Corporate Administration and Compliance
Scope
Corporate Administration and Compliance tests the systems that keep an organisation lawful, ethical and resilient: statutory filings, internal controls, risk registers, data protection and financial crime controls.
Core rules
- Compliance framework. Identify obligations, assign owners, set controls, monitor, report and remediate. Compliance is not only legal advice; it is an operating system.
- Statutory administration. Maintain CAC filings, minute books, registers, licences and sector returns. Late or inaccurate filings are compliance failures.
- Risk and controls. Use a risk register with likelihood and impact; apply segregation of duties, authorisation limits, reconciliations and audit trails. COSO is a common internal-control framework.
- Data protection. The Nigeria Data Protection Act 2023 imposes duties on data controllers and processors, including lawful basis, security and breach notification.
- Financial crime. Apply customer due diligence, sanctions screening and suspicious-transaction reporting under anti-money laundering rules.
Worked example
A company suffers a data breach affecting customer records. The compliance officer should activate the incident response plan, contain the breach, assess risk, notify the Nigeria Data Protection Commission within the statutory window where required, inform affected customers if there is high risk, and document remediation. The reasoning is that breach response is a legal obligation and a governance test, not merely an IT fix.
Traps
Do not confuse the data controller with the processor; do not treat compliance as a one-off audit; do not keep risk registers without owners; and do not assume a policy document is a control.
Key check
For each obligation, ask: who owns it, what evidence proves compliance, and what happens when it fails?