Importance of Segregation of Duties in Financial Reporting: How SOD Prevents Fraud in Nigerian Organisations

Introduction

Among the most fundamental and powerful internal controls available to any organisation, segregation of duties stands in a class of its own. It is not a new concept. It is not a complicated one. But in Nigerian organisations  across financial services, manufacturing, oil and gas, the public sector, and beyond  the failure to implement and enforce proper segregation of duties remains one of the single most common root causes of financial fraud, material misstatement, and audit failure.

Segregation of duties, or SOD, is the practice of dividing critical financial tasks and responsibilities among multiple individuals so that no single person controls an entire process from beginning to end. When properly designed and consistently enforced, it makes fraud exponentially more difficult to commit and significantly easier to detect. When it is absent or poorly implemented, it creates the conditions in which one determined or dishonest individual can cause enormous financial harm before anyone notices.

This article explores what segregation of duties means, why it is indispensable to financial reporting integrity in Nigeria, how it prevents fraud, and what Nigerian finance and audit leaders must know about the latest developments in SOD management and compliance.

1. The Internal Control Crisis in Nigerian Financial Reporting

To appreciate why segregation of duties matters so profoundly, it helps to first understand the environment in which Nigerian financial reporting operates and where it most commonly breaks down.

Financial reporting failures in Nigeria are not primarily caused by complex accounting standards or sophisticated fraud schemes. In the majority of cases examined by forensic investigators, external auditors, and regulatory bodies, the root cause is strikingly simple: one person had too much access and too much unchecked authority over a financial process, and nobody was watching closely enough.

The EFCC, the Financial Reporting Council of Nigeria, and external auditors consistently identify weak internal controls  and specifically inadequate segregation of duties  as a primary enabler of the financial fraud and misreporting that damages Nigerian businesses, erodes investor confidence, and undermines the credibility of Nigerian financial markets. Ghost workers on public sector payrolls, fictitious vendor payments, unauthorised journal entries that mask losses, and procurement fraud involving inflated purchase orders  virtually all of these share a common thread: the absence of meaningful separation between the individual who initiates a transaction, the individual who approves it, and the individual who records and reconciles it.

For Nigerian CFOs, finance directors, internal auditors, and board members, understanding and enforcing segregation of duties is not optional. It is the bedrock on which trustworthy financial reporting is built.

2. Key Definition: What Is Segregation of Duties?

A precise understanding of what segregation of duties means in practice is the essential foundation for designing and enforcing it effectively.

Segregation of duties (SOD) is an internal control principle that requires the responsibilities for authorising transactions, recording and processing transactions, and maintaining custody of the resulting assets to be divided among at least two or more separate individuals. The underlying logic is that requiring collusion between multiple people to commit or conceal fraud dramatically reduces the likelihood that fraud will occur and significantly increases the probability that it will be detected if attempted.

In financial reporting specifically, SOD ensures that the person who initiates a payment cannot also approve it, the person who records a journal entry cannot also reconcile the account it affects, and the person who manages vendor relationships cannot also authorise vendor payments. Each of these separations creates a check— a moment at which a second set of eyes must engage with a transaction before it can be completed.

Reference: This definition is adapted from the American Institute of Certified Public Accountants (AICPA) — Internal Control — Integrated Framework: Understanding the COSO Framework, a foundational educational resource for finance, audit, and governance professionals worldwide. Available at: https://www.aicpa-cima.com/resources/article/understanding-internal-controls

3. Why Segregation of Duties Is Critical to Financial Reporting in Nigeria

The theoretical case for SOD is well established globally. But the specific Nigerian context makes it not just important  it makes it urgent.

3.1 The Scale of Fraud Enabled by SOD Failures

The Association of Certified Fraud Examiners consistently finds in its global research that a lack of internal controls  with inadequate segregation of duties specifically cited  is the most common factor enabling occupational fraud. In Nigeria, where the ACFE estimates fraud losses across the economy run into billions of naira annually, the stakes are acute. When a single employee can create a vendor, approve a purchase order, authorise a payment, and reconcile the bank account  all without any independent check  the temptation and opportunity for fraud are almost irresistible for individuals under financial pressure or with dishonest intent.

3.2 Regulatory Expectations in Nigeria

Nigerian regulators have made it increasingly clear that adequate internal controls, including SOD, are a baseline expectation rather than a best practice aspiration. The CBN’s guidelines on internal controls for banks, the Financial Reporting Council of Nigeria’s corporate governance codes, the SEC’s rules on internal controls for listed companies, and PENCOM’s investment guidelines all either explicitly reference or clearly imply SOD requirements. Organisations that cannot demonstrate adequate separation of duties face regulatory censure, increased scrutiny during examinations, and in severe cases, sanctions and remediation orders.

3.3 The Financial Reporting Integrity Imperative

For Nigerian companies that are listed on the NGX, seeking international capital, undergoing external audits, or reporting to international parent organisations, the integrity of financial statements is non-negotiable. External auditors assess SOD as part of their evaluation of the internal control environment. Weak SOD raises the risk of material misstatement, triggers expanded audit procedures, increases audit fees, and in the worst cases leads to qualified or adverse audit opinions that can have severe market and regulatory consequences. Investors and lenders  both domestic and international  price governance risk their decisions, and visible SOD weaknesses raise that price significantly.

3.4 The Ghost Worker and Payroll Fraud Connection

Nigeria’s persistent ghost worker problem  in which fictitious employees are maintained on payrolls and their salaries diverted by insiders  is almost universally enabled by a failure of segregation of duties in the human resources and payroll process. When the same individual or team that onboards employees also processes payroll and reconciles payroll accounts, the segregation that would expose ghost workers simply does not exist. Proper SOD in the payroll process  separating HR administration, payroll processing, payment authorisation, and payroll reconciliation into distinct roles  is the most direct and effective control against this pervasive fraud type.

4. The Four Key Duties That Must Be Separated

In practice, effective SOD requires clear thinking about which specific responsibilities need to be kept apart. There are four core duties at the heart of every well-designed SOD framework.

4.1 Authorisation

The authority to approve a transaction  to say that a payment should be made, that a journal entry should be posted, or that a contract should be awarded  must sit with an individual who is independent of the person who initiated and who will process the transaction. Authorisation is the gatekeeper function. When it is bundled with initiation or processing, the gate is effectively unmanned.

4.2 Recording

The responsibility for recording transactions in the financial system, posting journal entries, maintaining the general ledger, updating the fixed asset register  must be separated from both the authorisation and custody functions. An individual who can both authorise a transaction and record it in the books has the ability to create fictitious transactions and conceal them within the accounting records without any independent verification.

4.3 Custody

Physical or electronic custody of assets  including cash, inventory, securities, and access credentials to financial systems  must be managed by individuals who do not also have recording or authorization responsibilities. In Nigerian organisations, this is particularly important for cash handling, inventory management, and the administration of banking access credentials, where custody-related fraud is a persistent risk.

4.4 Reconciliation

The reconciliation function  comparing records to physical counts, bank statements, or system reports to verify accuracy and completeness  is the detective control that catches errors and fraud that slipped through other controls. For reconciliation to work as a control, it must be performed by someone who was not involved in the underlying transactions being reconciled. When the same person who processes payments also reconciles the bank account, the reconciliation provides no real assurance whatsoever.

5. SOD in an Automated and ERP Environment

As more Nigerian organisations move to ERP systems and automated financial processes, the nature and implementation of SOD must evolve accordingly.

5.1 SOD in SAP, Oracle, and Other ERP Platforms

Enterprise Resource Planning systems such as SAP, Oracle Financials, and Microsoft Dynamics implement SOD through system-level access controls  specifically through the assignment of roles and authorisations that determine which transactions each user can initiate, approve, and record. In theory, ERP systems make SOD enforcement more rigorous and consistent. In practice, many Nigerian organisations have implemented ERP systems with poorly designed access controls that replicate or even worsen the SOD violations that existed in their manual processes.

Common ERP SOD violations in Nigerian organisations include users assigned to multiple conflicting roles  for example, a role that allows both vendor creation and vendor payment, excessive use of superuser or administrator access that bypasses all control restrictions, and inadequate periodic review of user access rights to detect access creep over time. Internal audit and IT security teams must work together to identify and remediate these ERP-level SOD conflicts on an ongoing basis.

5.2 Compensating Controls Where Full SOD Is Not Possible

In smaller Nigerian organisations  particularly SMEs and small public sector entities achieving full segregation of duties across all processes may not be practical due to limited staff numbers. In these cases, compensating controls become essential. Compensating controls are alternative measures that partially substitute for the protection that full SOD would provide. Examples include enhanced management review and approval of transactions, more frequent and independent reconciliation by owners or senior management, external bookkeeping or payroll processing by third parties, rotation of staff across financial roles, and increased frequency of internal and external audit procedures focused on high-risk processes. Compensating controls do not eliminate SOD risk  but they can reduce it to a manageable level when full separation is genuinely impractical.

6. What Is Changing in SOD Management in 2025–2026

The way organisations design, monitor, and enforce segregation of duties is changing rapidly. Nigerian finance and audit leaders must understand these developments to stay current.

6.1 Automated SOD Conflict Detection Is Now Standard Practice

In 2025, the expectation that organisations manually review SOD conflicts through periodic access rights audits has given way to the expectation of continuous, automated SOD monitoring. Leading GRC platforms  including SAP GRC Access Control, MetricStream, and AuditBoard  now provide real-time SOD conflict detection engines that continuously scan user access rights, flag violations as they occur, and generate automated alerts for review and remediation. For Nigerian organisations with ERP systems, implementing automated SOD monitoring is no longer an advanced practice  it is becoming the baseline expectation of external auditors, regulators, and audit committees.

6.2 The IIA’s 2025 Standards Place Greater Emphasis on Control Environment Assessment

The IIA’s revised International Standards, effective from January 2025, place significantly greater emphasis on the internal audit function’s responsibility to assess the adequacy of the internal control environment  including SOD  as a core assurance obligation. Standard 9.2 now explicitly requires internal auditors to evaluate whether the organisation’s control environment is appropriately designed to prevent and detect material errors and fraud. For Nigerian internal audit teams, this means that SOD assessment must become a structured and documented component of every significant financial process audit, rather than an informal observation.

6.3 Remote Work Has Created New SOD Vulnerabilities

The acceleration of hybrid and remote working arrangements in Nigerian organisations since 2022 has created new SOD challenges that many finance and audit teams have not yet fully addressed. When financial processes that previously relied on physical separation  for example, requiring a second authorised signatory to be physically present to release a payment  move to digital environments, the SOD controls must be redesigned for the digital context. In 2025, Nigerian banks and financial institutions received specific CBN guidance noting that remote and digital operational models must maintain equivalent SOD standards to in-person processes, with system-enforced controls rather than manual workarounds.

6.4 Forensic Audit Findings Are Driving Board-Level SOD Scrutiny

A series of high-profile forensic audit findings published in 2024 and 2025  involving Nigerian state-owned enterprises, financial institutions, and listed companies  have placed SOD directly in the boardroom spotlight. Audit committees across Nigeria are now asking more pointed questions about SOD adequacy than at any previous point. This heightened scrutiny is translating into increased internal audit mandates to assess and report on SOD, increased investment in access control reviews, and in some organisations a formal SOD policy approved at board level for the first time.

6.5 FRCN’s Enhanced Corporate Governance Code Tightens SOD Expectations

The Financial Reporting Council of Nigeria’s enhanced corporate governance code, updated in 2025, includes strengthened provisions relating to internal control adequacy for listed and public interest entities. The updated code places explicit responsibility on the board and audit committee to satisfy themselves that management has implemented adequate segregation of duties across all material financial reporting processes. Boards that cannot demonstrate this oversight face increased scrutiny from the FRCN during governance assessments and potential public disclosure requirements regarding internal control deficiencies.

7. Designing an Effective SOD Framework for Your Nigerian Organisation

Knowing that SOD matters is the first step. Building a practical, enforceable SOD framework that works in the Nigerian organisational context is the critical next step.

An effective SOD framework begins with a comprehensive mapping of all financial processes and the roles involved in each step of those processes. This process map is then used to identify all actual or potential conflict  points at which the same individual has access to two or more of the four key duties that should be separated. Each conflict is assessed for its risk level, and a remediation plan is developed that either eliminates the conflict through role redesign or addresses it through a formally documented and monitored compensating control.

The framework must be supported by a formal SOD policy approved by the board or audit committee, clear role definitions in both the HR and IT systems, periodic access rights reviews  ideally automated and continuous and a process for managing SOD exceptions where business necessity requires a temporary deviation from the framework. Every exception must be formally documented, risk-assessed, time-limited, and subject to enhanced monitoring for the duration of the exception.

Internal audit plays a critical role in the ongoing assurance of the SOD framework, testing not just whether controls exist on paper but whether they are functioning effectively in practice. SOD testing should be a standing component of every internal audit engagement that touches financial reporting processes.

8. References

1. American Institute of Certified Public Accountants (AICPA) — Understanding Internal Controls: The COSO Framework. Available at: https://www.aicpa-cima.com/resources/article/understanding-internal-controls
   
2. Committee of Sponsoring Organisations of the Treadway Commission (COSO) — Internal Control — Integrated Framework (2013). Available at: https://www.coso.org/guidance-on-ic
   
3. Association of Certified Fraud Examiners (ACFE) — Report to the Nations on Occupational Fraud and Abuse. Available at: https://www.acfe.com/report-to-the-nations
   
4. Financial Reporting Council of Nigeria (FRCN) — Nigerian Code of Corporate Governance. Available at: https://www.financialreportingcouncil.gov.ng
   
5. Central Bank of Nigeria — Guidelines on Internal Controls for Banks and Other Financial Institutions. Available at: https://www.cbn.gov.ng
   
6. The Institute of Internal Auditors — International Standards for the Professional Practice of Internal Auditing. Available at: https://www.theiia.org/en/standards/
   
7. SAP — GRC Access Control and SOD Conflict Detection. Available at: https://www.sap.com/products/financial-management/grc.html
   
8. MetricStream — SOD and Access Risk Management. Available at: https://www.metricstream.com
   

Is Your Organisation’s Financial Reporting Protected by Proper Segregation of Duties?

The uncomfortable truth is that many Nigerian organisations  including some with sophisticated finance teams and established external audit relationships  are operating with significant SOD gaps that they have not yet identified. These gaps are not theoretical risks. They are live vulnerabilities that fraudsters and dishonest insiders can and do exploit, often for extended periods before detection.

A well-designed, properly enforced segregation of duties framework is one of the highest-return investments a Nigerian finance leader can make. It deters fraud before it starts, detects problems faster when controls are tested, satisfies regulatory expectations, and gives your board and audit committee the genuine assurance they need that your financial reporting can be trusted.

At Mocaccountants, we help Nigerian organisations assess, design, and strengthen their segregation of duties frameworks  from initial SOD gap assessments and process mapping through policy design, ERP access control reviews, compensating control frameworks, and internal audit SOD testing programmes. We understand the Nigerian regulatory environment, the practical realities of Nigerian organisational structures, and the specific fraud risks that SOD failures enable in the Nigerian context.

Our internal controls and SOD services include:

SOD Gap Assessments and Process Mapping | ERP Access Rights Reviews and Conflict Analysis | SOD Policy and Framework Design | Compensating Control Framework Development | Internal Audit SOD Testing Programmes | Board and Audit Committee Reporting on Internal Control Adequacy | Finance Team Training on SOD Principles and Practice

Do not wait for a fraud incident or a regulatory finding to discover your SOD gaps. Contact Mocaccountants today and let us help you build financial reporting controls you can genuinely rely on.

Tel: (+234) 802 320 0801, (+234) 807 576 5799
E-Mail: enquiry@mocaccountants.com
Office Address: 5, Ishola Bello Close, Off Iyalla Street, Alausa, Ikeja, Lagos, Nigeria