Greenfield Agro Ltd: A Shared Login, a Fraudulent Payee and a Covenant Journal
Maya Achebe is financial controller of Greenfield Agro Ltd, a company with a ₦45m bank covenant measured on profit before tax. In November 2025 the company migrated to a cloud accounting package. Since then:
- All five finance staff use one shared 'finance' login, with the password pinned to the noticeboard.
- The system audit trail was switched off during data migration and never re-enabled.
- A junior accounts clerk holds administrator rights.
- In December a supplier emailed revised bank details; ₦6.2m was paid to the new account, which turned out to belong to a fraudster.
- Customer price lists and 5,000 customer records sit on a personal USB drive taken home by a clerk.
Year-end profit before tax is ₦34m. The finance director asks Maya to post a ₦12m manual journal reducing the allowance for doubtful debts so that profit reaches the covenant, saying 'everybody does this at year-end; the loan becomes repayable on demand otherwise'. Maya is a member of a professional body.
1. Identify and evaluate the ethical threats Maya faces and set out, with reasons, the course of action she should take.
Read the worked answer
The threat analysis.
- Intimidation threat: the finance director is senior to Maya and has linked the journal to the loan becoming repayable on demand, implying blame if she refuses.
- Self-interest threat: her own position, bonus and the company's survival appear to depend on the entry.
- Integrity and objectivity: the journal has no basis in evidence. The allowance must reflect the risk on receivables; reducing it by ₦12m without any change in the underlying debts misstates profit, receivables and equity, and misleads the bank.
- 'Everybody does this' is not a justification. The test is whether a reasonable and informed third party, aware of the facts, would accept the treatment. They would not.
Course of action.
- Ask for the evidence supporting the reduction. If none exists, decline to post it and record the request and her refusal in writing.
- Explain the consequences factually: the covenant breach must be disclosed and the loan may be reclassified as current, which affects going concern disclosure, not just the profit figure.
- Escalate to the audit committee or the non-executive directors; where there is none, to the most senior director not involved.
- If the matter is material and unresolved, take external professional advice and consider whether continuing in the role is compatible with her professional obligations.
- Do not sign the financial statements and do not mislead the external auditor. Confidentiality does not prevent disclosure of wrongdoing to the appropriate authority; it prevents casual disclosure.
Booking the entry would solve nothing in substance and would expose Maya personally, regardless of who instructed her.
2. Identify the IT control weaknesses revealed by the facts and recommend the specific control for each, including the payment fraud.
Read the worked answer
| Weakness | Risk | Recommended control |
|---|---|---|
| Shared 'finance' login with visible password | No accountability; any one of five staff can post anything | Unique user IDs, role-based access, strong passwords with MFA, immediate deactivation on leaving |
| Audit trail disabled | Transactions can be altered or deleted without trace; fraud undetectable | Audit trail switched on and its logs reviewed monthly; make re-enabling a condition of continued system use |
| Junior clerk with administrator rights | Anyone can change master data, user rights and supplier records | Segregation of duties; administrator rights restricted to a named IT officer; privileged access logged |
| Supplier bank details changed on the strength of an email | Payment diversion | Independent verification by callback to a known number before any change; two-person approval of new payees; review of all master file changes |
| ₦6.2m released without a second check | Loss | Dual authorisation on payments above a threshold; daily bank review; immediate bank and police report on discovery |
| Customer data on a personal USB drive | Data loss and breach of data protection law | Company-encrypted devices only; ban on personal removable media; data classification, retention and access policy; documented incident response |
The pattern behind all six is the absence of segregation of duties and of independent review - the same one or two people can initiate, process and conceal a transaction. Re-enabling the audit trail and separating administrator rights are the two changes that cost least and remove most of the exposure. The ₦6.2m fraud should also be treated as a reportable incident, with an assessment of whether it indicates a wider compromise of supplier master data.
3. Explain Maya's professional responsibilities in relation to confidentiality, the external auditor and the bank, distinguishing what she may disclose from what she must not.
Read the worked answer
Confidentiality is not secrecy. Maya must not disclose company information to outsiders for personal advantage or casually, but the duty operates within the law and within her professional obligations. The distinction is between revelation without authority (which is prohibited) and disclosure to the proper person for a proper purpose (which may be required or permitted).
External auditor. Maya must not mislead the auditor or withhold information relevant to the financial statements. If the ₦12m journal is posted, she must make the auditor aware of the covenant position, the pressure applied and the absence of supporting evidence. Providing information in the course of an audit is a normal, authorised disclosure to a party bound by its own confidentiality obligations. Actively helping to hide the journal would be a separate and more serious breach.
Audit committee / non-executives. Internal escalation is the first route and is not a breach of confidentiality at all - it is the discharge of her responsibility to the company as a whole rather than to one director.
The bank. The company, not Maya personally, communicates with the lender. Her duty is to ensure the financial statements and covenant compliance certificate are accurate; if the certificate is signed on misstated figures, that is a misrepresentation by the company. She should refuse to certify what she knows to be wrong and ensure the matter is disclosed.
Whistleblowing. Where internal escalation fails and the matter is serious, disclosure to an appropriate external body or regulator may be justified as a last resort. Confidentiality is not a shield for fraud.