Non-compliance with laws and regulations (NOCLAR) and whistleblowing

During an audit of a pharmaceutical distributor, the auditor learns that the company has been paying officials to clear unregistered drugs. The finance director says, "This is how business is done. Please keep it out of your report." The auditor is now facing non-compliance with laws and regulations, usually shortened to NOCLAR. The question is what to do: look away, resign, or tell somebody outside the company.

The professional rules set out a path that begins inside the company and, if that fails, may end with a report to an authority.

This topic covers what NOCLAR is, the steps an accountant must take, when confidentiality may be set aside, and how whistleblowing fits in. It follows the topics on confidentiality and conflicts.

Key terms in plain English

Syllabus check

This topic is in syllabus area E, professional ethics and public interest (15% of marks). It covers:

• the concept of whistleblowing in audit and assurance
• non-compliance with laws and regulations (NOCLAR)
• the importance of professional ethics

CAMA 2020 and NOCLAR

The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.

The rules in more depth

What non-compliance with laws and regulations is

The Code of Ethics of the International Federation of Accountants (IFAC) gives all professional accountants guidance on how to respond to non-compliance with laws and regulations (NOCLAR). The non-compliance may be intentional or not. Examples are:

• fraud, corruption and bribery;
• money laundering, terrorist financing and proceeds of crime;
• securities markets and trading;
• banking and other financial products and services;
• data protection;
• tax and pension liabilities and payments;
• environmental protection; and
• public health and safety.

The framework sets out the process an accountant follows on meeting a suspected fraud or illegal act. The circumstances in which the accountant may override the fundamental principle of confidentiality and disclose the matter to an appropriate authority. That disclosure is also called whistleblowing. Under the framework an auditor cannot simply resign because of identified or suspected NOCLAR without the matter being properly addressed.

International Standard on Auditing (ISA) 250 deals with the same matter from the audit side, so the auditor must consider laws and regulations in the audit and respond when non-compliance is found or suspected.

The accountant's responsibilities, step by step

1. Understand the matter: obtain facts, the laws involved and the people responsible.
2. Advise management to take appropriate and timely action, that is to rectify, remediate or mitigate the consequences of the non-compliance, to deter it if it has not yet happened, or to disclose it to an appropriate authority.
3. Judge management's response. Ask whether it is timely, whether the matter was adequately investigated, whether action is being taken to rectify, remediate or mitigate the consequences, whether action is being taken to deter non-compliance not yet committed, whether steps are being taken to reduce the risk of repetition, for example by new controls or training, and whether the matter has been adequately disclosed to an authority.
4. Decide whether further action is needed in the public interest. Consider the legal and regulatory framework, how urgent the matter is, the integrity of management and whether the non-compliance is likely to recur.

Further action may be to disclose the matter to an appropriate authority even when there is no legal duty to do so, or to withdraw from the engagement and the professional relationship, where the law permits.

When disclosure to an authority may be made

The accountant may disclose the matter to an appropriate authority if, for example:

• the entity is engaged in bribery;
• the entity is regulated and the matter is so significant that it threatens its operating licence;
• the matter could harm the financial markets;
• products harmful to public health or safety are likely to be sold; or
• the entity is promoting a scheme to help clients evade taxes.

In a regulated sector such as banking, the appropriate authority may be the Central Bank of Nigeria or the Nigeria Deposit Insurance Corporation. For fraud or corruption it may be the Economic and Financial Crimes Commission or the Independent Corrupt Practices and Other Related Offences Commission. Where the law requires the report, as with money laundering, the auditor must make it, and confidentiality gives no protection.

The auditor's audit procedures when NOCLAR is suspected

The May 2026 examination described Royal Bank Plc, where a whistle-blower said loans were approved without proper documentation, in breach of regulations. The procedures that fit the facts are:

Note on the Pathfinder solution. The Pathfinder says that ISA 250 and the IFAC Code require all NOCLAR to be reported. The Code does not say so. It sets the process above, and disclosure to an authority is required where the law requires it and otherwise allowed when the auditor decides it is needed in the public interest. So the Pathfinder solution is slightly different from ours. The six steps and the bodies it names are otherwise right.

Whistleblowing

A whistleblower is a person who reports wrongdoing to someone who can act on it. The person may be an employee who tells the auditor, as in the Royal Bank case, or the auditor who reports outwards. Good practice has three parts.

The entity has a safe channel for staff to raise concerns, the person who raises a concern is protected from retaliation. The person who receives the report treats the source in confidence. In Nigeria the Federal Ministry of Finance introduced a whistleblowing policy in December 2016 that invites reports of looting of public funds and offers the informant a reward of between 2.5% and 5% of the recovered money.

An auditor who receives an allegation from a whistleblower treats it as information that must be checked, and does not accept it or dismiss it at face value.

Why the auditor does not simply resign

Resigning may feel safe, but it leaves the problem hidden, the shareholders uninformed and a successor auditor starting without warning. Under company law an auditor who resigns must give a statement of the circumstances. The framework adds that resignation is not a substitute for addressing the matter, and that withdrawal is a further step only after the other steps have failed and where the law permits.

Worked examples

1. Understand the facts: the contract, the service delivered and the owner.
2. The senior tells the audit manager and partner, who raise the matter with management and those charged with governance.
3. No one reports outside until management's response has been judged.

1. The response is not timely and does not show real investigation or remediation.
2. Further action is needed in the public interest: consider disclosure to an authority.

1. The entity is regulated and the matter threatens its operating licence.
2. The auditor may disclose to the regulator, after raising it with those charged with governance.

1. The framework does not let the auditor leave without the matter being addressed.
2. Money laundering must be reported to the authority, and the report is a legal duty.

How to score full marks

• Define NOCLAR and give two or three examples.
• List the steps: understand, advise management, judge the response, decide further action.
• Name the authority that fits the sector.
• State that confidentiality can be overridden only within the framework and the law.

Common mistakes in the exam

• Reporting externally before raising the matter with management.
• Resigning at once.
• Saying every breach must be reported to an authority.
• Failing to document each step.

Quick revision

• NOCLAR: intentional or unintentional breaches of laws and regulations.
• Understand; advise management; judge response; decide further action.
• Disclose to an authority or withdraw, where allowed.
• Do not just resign.
• Document everything.

Practice questions

Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.

Model answers

Spotted a mistake? Tell us and we will check it.