Our Blog

A ship’s captain and a fleet of harbour pilots do not report to the same authority, yet both must answer for the same vessel reaching port safely. That is roughly how Nigerian corporate governance works. A company answers to the overarching national code, but also to whichever sector regulator holds its licence, and sometimes to a stock exchange guideline on top of both. Miss the overlap and you are not short of rules. You are short of the one rule that mattered for the fine you just received.

Company secretaries and in-house counsel rarely fail because nobody told them about governance codes. They fail because three codes applied at once and the business only read one of them.

What reporting models govern corporate compliance disclosures?

Pick the “Apply and Explain” model over a simple box-ticking exercise, because the box-ticking version is the one that gets flagged on inspection. Under the Nigerian Code of Corporate Governance, companies do not get to pick and choose which principles to follow.

The model assumes every principle applies, and the company’s job is to explain, in its own words, how its specific practices deliver the outcome the principle is after. The Nigerian Code of Corporate Governance frames it this way: companies must show how the specific activities they have undertaken best achieve the outcomes the principle intends, not simply confirm they read the principle.

That is a heavier lift than it sounds. A board that writes how the audit committee’s composition, meeting frequency and reporting line actually produce independent oversight has done the work the Code wants.

Compare that with the UK’s approach, which Nigerian boards sometimes reference because it is well documented and because many Nigerian subsidiaries sit inside groups with UK-listed parents. The UK Corporate Governance Code 2024 runs on “comply or explain” across five sections: Board Leadership and Company Purpose, Division of Responsibilities, Composition Succession and Evaluation, Audit Risk and Internal Control, and Remuneration.

Under comply or explain, a board can simply not comply with a provision, provided it explains why. Under apply and explain, non-application is not really an option; every principle is assumed in force, and the explanation is about method, not about whether to bother at all.

The trade-off for a Nigerian company sitting under both frameworks, perhaps a NGX-listed entity with a UK-headquartered shareholder, is real. Apply and explain demands fuller narrative disclosure on every single principle, every year, which costs more drafting time from the company secretary’s desk. Comply or explain is lighter where a board genuinely departs from a provision, because a short explanation closes the matter. But apply and explain leaves far less room for a regulator to argue a company dodged a principle it didn’t fancy.

For a managing director weighing how much time the company secretary should spend on annual disclosure drafting, the honest answer is: more than feels proportionate, because a thin “yes, we comply” sentence under apply and explain reads as evasive the moment a sectoral regulator cross-checks it against board minutes.

Sectoral codes sit on top, not instead of, the national Code. The Financial Reporting Council of Nigeria is explicit that sectoral codes address sector-specific issues, while the national Code is all-encompassing across every entity in the country. A telecoms licensee, for instance, follows the Nigerian Communications Commission’s own guidelines, which the Commission states are built to complement the national Code, not replace it. A bank follows the CBN’s code. A public company adds the Securities and Exchange Commission’s layer too.

Public companies carry a third layer: SEC Form 01. The SEC Corporate Governance Guideline requires public companies to use SEC Form 01 as a checklist alongside the national Code’s own reporting template. Each element appears as a question, and the company responds “complied,” “not complied,” or “partially complied,” with a comment justifying the answer. That third answer, partially complied, is where most genuine governance gaps hide, and it is also the answer boards are most tempted to avoid writing honestly.

The practical mistake here is treating these as competing paperwork exercises rather than one disclosure built from the same underlying governance facts. If your board charter, your committee minutes and your SEC Form 01 responses tell three different stories about the same meeting, you have a bigger problem than paperwork.

Boards must evaluate internal controls and formally declare their effectiveness

The UK Corporate Governance Code’s Provision 29 moved the bar from describing controls to declaring their effectiveness. Boards must now make an explicit declaration about whether their internal control systems actually work, not just that they exist. The FRC has since published supporting material, including a mythbuster on the auditor’s role in that declaration, dated June 2026, which tells you this is an area regulators keep refining rather than treating as settled.

Nigerian boards under sector-specific guidance face a similar expectation, phrased differently. The NCC’s guidelines require an annual Board evaluation report that goes well beyond attendance registers. The report must consider the board’s composition, objectivity, member competence, meeting attendance, and the governance practices instituted during the previous year. That is five distinct things to assess, not one combined impression.

Here’s what changes for a company secretary building this report: an evaluation that only counts how many meetings each director attended is not a board evaluation under this standard. It is attendance tracking wearing a bigger title. The regulator wants a judgement on whether the directors sitting in those meetings were objective, competent for the role, and whether the governance machinery around them actually improved during the year.

The board charter is the document that makes evaluation possible at all. You cannot assess whether a board met its responsibilities if nobody wrote down what those responsibilities were. The national Code’s own reporting template asks a blunt opening question: does the board have an approved charter setting out its responsibilities and terms of reference, and when was it last reviewed? One disclosed example in the Code’s own documentation shows a company answering “No” to having a charter, relying instead on the Companies and Allied Matters Act and its memorandum and articles to guide board activity. That is a legal answer, not a governance one. A statute tells a board what it must not do. A charter tells a board what good looks like for this company specifically, and without one, your annual evaluation has nothing concrete to measure against.

A mistake worth naming here: some secretariats draft the charter once at incorporation and never touch it again. The charter needs periodic review against the company’s statutes, and a board that has grown from five directors to nine, or added a new committee, is operating against a charter that no longer describes it.

Statutory rules enforce financial statement sign-off and auditor reporting windows

An auditor who sits on knowledge of an irregularity for two months before telling anyone has broken a specific, timed obligation, not a vague professional norm.

The Financial Reporting Council of Nigeria sets a hard clock on this. Where an external auditor observes or receives information about irregularities during an audit, the auditor must report it to the Council within 30 days. Thirty days from observation, not thirty days from when the audit concludes, not thirty days from when the client finally responds to a query. The clock starts the moment the auditor has the information.

The implication for in-house counsel is direct. If your external audit team raises an informal concern about a transaction, that conversation has started a statutory countdown whether or not your company has resolved the underlying issue. Treating an auditor’s query as something to sit on while management “looks into it” internally can leave the auditor racing a deadline your company controls none of. The better posture is to treat any irregularity flag from your auditor as urgent from day one, because your auditor’s compliance exposure is now tied to how fast your company responds.

Sign-off cannot hide behind the audit firm’s name. The FRC also requires that where an audit firm performs statutory audit and assurance work, the report must be signed by the actual engagement partner who carried out the audit, on the firm’s behalf. A generic firm signature does not satisfy this. There is a named, accountable individual behind every statutory audit report, and that person’s name should appear on the document your board relies on.

For a company secretary reviewing incoming audit reports, this is a two-second check that catches a surprising number of lapses: does the signature belong to a named partner, or does it read as a firm-level stamp? If it is the latter, query it before you file anything with it attached.

Financial statement sign-off at board level has its own separate rule, under the Companies and Allied Matters Act. A company’s balance sheet, whether laid before the company in general meeting or delivered to the Corporate Affairs Commission, must be signed on behalf of the board by two directors. Not one. Two.

A balance sheet circulated or published without that dual signature, where the statute required it, is treated as improperly completed. This is one of those requirements that seems almost too basic to get wrong, and yet it is exactly the kind of basic requirement that slips when a finance team is rushing to meet a filing deadline and a single director signs because the second one is travelling.

Financial statements themselves need to reach the right people with enough lead time before the meeting that discusses them. CAMA’s own completion procedure requires that a copy of the company’s financial statements be sent to entitled persons at least 21 days before the meeting at which they will be laid. That 21-day figure also appears, separately, in the NCC’s guideline for general meeting notices, so a licensee under both frameworks is not dealing with two different numbers, just one number that both statutes happen to agree on.

Regulators mandate whistleblower safeguards and annual ESG disclosures

A whistleblowing policy nobody has reviewed in three years is not a safeguard. It is a document that existed once.

The NCC’s guidelines set a maintenance obligation most boards underestimate: the audit committee must review the whistleblowing mechanisms at least once every twelve months. Not draft them once and move on. Review them annually, which means checking whether the reporting channel still works, whether staff know it exists, and whether a complaint raised through it last year was actually handled the way the policy promised.

The risk this addresses is specific to how whistleblowing fails in practice. A policy fails quietly, not loudly. Nobody announces that the hotline number is disconnected or that the designated recipient left the company eight months ago. The annual review exists precisely to catch that kind of silent decay before an employee discovers it the hard way, by reporting something and hearing nothing back.

CAMA backs this with a direct protection for employees who cooperate with a Corporate Affairs Commission investigation. Where an employee provides information to an inspector in compliance with a request, the company must protect that employee from discrimination or unfair treatment. And if an employee is dismissed without just cause for reasons other than that disclosure, the statute provides for compensation calculated as though the employee had served to maximum retirement age or maximum service period, according to the employee’s terms. That is a meaningful financial exposure sitting behind a governance box most companies treat as a formality.

The board’s own ethics review carries a matching annual clock. The guidelines require the board to review the Code of Ethics and Business at least once every twelve months too, so the ethics framework and the whistleblowing channel that enforces it are meant to move in step, both revisited on the same annual rhythm rather than one getting attention while the other gathers dust.

ESG disclosure has moved from aspiration to a filed document with a deadline. The constraint here is straightforward: a licensee cannot simply claim to care about sustainability in a mission statement and call that compliance. The NCC guidelines require licensees to submit a Sustainability and Corporate Social Responsibility Report at the end of every financial year, detailing the licensee’s environmental, social and governance goals and the steps being taken toward them. This is a filing, with a deadline tied to the financial year end, not a voluntary gesture.

Nigeria’s wider direction of travel on this reinforces the point. The Financial Reporting Council has published a Roadmap Report for the Adoption of IFRS Sustainability Disclosure Standards in Nigeria, amended in 2026, signalling that sustainability disclosure is heading toward a more standardised, comparable format across sectors rather than staying a sector-by-sector patchwork. A company building its ESG report now, around the NCC’s existing annual requirement, is building on a foundation that is likely to extend rather than disappear.

The option that addresses this constraint is not complicated, but it does require starting earlier than most finance teams expect. ESG reporting draws on data scattered across departments: energy use from facilities, workforce diversity from HR, community spend from whichever team ran last year’s outreach programme. A report assembled in the final fortnight before the financial year end reads as exactly that, rushed and thin. Treating the ESG report as a year-round data collection exercise, with a named owner checking in quarterly, produces a document that actually tells the regulator something, rather than one stitched together from memory in December.

The Nigerian Regulatory Architecture for Corporate Governance

No single code covers every company the same way, and the overlap is where most genuine compliance failures start. A manufacturing company answers to the national Code alone. A telecoms licensee answers to the national Code plus the NCC’s own guidelines. A listed public company answers to the national Code, the SEC’s guidelines, and SEC Form 01 on top. Knowing which layers apply to your entity, before you build a compliance calendar, saves the far more painful exercise of discovering a missed layer during a regulatory inspection.

Implementing an Effective Corporate Governance Compliance Cycle

A compliance calendar built around a single annual deadline misses the point that most of these obligations are continuous, not seasonal.

1. Confirm which codes apply. Identify the national Code, any sectoral guideline tied to your licence, and any exchange or SEC layer tied to your listing status. This determines every deadline that follows.
2. Review and, if needed, draft the board charter. Without a charter, the evaluation step below has nothing concrete to measure against.
3. Run the annual board evaluation, covering composition, objectivity, competence, attendance, and governance practices instituted over the prior year, as the NCC guidelines specify.
4. Review the whistleblowing mechanism and the Code of Ethics, each on its own twelve-month clock, checking that the channel still functions and staff still know about it.
5. Track external audit timing, including the 30-day irregularity reporting window and confirmation that the engagement partner’s name appears on the signed report.
6. Prepare financial statements for circulation at least 21 days ahead of the meeting at which they will be laid, signed by two directors as required.
7. Compile the ESG report year-round, assigning a named owner so the document filed at financial year end reflects real data, not a last-minute summary.
8. File SEC Form 01 or the equivalent sectoral compliance report, answering honestly where compliance is partial rather than rounding up to “complied.”

The honest part of this cycle is step 7 and step 4. Most boards execute steps 1, 2, 3, 5, 6 and 8 reasonably well, because each has a hard external deadline attached. The continuous obligations, the ones with no single filing date to force attention, are where governance quietly lapses. If you are a company secretary reading this and wondering which step your organisation last actually completed properly, it is probably not the annual review of the whistleblowing channel.

This overlaps directly with how companies build their wider legal compliance posture from the ground up, something worth reading alongside your startup corporate legal compliance obligations if your governance structure is still young. And if your business holds data on customers or employees as part of its ESG and governance reporting, the overlap with data protection compliance is closer than most boards assume.

Frequently Asked Questions

Does every Nigerian company need to comply with the national Code of Corporate Governance?

Yes, in principle, because the Nigerian Code of Corporate Governance is described as an all-encompassing Code that addresses issues across entities in the country, not one limited to listed or regulated companies. In practice, how strictly it is enforced against a small private company versus a public company with SEC and exchange obligations differs sharply, because the public company layer adds SEC Form 01 and mandatory annual reporting to shareholders on top of the national Code.

What happens if a company only partially complies with a governance guideline?

SEC Form 01 explicitly allows for a “partially complied” answer, and companies are required to record a substantiating comment explaining that status. The honest route is to disclose the gap and the plan to close it, rather than rounding the answer up to full compliance, since the comment field exists precisely so a regulator can see the reasoning behind a partial answer.

How often must a board review its whistleblowing policy?

At least once every twelve months, where the NCC guidelines apply, since the audit committee is required to review the whistleblowing mechanisms at least once every 12 months. This is a standing obligation, not a one-time drafting exercise, and it sits alongside the board’s separate twelve-month review of the Code of Ethics and Business.

Who signs a statutory audit report in Nigeria?

The engagement partner who actually carried out the audit, signing on behalf of the audit firm, as required where an audit firm carries out statutory audit and assurance services. A firm-level signature without a named engagement partner does not meet this requirement, and a company secretary reviewing an incoming audit report should check for that named signature before filing.