Risk Oversight at Zennith Allied Industries Plc
Zennith Allied Industries Plc is a Nigerian consumer-goods company listed on the NGX with revenue of ₦18.4 billion and eight subsidiaries. Its board risk and audit committee has not met for eleven months: the chair resigned in March 2024 and was not replaced. The enterprise risk register was last refreshed fourteen months ago and lists only 19 risks, all rated medium or low. The chief risk officer left eight months ago; her duties were assigned informally to the chief financial officer, who also supervises internal audit. In the last quarter the managing director approved two related-party contracts worth ₦1.3 billion without board or committee approval, relying on a 2019 delegation-of-authority matrix that has never been reviewed. A whistleblower has written to the company secretary alleging that a subsidiary depot manager pays regular returns to a director's private company. The company secretary, a Fellow of ICSAN, is asked by the MD to keep the matter in-house until after the annual general meeting.
1. Identify the risk-governance failures in this scenario and explain why each is material, with reference to the Nigerian Code of Corporate Governance 2018 and the SEC Code of Corporate Governance for Public Companies.
Read the worked answer
The failures are structural, not administrative. (1) A dormant board risk committee means risk appetite, top risks and treatment plans are never challenged; the board has delegated oversight but cannot delegate accountability. (2) Assigning the CRO duties to the CFO, who also supervises internal audit, merges the second and third lines. Internal audit cannot objectively review finance controls when its reporting line is the finance controller. (3) A 14-month-old register with 19 risks all rated medium or low is not credible; it suggests no identification of strategic, emerging or fraud risks and no link to strategy. (4) The unreviewed 2019 delegation matrix allowed ₦1.3 billion related-party contracts to bypass the board; related-party transactions require independent approval and disclosure, and the director's interest must be declared. (5) The whistleblowing allegation implicates a director, yet the channel is not independent of management, creating a concealment risk.
Materiality: each failure breaks a control or governance principle in the NCCG 2018 and the SEC Code, and together they create a chain: no committee oversight, no independent risk function, no reliable risk information, weak approval discipline and suppressed challenge. The highest-priority issues are the related-party approvals and the whistleblower allegation because they raise integrity and possible criminal conduct; next is internal audit independence, because without it the board is blind.
2. Advise the company secretary on how to handle the MD's instruction and the whistleblower's allegation, including documentation, escalation and personal professional exposure.
Read the worked answer
The company secretary's duty is to the company, not to the MD. Accepting an instruction to keep a board-level allegation in-house risks breaching the ICSAN Code of Professional Ethics and Conduct, the duty of objectivity and the officer duties under CAMA. It also risks personal regulatory and disciplinary exposure.
Steps: (1) Make a contemporaneous file note of the MD's instruction; follow up with a short email confirming your advice and the request received. (2) Escalate to the board chair and audit committee chair; if either is conflicted because the allegation involves a director, go to the senior independent director. (3) Recommend an independent investigation with written terms of reference, external counsel or forensic support, and a conflict-of-interest protocol. (4) Protect the whistleblower's identity and explain the limits of confidentiality; do not promise what cannot be delivered. (5) Place the related-party contracts on the board agenda for ratification or reversal, with the interested director recusing and disclosure considered under SEC and NGX rules. (6) If the board fails to act, obtain external legal advice on escalation to the SEC or NGX, and document that advice. (7) Preserve all documents and emails; do not delete anything.
The safest professional course is transparent escalation. Silence would make the company secretary a participant in concealment.
3. Describe how the three lines model should be restored, with sequencing and interim measures.
Read the worked answer
Restore the model in three stages. First 30 days: convene the risk committee and appoint an interim chair; appoint an interim CRO or engage an external risk adviser; separate risk from finance; put internal audit under the audit committee on an interim basis. Refresh the risk register with the top 15 risks, named owners, inherent and residual scores, key risk indicators and treatment plans. Board-approve a revised delegation of authority and a related-party register.
60 to 90 days: recruit a permanent CRO; review the enterprise risk framework, risk appetite statement and internal audit charter; commission the independent investigation into the whistleblower allegation and report it to the audit committee; train directors on risk oversight. Medium term: annual board effectiveness review, whistleblowing channel operated independently, quarterly risk reporting to the board, and internal audit follow-up on overdue actions.
Success measures: committee meetings held, percentage of top risks with owners and indicators, overdue treatment actions, audit findings closed, whistleblower cases resolved and time taken to escalate. Interim measures must be documented and time-bound; otherwise the informal CFO arrangement becomes permanent by default.