ICSAN Sector Governance cheat sheet

Nigerian Code of Corporate Governance 2018: issued by the Financial Reporting Council of Nigeria (FRCN), effective 1 January 2019, principle-based, and operated on an 'apply and explain' basis by public companies and entities in regulated sectors.

Cadbury Report (UK, 1992) introduced the 'comply or explain' approach, separation of the chairman and CEO roles, independent non-executive directors, and audit committees with independent members.

UK Corporate Governance Code (FRC, current edition): comply or explain; sections cover board leadership and purpose, division of responsibilities, composition, succession and nomination, audit, risk and internal control, and remuneration.

King IV (South Africa, 2016): apply and explain, 17 principles organised around four outcomes - ethical culture, good performance, effective control and legitimacy - and applies to all organisations, not only companies.

G20/OECD Principles of Corporate Governance (2015) run in six chapters: ensuring the basis for an effective framework; rights and equitable treatment of shareholders; institutional investors and markets; role of stakeholders; disclosure and transparency; responsibilities of the board.

Hierarchy in Nigeria: statute (CAMA 2020, BOFIA 2020, ISA 2025, PIA 2021 and sector acts) prevails over regulator codes; sector codes (CBN, NAICOM, PenCom, SEC, NCC) prevail on sector-specific matters; the NCCG 2018 supplies the general baseline; the company's board charter and policies sit below.

Regulator map: CBN - banks, discount houses and other financial institutions; NAICOM - insurers and brokers; PenCom - pension operators and custodians; SEC - public companies, capital market operators and collective investment schemes; NCC - telecoms licensees; CAC - incorporation, annual returns and incorporated trustees; NDIC - deposit insurance.

FRCN statutory remit: issue and approve financial reporting and auditing standards, issue the national corporate governance code, register and monitor auditors and other reporting professionals, and enforce compliance with reporting standards.

Decision rule: under 'comply or explain' a company may deviate from a provision if it explains why; under 'apply and explain' it must apply every principle and explain how it applied it - deviation is not itself a compliant outcome.

Board's core roles: set strategy and direction, monitor management performance, approve risk appetite and financial plans, safeguard reporting integrity, appoint and remove the CEO, determine senior remuneration, oversee succession and account to stakeholders.

Role split: the chairman leads the board, its agenda and its evaluation; the CEO leads management and executes strategy. Combining the two roles concentrates power and is contrary to NCCG 2018 and the Cadbury tradition.

Director categories: executive directors (also employees of the company), non-executive directors, and independent non-executive directors with no material relationship with the company, its advisers or a controlling shareholder.

Standing committees of a regulated company: audit, risk management, nomination/governance and remuneration. Each needs written terms of reference, a quorum, a membership rule and a duty to report to the full board; delegation never transfers board accountability.

Audit committee: under CAMA 2020 a public company has a statutory audit committee made up of shareholder representatives elected at the annual general meeting and directors' representatives; the board-level committee should be chaired by an independent non-executive director and include at least one financially literate member with accounting or audit experience.

Board evaluation: internal evaluation of the board, its committees and individual directors annually; independent external evaluation at intervals, stated in NCCG 2018 as at least once every three years, with the outcome disclosed in the annual report.

Meeting discipline: papers circulated sufficiently in advance, quorum confirmed before business, interests declared and recused members recorded, decisions reduced to numbered resolutions, action log reviewed at the next meeting; CAMA 2020 permits electronic participation and written resolutions.

Appointment and removal: appointment by the board subject to shareholder ratification or directly by shareholders; removal of a director of a public company by ordinary resolution after special notice, with a right to make representations; a replacement must be notified to the CAC.

Pre-appointment due diligence: identity and integrity checks, qualifications, prior disqualifications, competing directorships and time commitment, related-party links, and regulator pre-approval where the entity is regulated (for banks, CBN approval before appointment takes effect).

CAMA 2020 governance changes: single-member/shareholder companies, no mandatory AGM for private companies, electronic and virtual meetings, written resolutions of directors, codified directors' duties, and qualification requirements for the company secretary of a public company.

Company secretary of a public company (CAMA 2020): must be a member of ICAN, ANAN, ICSAN or CITN, or a legal practitioner, or hold another qualification prescribed by the CAC; the office-holder maintains statutory registers, minutes and records and advises the board on compliance.

Directors' duties codified in CAMA 2020: act in good faith in the best interests of the company, exercise care, skill and diligence, avoid conflicts of interest, do not exploit corporate opportunities or accept third-party benefits, and disclose interests in transactions.

Listed entities (NGX Rulebook and SEC rules): minimum public free float, board composition and committee requirements, immediate disclosure of material and price-sensitive information, a closed period before results, and disclosure of directors' dealings in shares.

Shareholder resolutions: ordinary resolution for routine business (dividends, director appointments, auditor appointment); special resolution, requiring a 75 per cent majority of votes cast, for matters such as alteration of the articles, reduction of capital and re-registration.

Banks and financial institutions: BOFIA 2020 plus the CBN Code of Corporate Governance for Banks and Discount Houses, with prior CBN approval for directors and significant shareholdings, fit-and-proper screening, minimum independent directors, mandatory board committees, and tenure limits including a 10-year maximum for CEOs and 12 years (three terms of four years) for non-executive directors.

Financial safety net: CBN as prudential regulator, NDIC for deposit insurance, AMCON for resolution of non-performing loans, SEC for capital market operators; each imposes governance, capital and reporting conditions that override ordinary company practice.

Notifiable events: changes in directors, auditors or substantial shareholdings must be reported to the relevant regulator and, for listed companies, announced to the exchange; regulator approval is not automatic and can be refused on fit-and-proper grounds.

Private company discipline: exemption from statutory audit for qualifying small companies does not remove the duty to keep proper accounting records, file annual returns with the CAC, file tax returns, or comply with directors' duties.

Constitutional anchors: Consolidated Revenue Fund (section 80), Federation Account distribution (section 162), and the Auditor-General for the Federation (section 85) who audits public accounts and reports to the National Assembly.

Fiscal Responsibility Act 2007: creates the Fiscal Responsibility Commission, requires a Medium Term Expenditure Framework and Fiscal Strategy Paper before the budget is laid, and mandates quarterly reporting on budget implementation.

Public Procurement Act 2007: open competitive bidding as the default method, procurement planning, due process certification from the Bureau of Public Procurement, and an express prohibition on splitting contracts to avoid approval thresholds.

Public financial management controls: Treasury Single Account for cash consolidation, GIFMIS for commitment and payment control, IPPIS for payroll integrity, and the Open Treasury portal for proactive disclosure of payments.

Freedom of Information Act 2011: public institutions must proactively publish records and respond to requests within seven days, extendable by a further seven, with limited exemptions; refusal can be challenged in court.

Code of Conduct Bureau and Tribunal: public officers declare assets on assumption and on leaving office; breaches such as operating foreign bank accounts, receiving gifts or holding conflicting interests are tried by the Code of Conduct Tribunal.

State-owned entity governance: an ownership policy sets objectives, boards are appointed on competence and independence, management operates under a performance contract with the supervising ministry, and annual audited accounts are published and laid before the legislature.

Accountability chain: the Accounting Officer (Permanent Secretary or CEO) is answerable for funds; internal audit reports to the Accounting Officer and the audit committee; the Auditor-General is the external auditor and may conduct value-for-money audits.

Where a public entity is incorporated as a company (for example NNPC Limited under CAMA 2020), company law, the NCCG 2018 and the relevant sector regulator apply together, while ownership remains with the state as shareholder.

Three lines model (IIA, 2020): first line - operating management owns and manages risk; second line - risk, compliance, legal and finance control functions monitor, advise and challenge; third line - internal audit provides independent assurance; the board and audit committee oversee all three.

COSO ERM 2017: five components - governance and culture; strategy and objective-setting; performance; review and revision; information, communication and reporting - supported by 20 principles.

COSO internal control framework (2013): five components - control environment, risk assessment, control activities, information and communication, and monitoring - supported by 17 principles; deficiencies are graded and reported to the board.

Risk register discipline: identify the risk, assess it as likelihood multiplied by impact, assign a named owner, select a response (avoid, reduce, transfer, accept), track key risk indicators, and report movement to the risk committee at each meeting.

Internal audit independence: the chief audit executive reports functionally to the audit committee (charter, audit plan, appointment and removal, performance appraisal, remuneration) and administratively to the CEO, and must not undertake management decisions.

IIA quality assurance: internal assessments every year and an external quality assessment at least once every five years by an independent, qualified reviewer, with the results reported to the audit committee.

Audit committee oversight: integrity of financial statements, selection and independence of the external auditor, effectiveness of internal audit, adequacy of internal control, related-party transactions, whistleblowing arrangements, and legal and regulatory compliance.

External audit: independence safeguards include controls on non-audit services and fees, partner rotation and, where required, audit firm rotation; the report presents the opinion, key audit matters under ISA 701, and material uncertainty on going concern where relevant.

Compliance function: maintains a regulatory register, conducts a compliance risk assessment, monitors regulatory change, trains staff, and reports exceptions and breaches to the risk committee and the audit committee.

Legal forms in Nigeria: incorporated trustees registered under CAMA 2020 with the CAC, a company limited by guarantee for larger non-profits, or a cooperative society registered under the applicable state cooperative societies law.

Board or trustee duties in a non-profit: hold assets in trust for the stated objects, set strategy, approve budgets, oversee financial controls, manage conflicts and related-party transactions, and ensure that no private benefit accrues to insiders.

Reporting: audited or independently examined accounts, a statement of financial activity, restricted versus unrestricted funds, a reserves policy, and public disclosure of programmes, governance and results.

Income types: grants, donations, membership subscriptions, earned income and cooperative surplus; donor conditions create restricted funds that must be ring-fenced and reported separately.

Cooperative identity: one member one vote regardless of capital contributed, a member-elected board, surplus distributed in proportion to patronage rather than shareholding, and a limited return on capital.

Dual character of cooperatives: a business that must be commercially viable and an association that is democratically controlled, with the members' general meeting as the ultimate authority over the board.

AML/CFT obligations: non-profit organisations must register with SCUML and report suspicious transactions, and the Money Laundering (Prevention and Prohibition) Act 2022 applies to them alongside banks and designated businesses.

Tax position: approved non-profit bodies may be exempt from companies income tax where no profit is distributed to members, but exemption does not remove the duty to file returns and keep proper records.

Beneficiary accountability: safeguarding and child protection policies, complaints and feedback mechanisms, and impact measurement are governance obligations because beneficiaries cannot exercise shareholder rights or vote out a failing board.

Nigerian anti-corruption framework: EFCC Act 2004, Corrupt Practices and Other Related Offences Act 2000 (ICPC), the Code of Conduct Bureau under the 1999 Constitution, Money Laundering (Prevention and Prohibition) Act 2022 and the Proceeds of Crime (Recovery and Management) Act 2022.

EFCC versus ICPC: the EFCC handles economic and financial crimes including fraud, money laundering and cybercrime; the ICPC focuses on corruption in public office; their mandates overlap on bribery and both can prosecute companies and officers.

Corporate liability: a company can be liable for the acts of its directors and employees, so mitigation rests on a documented ethics programme - code of conduct, training, gifts register, due diligence on agents and a functioning reporting channel.

Whistleblowing programme components: multiple reporting channels (hotline, email, web, ombudsman), confidentiality and anonymity options, a written non-retaliation guarantee, a triage and investigation protocol, a case register, and periodic reporting to the audit committee.

Nigeria's whistleblowing policy (Federal Ministry of Finance, 2016) provides a reward of between 2.5 per cent and 5 per cent of funds recovered following information on financial malpractice, subject to the whistleblower being eligible and the tip being the originating source.

Gifts and hospitality controls: a register records the offer, value, source, decision and recipient, anything capable of improperly influencing a decision is declined, and public-officer limits are applied where the counterparty is a government body.

Conflicts of interest: directors and staff declare interests in writing, the conflicted person withdraws from discussion and voting, the declaration and recusal are minuted, and related-party transactions are disclosed and approved at the correct level.

Extraterritorial exposure: the UK Bribery Act 2010 creates strict liability for failure to prevent bribery with an adequate procedures defence, and the US FCPA imposes anti-bribery and books-and-records requirements on issuers with a US nexus.

Ethical decision tests: is it legal; does it respect stakeholders; would disclosure of the decision be embarrassing; would I accept the same rule applied to me; and is it consistent with the code and stated values.

Core shareholder rights: vote at general meetings, receive declared dividends, receive notices and audited accounts, appoint a proxy, attend and speak, requisition a general meeting, and seek court relief where the affairs of the company are conducted oppressively.

Poll voting: one share one vote; a poll, not a show of hands, is the authoritative expression of shareholder will, and the result together with proxy figures should be published.

Minority protection under CAMA 2020: derivative action brought on behalf of the company with leave of court, relief against unfair prejudice or oppression, and the right to challenge resolutions that breach the Act or the articles.

Board-management boundary: the board sets strategy, risk appetite and key policies; the CEO and executives propose and execute within a delegated authority matrix; board involvement in routine operations is over-reach and blurs accountability.

Information flow: the company secretary circulates the agenda and papers in advance, records decisions and tracks actions, and is the formal channel linking board, committees, management and shareholders.

Engagement planning: segment stakeholders (shareholders, employees, regulators, customers, host communities, financiers) using power, legitimacy and urgency; agree the channel, frequency, owner and escalation route for each group.

AGM mechanics: proper notice, chair's report, audited accounts laid, auditors appointed and fees approved, directors retiring by rotation and re-elected, dividends declared, polls conducted and questions answered.

Institutional investors and proxy advisers: stewardship expectations include voting at meetings, engaging privately with the chair or senior independent director, disclosing voting policy, and escalating by voting against resolutions.

Grievance and remediation: employee and community grievance channels must be accessible, recorded, time-bound, and reported with resolution statistics to the board committee responsible for stakeholders.

NCCG 2018 corporate disclosure: the annual report should set out board composition and committees, governance practices, the outcome of board evaluation, directors' remuneration, the risk management approach, and a statement on how the code was applied.

CAMA 2020 statutory filings: annual return to the CAC, audited financial statements, and statutory registers of members, directors, secretaries and charges; changes in directors and the secretary must be notified to the CAC.

Annual return timing: filed with the CAC within 42 days of the annual general meeting for companies required to hold one, using the CAC electronic portal, with late filing attracting penalties.

Financial reporting: Nigeria applies IFRS for public interest entities, with the FRCN as standard setter; the auditor's report contains the opinion, key audit matters and a material uncertainty statement where going concern is in doubt.

Timely disclosure for listed entities: material and price-sensitive information must be released to the exchange promptly and before selective briefing; results are published within the regulatory deadline and directors observe the closed period.

Related-party disclosure: the relationship, nature of the transaction, amount, terms and outstanding balance with directors, substantial shareholders and connected persons are disclosed, approved at board or shareholder level, and reported in the notes.

Sustainability and integrated reporting: the IIRC six-capital model and the ISSB's IFRS S1 and S2 (2023) form the global baseline for sustainability-related financial disclosure and connected value-creation reporting.

Transparency test: disclosure must be accurate, complete, timely, comparable and accessible; delaying or omitting adverse information is a disclosure failure even when everything actually published is true.

Directors' report content: statement of directors' responsibilities, going concern statement, internal control and risk statement, and the audit committee's report, all signed off before publication.

Family business structures: family assembly, family council, family constitution, a board that includes independent non-executive directors, a family employment policy, a succession plan and a share transfer or exit policy.

Family business decision rule: the family council handles ownership and family matters, the board decides business strategy, management runs operations, and a written dividend policy separates family income needs from reinvestment.

SME governance minimum: a board with segregation of duties, written accounting policies, monthly management accounts, a simple risk register, documented approval limits, and a designated company secretarial function.

Oil and gas under the Petroleum Industry Act 2021: NUPRC regulates upstream operations, NMDPRA regulates midstream and downstream, NNPC Limited is incorporated under CAMA 2020 and run commercially, and host community development trusts receive a statutory percentage of an operator's operating expenditure.

Nigerian content: the NOGICD Act 2010 and the NCDMB require operators to use Nigerian labour, materials and services, submit Nigerian content plans and reports, and fund capacity development.

Telecommunications (Nigerian Communications Act 2003 and NCC): licensees must meet licence conditions, quality-of-service key performance indicators, consumer complaint handling codes, tariff approval rules and the NCC's corporate governance requirements for the industry.

Regulated industries generally: the sector regulator controls licensing, tariffs, service standards, capital and governance requirements, can revoke a licence for governance failure, and its code applies on top of the NCCG 2018.

Cross-sector competition and consumer rules: the Federal Competition and Consumer Protection Act 2018 and the FCCPC apply across sectors, prohibiting abuse of dominance, anti-competitive agreements and misleading market conduct.

Sector risk map: oil and gas - environmental, community and asset integrity risk; telecoms - cyber, data privacy and service continuity risk; banking - credit, liquidity and conduct risk; each regulator requires a sector-specific risk and reporting framework.