, disciplinary actions.

SOX and Its Nigerian Equivalent

The Sarbanes-Oxley Act (SOX) is a US law passed in 2002 that requires CEOs and CFOs of public companies to personally certify the accuracy of financial statements and the effectiveness of internal controls. SOX does not directly apply to Nigerian companies, but Nigeria has its own equivalent.

Under Sections 60–63 of the Investments and Securities Act 2007, Nigerian public companies must:

• Include a management report on internal controls in annual reports
• Have CEOs and CFOs certify that financial reports fairly present financial condition
• Ensure external auditors attest to management’s assessment of internal controls (SEC Nigeria Guidance)

The SEC Nigeria guidance permits the use of the COSO (Committee of Sponsoring Organizations) framework or any other suitable recognised framework for management’s ICFR evaluation (SEC Nigeria Guidance).

Why Nigerian SMEs Should Care About SOX-Style Controls

Even if SOX doesn’t apply to your SME, the principles behind it are universal. CBN regulations now demand stronger controls for all businesses. The CBN’s Corporate Governance Guidelines require banks and financial holding companies to ensure an efficient internal control system, establish a delegation-of-authority framework with transaction thresholds, and ensure internal audit functions are not outsourced (CBN Corporate Governance Guidelines). While these guidelines directly apply to banks, they represent best practice for any Nigerian business.

Additionally, the Nigerian Code of Corporate Governance (NCCG) 2018, issued by the Financial Reporting Council (FRC), is mandatory for public companies, with non-compliance punishable by fines and other sanctions (SEC Nigeria Guidelines). SMEs that adopt these standards early position themselves for growth, investment, and easier access to credit.

Key Components of Internal Controls for Nigerian SMEs

1. Payments Approvals

Payments are the lifeblood of any business, but they are also the most common target for fraud. Here is how to build strong payment controls:

Dual Authorisation Set a threshold — for example, ₦100,000 — above which no single person can approve a payment. Two authorised signatories must approve every transaction above this limit. This is a basic preventive control that stops a single employee from diverting funds.

Vendor Verification Using BVN Before onboarding a new vendor, verify their Bank Verification Number (BVN) against their bank account details. This prevents “ghost vendors” — fake suppliers created by employees to siphon money. Your bank can help with BVN verification, or you can use third-party services.

CBN’s New-Device App Limit Under the CBN’s instant payment fraud-control rules effective 1 July 2026, any mobile banking app activated on a new device has a temporary transaction limit of ₦20,000 for the first 24 hours (CBN Reforms). Ensure your finance team is aware of this limit and plans large payments accordingly.

Cash Withdrawal Controls Since 1 January 2026, individual weekly cash withdrawals are capped at ₦500,000 and corporate withdrawals at ₦5 million across all channels. Excess withdrawals incur charges of 3% for individuals and 5% for corporates (CBN Reforms). Your payment approval workflow must include a check against these limits before any cash withdrawal is processed.

2. Inventory Controls

For SMEs that hold physical stock, inventory is often the largest asset on the balance sheet. Poor inventory controls lead to shrinkage, theft, and inaccurate financial reporting.

Cycle Counts and Full Reconciliation Perform cycle counts of high-value items monthly and a full physical inventory reconciliation quarterly. Compare the physical count to your inventory system and investigate discrepancies immediately.

Segregation of Duties in Inventory The person who orders stock must not be the same person who receives it, and neither should be the person who pays for it. This three-way separation — ordering, receiving, and payment — is a classic internal control that prevents collusion and theft.

Three-Way Matching Before paying a supplier invoice, match three documents:

• Purchase Order (PO) — what you ordered
• Goods Received Note (GRN) — what you received
• Invoice — what the supplier is charging

If any of these three documents do not match, stop the payment and investigate.

3. Fraud Prevention

Fraud is a real threat for Nigerian SMEs. The CBN’s 2026 reforms include several measures that SMEs can adopt.

Employee Background Checks Using NIN Before hiring any employee who will handle money or inventory, verify their National Identification Number (NIN). This helps confirm identity and reduces the risk of employing someone with a history of fraud.

Whistleblower Policy The CBN’s Corporate Governance Guidelines require board-level oversight of whistleblower mechanisms for banks (CBN Corporate Governance Guidelines). SMEs can adopt a simpler version: a confidential email address or phone number where employees can report suspicious activity without fear of retaliation.

Segregation of Duties No single person should control an entire transaction from start to finish. For example:

• The person who raises a purchase order should not approve it
• The person who approves a payment should not also reconcile the bank statement
• The person who counts inventory should not also update the inventory system

Supplier Bank-Detail Call-Back Verification Before making a payment to a new or changed supplier bank account, call the supplier using a phone number you have on file (not the one on the invoice) to confirm the account details. This simple step prevents invoice fraud, where fraudsters intercept invoices and change the bank account number.

Monthly Bank Reconciliation Reconcile your bank statements every month, no exceptions. Compare every transaction in your accounting system to the bank statement. Investigate any unmatched items immediately.

Step-by-Step Guide to Implementing Internal Controls (With ₦ Costs & Timelines)

Step 1: Assess Current Processes (Free, 1 Week)

Map out who does what in your business. Create a simple flowchart showing:

• Who raises purchase orders
• Who approves payments
• Who receives inventory
• Who reconciles bank statements
• Who has access to the bank app

Identify any points where one person controls an entire process. These are your highest-risk areas.

Cost: Free (your time) Timeline: 1 week Required documents: None

Step 2: Document Policies (Free Templates or Outsourced)

Write down your internal control policies. Include:

• Delegation-of-authority framework with transaction thresholds (who can approve what amount)
• Payment approval workflow
• Inventory counting schedule
• Fraud reporting procedure

The CBN’s Corporate Governance Guidelines require a delegation-of-authority framework with transaction thresholds for banks (CBN Corporate Governance Guidelines). Your SME should adopt the same approach.

Cost: Free templates available online; outsourcing to a consultant costs vary (current verified pricing data was unavailable) Timeline: 1–2 weeks Required documents: CAC registration certificate, list of bank signatories

Step 3: Set Up Payment Approval Workflows (₦0–Variable)

Most Nigerian banks offer multi-signatory accounts where two or more people must approve a payment. Set this up with your bank. For example:

• Access Bank, First Bank, GTBank, UBA, and Zenith Bank all offer corporate accounts with dual or triple signatory requirements
• You can also use accounting software like QuickBooks Nigeria to enforce approval workflows

Ensure you comply with the CBN’s instant payment fraud-control rules: enable multi-factor authentication for all payment approvals (CBN Reforms).

Cost: ₦0 if using your bank’s existing multi-signatory feature; software costs vary (current verified pricing data was unavailable) Timeline: 1–3 days for bank setup; 1–2 weeks for software implementation Required documents: BVN of all signatories, board resolution (if registered), CAC registration

Step 4: Implement Inventory Tracking (Free or Software)

For small inventories, Excel is sufficient. Create a simple spreadsheet with columns for:

• Item name and SKU
• Quantity on hand
• Reorder level
• Unit cost
• Total value

For larger inventories, consider inventory management software. Current verified pricing data for Nigerian-specific inventory software was unavailable, but options include:

• Sage 50 Nigeria (accounting with inventory module)
• Zoho Inventory (cloud-based)
• SeamlessHR (Nigerian HR and inventory platform)

Cost: Excel is free; software costs vary (current verified pricing data was unavailable) Timeline: 1 day for Excel; 1–2 weeks for software setup Required documents: NIN of staff responsible for inventory

Step 5: Train Staff (₦10,000–₦30,000 per Session)

Train your team on the new policies. Cover:

• Payment approval thresholds and procedures
• CBN cash withdrawal limits (individuals ₦500,000/week; corporates ₦5 million/week)
• CBN instant payment fraud controls (multi-factor authentication, new-device limit of ₦20,000)
• How to spot and report fraud
• Inventory counting procedures

Cost: ₦10,000–₦30,000 per session (internal or external trainer) Timeline: 1 day per session Required documents: Attendance register, training materials

Required Documents Summary

Comparison Table: Manual vs Automated Internal Controls

Note: The CBN deployed a Cybersecurity Self-Assessment Tool (CSAT) on 30 March 2026, requiring regulated financial institutions to strengthen cybersecurity governance (CBN Reforms). Automated controls make it easier to demonstrate compliance with these requirements.

Frequently Asked Questions About Internal Controls and SOX in Nigeria

Q1: What is the difference between internal controls and SOX?

Internal controls are the policies, procedures, and practices a business uses to ensure accurate financial reporting, protect assets, and comply with laws. SOX (Sarbanes-Oxley Act) is a US law that requires CEOs and CFOs of public companies to certify the effectiveness of those internal controls. Nigeria has its own equivalent under Sections 60–63 of the Investments and Securities Act 2007, which imposes similar certification requirements on Nigerian public companies (SEC Nigeria Guidance).

Q2: Does SOX apply to Nigerian SMEs?

No. SOX is a US law that applies to US public companies and their subsidiaries. However, the principles behind SOX — segregation of duties, documented approval workflows, CEO/CFO certification — are relevant to any Nigerian SME that wants to reduce fraud and build investor trust.

Q3: What are the CBN’s cash withdrawal limits for 2026?

Since 1 January 2026, individual weekly cash withdrawals are capped at ₦500,000 and corporate withdrawals at ₦5 million across all channels. Excess withdrawals incur charges of 3% for individuals and 5% for corporates (CBN Reforms).

Q4: What are the CBN’s instant payment fraud-control rules?

Effective 1 July 2026, banks must:

• Let customers disable instant transfers voluntarily
• Enforce multi-factor authentication for opt-in/opt-out
• Deploy real-time enterprise fraud monitoring
• Apply a temporary ₦20,000 transaction limit for the first 24 hours after a mobile banking app is activated on a new device (CBN Reforms)

Q5: What documents do I need to set up internal controls?

You will need:

• BVN (Bank Verification Number) for all signatories and vendors
• NIN (National Identification Number) for employee background checks
• CAC registration certificate
• Bank signatory list
• Board resolution (if your business is registered)

Q6: How much does it cost to implement internal controls?

Basic manual controls (Excel, paper-based approvals) cost nothing beyond your time. Automated controls using accounting or inventory software vary in cost; current verified pricing data for Nigerian-specific providers was unavailable at the time of writing. Bank multi-signatory accounts are typically free.

Q7: What is the Nigerian equivalent of SOX?

Nigeria’s equivalent is found in Sections 60–63 of the Investments and Securities Act 2007. The SEC Nigeria guidance requires public companies to include a management report on internal controls in annual reports, have CEOs and CFOs certify financial reports, and have external auditors attest to management’s ICFR assessment (SEC Nigeria Guidance).

Q8: What is the COSO framework?

COSO (Committee of Sponsoring Organizations) is a widely recognised framework for designing and evaluating internal controls. The SEC Nigeria guidance permits the use of COSO or any other suitable recognised framework for management’s ICFR evaluation (SEC Nigeria Guidance).

Q9: How often should I reconcile my bank statements?

Monthly, at minimum. For businesses with high transaction volumes, weekly or daily reconciliation is better. Automated reconciliation tools can help.

Q10: What is three-way matching?

Three-way matching is a control that compares three documents before paying a supplier invoice:

• Purchase Order (PO) — what you ordered
• Goods Received Note (GRN) — what you received
• Invoice — what the supplier is charging

If any document does not match, stop the payment and investigate.

What to Do Next

Internal controls are not a one-time project — they are an ongoing commitment. Here is your action plan for the next 30 days:

1. This week: Map your current processes and identify any single points of failure (one person controlling an entire transaction).
2. Next week: Document your policies, including a delegation-of-authority framework with transaction thresholds.
3. By week 3: Set up multi-signatory payment approvals with your bank and enable multi-factor authentication.
4. By week 4: Train your team on the new policies, CBN cash withdrawal limits, and fraud reporting procedures.

Remember: the goal is not perfection from day one. Start with the highest-risk areas — payments and inventory — and build from there. Every control you add reduces your risk of fraud and positions your SME for growth.

For more guidance, refer to the SEC Nigeria Guidance on Sections 60–63 of the Investments and Securities Act 2007 (SEC Nigeria Guidance) and the CBN’s Reforms and Initiatives page (CBN Reforms).

Related reading

• Business Loan Readiness Checklist for Nigerian SMEs
• Best Solar Solutions for Nigerian Homes & SMEs: Powering Up Smartly