Ghost Workers at Greenfield Schools Group
Greenfield Schools Group operates six private schools in Ogun and Oyo States with 940 employees and a monthly payroll of ₦412 million. In August 2024 the outsourced internal auditor ran a data analytics test and found 23 employees with no pension PIN, no tax identification number and bank accounts opened at the same microfinance bank branch within two weeks of one another. All 23 were approved by the same payroll officer, who has worked in HR for nine years; salaries totalling ₦14.6 million over 18 months were paid to the accounts. The head of HR says the officer is trusted and the findings are a system error. The payroll officer's line manager signed off monthly payroll summaries without checking the master file. The whistleblowing line is operated by the head of HR. Two of the 23 names resemble genuine teachers who left in 2022. The board chair is a personal friend of the payroll officer's family and asks that the matter be handled quietly and internally.
1. Assess the fraud risk factors and control failures that allowed this scheme, using the fraud triangle or a fraud risk register.
Read the worked answer
Pressure: the payroll officer may have personal financial strain, but that is not yet known. Opportunity is clear: one officer controlled the payroll master file, approved additions and could create or retain ghost employees. Rationalisation is visible in the language of trust and system error.
Control failures: no segregation between HR master-data creation, payroll processing and payment; no independent reconciliation of payroll to headcount, biometric attendance or pension and tax records; monthly summaries signed without reviewing the master file; no validation of bank accounts, pension PINs or TINs; no exit checklist to remove leavers, shown by the two names resembling 2022 leavers; no analytics for duplicate accounts or new joiners; and the whistleblowing line is run by the head of HR, who is part of the control environment under review. The same bank branch and account-opening window are classic collusion red flags and may indicate insider involvement at the bank.
Fraud risk register: ghost employees, payroll diversion, collusion with bank staff, falsified approvals and HR conflicts of interest. Inherent risk is high and residual risk is high because preventive and detective controls are largely absent. The finding should be treated as a suspected fraud, not a payroll error.
2. Set out an investigation plan that preserves evidence, respects employment and data-protection law, and avoids tipping off suspects.
Read the worked answer
Appoint an independent investigator with legal counsel; the terms of reference should report to the audit committee, not to HR. Preserve payroll master-file history, HR files, approval emails, bank lists, access logs, biometric attendance and pension and tax records. Take forensic copies and maintain a chain of custody.
Analyse quietly: match every payroll record to a personnel file, biometric attendance, pension PIN, TIN, next of kin and bank-account details; identify leavers and duplicate accounts; quantify the loss; and check whether the bank accounts belong to real people. Do not interview the payroll officer first. Interview witnesses in sequence, then the officer, with HR present and a note-taker. Allow the officer to be accompanied, avoid threats or promises, and observe the presumption of innocence.
Suspend system access immediately and consider suspension on full pay if the contract allows. Follow the disciplinary procedure and avoid dismissal before the evidence is secure. If there is a prima facie case, report to the police or EFCC, notify the bank's fraud desk and the insurer, and consider civil recovery. Limit personal data to those who need it. Protect the original whistleblower and document every decision.
3. Recommend preventive controls and governance changes, including how to handle the board chair's instruction.
Read the worked answer
Preventive controls: segregate HR master-data creation, payroll processing and payment; require dual approval for master-file changes; reconcile payroll monthly to headcount, biometric attendance, pension PINs and TINs; mandate verified bank accounts in the employee's name; use a new-joiner and leaver checklist; run exception reports for new joiners, account changes, duplicate accounts and employees without tax or pension records; and commission surprise payroll audits. The whistleblowing line should be independent and report to the audit committee, with a feedback loop to the reporter.
The board chair's instruction cannot be followed. The company secretary should record the request and advise that a suspected fraud must go to the audit committee and be independently investigated. The chair's friendship is a conflict of interest, so he should recuse himself from oversight of the matter. If he persists, escalate to the senior independent director or the full board, take external legal advice and, if necessary, report to the regulator. Document all steps. Suppressing the matter would breach the ICSAN Code, the officer duties under CAMA and the company's own ethics policy. Confidentiality protects the investigation; it does not authorise concealment of fraud.