Sahel Foods Plc: privileged access and change control at a listed manufacturer

The framework

Severity is not decided by how many findings there are. It is decided by whether a deficiency, or a combination of deficiencies, creates a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected on a timely basis. The relevant factors are:

• Likelihood and magnitude: which financial statement accounts and disclosures the affected controls protect, and how large the exposure can be.
• Pervasiveness: whether the weakness is confined to one process or runs across the financial reporting environment.
• Compensating controls: whether detective controls - reconciliation, independent review, audit verification - operate effectively and in time.
• Detection history: whether the weaknesses were found by management or only by internal audit and, historically, whether errors have occurred.
• Aggregation: individually tolerable deficiencies can combine into a material weakness.

Application to the facts

• 14 shared privileged accounts with spreadsheet-stored passwords means activity cannot be attributed to an individual. This is a pervasive ITGC weakness affecting the whole ERP.
• A contractor with both development and production access removes the segregation that prevents unauthorised or untested changes reaching live financial processing.
• 23 changes without UAT evidence means changes affecting financial calculations can reach production unverified.
• Month-end spreadsheet adjustments of key reports with no review trail undermine the reliability of the reporting layer.

Provisional conclusion

A material weakness is the more defensible conclusion: the weaknesses are pervasive across the ERP, affect financial reporting directly, and no effective compensating detective control is described. A clean audit opinion does not rebut this - an audit can conclude the statements are fairly stated while internal control over financial reporting remains materially weak. The conclusion should be confirmed by testing whether reconciliations and auditor procedures genuinely operate at a level that would detect a misstatement.

Sequence by risk reduction per naira, not by ease

Days 0–30 - stop the bleeding

• Disable all 14 shared accounts; issue unique named accounts to provider staff with time-bound elevation through a privileged access management tool or, at minimum, a vaulted credential process with check-out and logging.
• Remove the contractor's production access immediately; separate development and production roles.
• Take the password spreadsheet out of service.
• Turn on and review privileged activity logging from the provider. Accountability: CISO, with the provider's account director jointly.

Days 30–90 - control change

• A change management workflow requiring documented UAT sign-off, approval and segregation for all production changes; a defined emergency change route with after-the-fact review within 48 hours.
• Retrospective review of the 23 recent changes for financial impact. Accountability: ERP change manager under the CFO.

Days 90–180 - reporting integrity

• Lock down the five key reports: control totals, independent review, versioned logic, and reconciliation to the general ledger. Remove manual adjustment rights except for named finance staff with review. Accountability: financial controller.

Interim compensating controls

Monthly independent re-performance or reconciliation of the five reports to the ledger; provider attestation of privileged access lists with a contractual right to audit; independent log review; and a quarterly ITGC confirmation to the audit committee.

Accountability

A single remediation programme owner - the CISO or CIO - with milestones reported monthly to the audit committee, and provider obligations embedded in the contract with service credits.

The committee should not accept a blanket deferral, and should separate the decision into its components.

Challenge the reasoning

The stated reasons - a clean prior audit opinion and the effect on bonuses - are not control considerations. A prior opinion is evidence about the financial statements, not about the design and operation of controls. Bonus impact is a remuneration question for the remuneration committee, not a basis for accepting control risk. The committee should record that distinction in its minutes.

Require a costed, phased plan

The ₦120m figure should be interrogated: how much is technology, how much is provider contract change, how much could be delivered in 30–90 days at low cost? The privileged access and segregation issues are largely configuration and contract enforcement, not capital projects. Deferring the whole programme is different from deferring the expensive reporting-layer redesign.

Consider disclosure and reporting obligations

As a listed entity, the committee should take advice on whether the weakness requires disclosure in the annual report or communication to the external auditor and, through them, to those charged with governance. It should ask the auditor directly whether the findings affect their audit approach or their view of internal control. Deferral must be an informed decision, documented, not a default.

Set the assurance rhythm

Require monthly progress against the 30/90/180-day milestones, interim compensating controls evidenced quarterly, and an independent validation before the weakness is declared closed. Escalate failure to the board risk committee. If management will not commit, the committee should say so in its report to shareholders rather than allow silent acceptance.