Emerging technologies and the audit changes in CAMA 2020

Technology changes what clients sell, how they work and what can go wrong, and it changes how auditors do their jobs. The principles of audit stay the same. The tools, the team and the risks do not. This topic closes the course by looking at emerging technologies and at the changes Companies and Allied Matters Act 2020 (CAMA 2020) made for audit in Nigeria.

It covers the business effects of technology, cyber-security as a business risk, data analytics and big data, how emerging technologies affect audit, and the key changes in CAMA 2020: the small company audit exemption, audited accounts on websites, certification of the financial statements by the chief executive officer (CEO) and chief financial officer (CFO), limited liability partnerships and the offence of improper influence on the audit.

The earlier topics on information technology cover cloud, artificial intelligence (AI), blockchain and robotics in more detail. This is the last topic in the course.

The key changes in CAMA 2020 that affect audit

On 7 August 2020 the Nigerian President signed the Companies and Allied Matters Bill into law. CAMA 2020 replaced CAMA 1990 (ICAN names it so, and some commentary refers to the 2004 revision). It aims to bring Nigeria in line with global best practice, make business easier and attract and retain foreign investors.

What the CEO and CFO certify

The certification must state that:

1. to the officer’s knowledge, the audited statements contain no untrue statement of material fact and do not omit a material fact that would make them misleading in the circumstances; and
2. the audited statements and other financial information included in them fairly present, in all material respects, the financial condition and results of operation of the company for the periods covered.

ICAN applies this to every company, and published commentary on section 405 says it applies to companies other than small companies. The earlier topic on communicating with those charged with governance also treats section 405 as covering internal controls. Know that the certification is about the statements and the controls behind them.

Developments in emerging technologies

Technology plays a fundamental role in the work of practitioners and their clients. Organisations fall into two groups: established ones that must modernise products and models, and new ones built on technology. Either way, technology shapes their prospects.

• Customers use the internet. Supermarkets, hardware stores and clothing shops offer online ordering and delivery, and marketplaces such as Amazon, Alibaba and eBay are common. A business without online sales loses custom to those that have them.
• Products move onto the internet. Training courses become online products, medical and legal advice may be given by AI products, and CDs, books and videos are replaced by downloads. Driverless cars and drones for delivery, security and surveying are being tested.
• Working models change. Manual work becomes semi- or fully automated, such as automated tax returns and expense claims. Remote work, virtual companies and the gig economy grow.

Practitioners must identify, assess and manage the technological business risks in how they offer and deliver services, and the clients’ risks that affect the practitioner’s risk and going concern assessments.

Cyber-security

Cyber-attacks, such as distributed denial of service, ransomware and theft of confidential data, intellectual property and design secrets, are now close to inevitable, and they are becoming more sophisticated. Organisations should treat cyber-security as a key business risk and invest in assessing and responding to it. Besides direct financial loss, they can suffer reputational damage, operational disruption, and fines and possible loss of licences for breaching data security rules.

The ultimate responsibility sits with leadership: boards of directors, trustees and managing partners. They may involve an information technology (IT) director, risk committee, internal audit and an audit committee. A challenge is to join IT and information risks with the wider management of business risks. There is a real risk that boards fail to grasp the size and complexity of the challenge and leave the organisation open to severe attacks.

A practitioner looks at cyber-security from two sides:

• In the firm. Build robust systems that let staff work flexibly and remotely, often through the internet and the cloud, while protecting software, data and processes.
• At the client. Identify, assess and respond to the audit risks from cyber-security, including the effect on going concern. The practitioner might also offer assurance on cyber-security or system design consultancy.

The practitioner must also look at cyber risk along the supply chain, because breaches have come from weaknesses in suppliers.

Data analytics and big data

Data analytics (DA) is the use of automated techniques to analyse a client’s data, to make the engagement more efficient and add value. A key challenge is accessing the client’s data. Usually the practitioner’s IT experts extract a copy of the data for analysis. Big data is large or complex data that traditional software cannot handle.

It may be unstructured or semi-structured, such as images and social media traffic.

There are no set rules on when DA should be used. In practice it is often used in the risk assessment phase, and sometimes in the response, for example to select a sample or to recalculate an inventory or irrecoverable debt provision. Examples are:

• data visualisation with graphs, clusters and dashboards, for example trends by product or region;
• sampling and, in some cases, 100% testing to find outliers, trends and anomalies;
• recalculating depreciation on property, plant and equipment by item;
• assessing inventory ageing and days of inventory in stock; and
• applying external exchange rates to value investments.

Some commentators call DA the modern version of computer-assisted audit techniques. DA is used mainly by the largest firms, including the Big 4, though smaller firms will gain access over time. The United Kingdom (UK) regulator, the Financial Reporting Council (FRC) of the United Kingdom, found that DA is happening but that its importance to audit is over-emphasised so far.

Even so, tenders for audits of public interest entities now routinely ask bidders how they will use DA.

The impact of emerging technologies on audit

The fundamental principles of audit and assurance stay the same. The IAASB has so far resisted calls for wholesale changes to the ISAs, but it keeps considering whether to amend them and has set up a project team. Practitioners must still understand the technology used by their clients so that they can identify and assess audit risk.

The tools and mechanics will keep changing. A bank confirmation procedure that took an associate two weeks on a large group audit ten years ago might now take one day and be largely automated. DA can test a whole population and find every outlier for further testing.

Routine work done by juniors will be automated, freeing them for judgemental areas, though there may be a skills gap in the basic techniques that have been automated. The key effect may be less a change in principles than a change in the skills of team members and in the structure and balance of the team.

More training in computer technology and data analytics is likely to be necessary to keep audit quality.

The rules in more depth

Why cyber-security is a going concern issue

A ransomware attack can stop a business for days. If a company cannot invoice or ship, cash flow falls fast. Fines for losing personal data add cost. An auditor assessing going concern should ask whether a serious attack would threaten the company’s survival and what the board has done about it.

Why supply chain risk counts

A client may have strong defences, but its payment provider or software supplier may not. Breaches have come through suppliers, so the auditor asks which suppliers hold or can reach the client’s systems and data.

Why DA does not change the opinion

DA changes how the auditor finds evidence. The auditor still decides what is material, interprets the exceptions and forms the opinion. A list of 400 exceptions from a 100% test still needs judgement on which matter.

Why the small company change matters to the auditor

The exemption cuts the number of statutory audits for small companies, which reduces demand for small-firm audit work, but exempt companies may choose a voluntary audit. For a company that is just above the threshold, an audit remains mandatory, as in the November 2025 Question 7 facts.

Why certification and improper influence go together

The CEO and CFO must stand behind the statements, and officers must not pressure the auditor to make them misleading. Both are aimed at the same risk: management shaping what shareholders see.

Worked example: using data analytics and the CAMA 2020 changes

1. Use of DA. Testing all 85,000 records for cut-off and ageing is a 100% test. It finds outliers rather than relying on a sample. It also helps assess the irrecoverable debt provision.
2. Judgement. Suppose the test produces 240 exceptions. The auditor must decide which are material, follow up the unusual ones with evidence, and consider the effect on the provision and on cut-off.
3. Access. The firm’s IT experts extract a copy of the client’s data, which is the usual way to overcome the access challenge.
4. Website. A public company must keep its audited accounts displayed on its website (s. 374(6)). The audit committee and auditor should raise the omission with those charged with governance.
5. Certification. The CEO and CFO must certify the audited statements (s. 405), covering no untrue statement or omission of a material fact, and a fair presentation of financial condition and results. Failure is an offence. A reluctant CFO is a warning about the control environment and management integrity.
6. Improper influence. If management pressed the team to stop the test, that could be an offence under s. 406, and the auditor has a right of access under s. 407(3).

How to score full marks

• List the CAMA 2020 changes with their sections. Exemption, website, certification, LLPs, improper influence. Five headings, one or two marks each.
• Quote the certification content. The two statements are the points markers look for.
• For technology questions, apply to the case. Say how DA, AI or cyber risk affects the specific client.
• Balance the technology view. The principles stay the same, the skills change. A one-sided answer that says technology replaces auditors loses marks.
• Give both sides of cyber-security. The practitioner’s own firm and the client.
• Say who is responsible. Leadership owns cyber-security. The auditor assesses its audit risk.

Common mistakes in the exam

• Saying the IAASB has rewritten the ISAs for technology. It has not made wholesale changes.
• Saying data analytics replaces professional judgement.
• Treating cyber-security as an IT matter only. It is a leadership and business risk.
• Forgetting the supply chain.
• Writing that all companies are exempt from audit under CAMA 2020. Only small companies and companies that have not carried on business, and not banks or insurers.
• Getting the certification wrong: it is the CEO and CFO who certify, not the auditor.
• Quoting CAMA 2004 or the old Act for any of these changes.

Quick revision

• Technology: online customers, online products, changing working models.
• Cyber-attacks: financial loss, reputation, disruption, fines and licences. Leadership owns it. Firm and client views. Supply chain.
• DA: automated analysis of client data. Big data: large or complex, unstructured. Used in risk assessment and sometimes response. Mostly the largest firms.
• IAASB: no wholesale International Standards on Auditing (ISA) changes. Impact is on skills and team structure.
• CAMA 2020, 7 August 2020: small company exemption (ss. 394, 402), website (s. 374(6)), CEO and CFO certification (s. 405), LLPs (Part C), improper influence (s. 406).
• Small company: turnover and net assets limits, no alien, no government, 51% directors. Banks and insurers excluded.

Practice questions

These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.

Recall check: multiple choice

The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.

Written questions

Model answers

Spotted a mistake? Tell us and we will check it.