Statutory audit and the legal framework: CAMA 2020 and the FRC Act

Chidi is a director of a Nigerian company and wants to hire his cousin, who owes the company ₦700,000, as its auditor because "he knows the business". Can he? The law says no. Who may audit a company, how the auditor is appointed, what the auditor must report, what the auditor is entitled to see, and who regulates auditors are all fixed by law and by the professional bodies. This topic sets those rules out for Nigeria.

It covers the requirement for an audit, the small company exemption, who may act as auditor, how auditors are regulated, the auditor's duties and rights, the audit committee, and the part played by the Financial Reporting Council of Nigeria (FRC). The standards that auditors follow are covered in the next topic.

Key terms in plain English

Syllabus check

This topic is in syllabus area A, legal and regulatory frameworks (20% of marks). It covers:

• the legal and regulatory framework for statutory audit under CAMA 2020
• the Financial Reporting Council of Nigeria Act, 2011 (as amended)
• the rights and duties of auditors and the audit committee

CAMA 2020 and statutory audit

The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.

The rules in more depth

The requirement for an external audit

Most countries require listed and other large companies to have their published financial statements audited, to protect the shareholders. In Nigeria section 401 of CAMA 2020 requires a company to appoint an auditor or auditors at each annual general meeting, to hold office from the end of that meeting until the end of the next.

The remuneration of the auditors is fixed by the company in general meeting, or as the meeting decides, under section 408(1)(b), and it is usual for members to authorise the directors to fix it.

The small company exemption

Section 402 exempts from the audit requirement a company that qualifies as a small company and a company that has not carried on any business since incorporation. A company qualifies as small in a year if all of these conditions are met (section 394 of CAMA 2020):

• it is a private company with a share capital;
• turnover for the year is not more than ₦120 million, or the amount the Corporate Affairs Commission (CAC) fixes;
• net assets are not more than ₦60 million, or the amount the CAC fixes;
• none of its members is an alien;
• none of its members is a government, a government corporation or agency, or a nominee of one; and
• the directors between them hold at least 51 per cent of the equity share capital.

All the conditions must be met. A small company may still choose a voluntary audit, for example because a bank requires one before it lends.

Who may act as auditor: the qualification and disqualification rules

Eligibility to act is normally tied to membership of a professional body such as the Institute of Chartered Accountants of Nigeria (ICAN), and, for audits of Public Interest Entities, to registration with the FRC. Section 403 of CAMA 2020 then bars certain people even if they are members of a body:

The disqualification also reaches persons who were employed by the company or connected with it in any way in respect of any period of the audit (section 403(3)). A firm qualifies only if every partner qualifies (section 403(5)). A person must not act as auditor knowing he is disqualified. An auditor who becomes disqualified during his term must vacate office and give written notice to the company (section 403(6)).

Acting in breach, or failing to give notice, is an offence (section 403(7)).

Regulation of auditors

Under self-regulation the profession's own body offers the qualification, makes sure audits are done only by fit and proper persons, requires work to follow technical standards such as International Standards on Auditing (ISAs), requires continuing professional development, investigates complaints and disciplines members, and keeps a public list of registered auditors. Under government regulation a public body does similar things: it authorises auditors, checks minimum skills and handles complaints and discipline.

Nigeria uses both: ICAN regulates its members, and the FRC regulates auditors of Public Interest Entities.

The Financial Reporting Council of Nigeria

The FRC was set up by the Financial Reporting Council of Nigeria Act 2011, as amended by the Financial Reporting Council of Nigeria (Amendment) Act 2023, signed on 3 May 2023. It develops and enforces accounting, financial reporting and auditing standards for Public Interest Entities. Its role in auditing includes:

• registering auditors, audit firms, audit committee members and other assurance providers, under the Audit Regulations 2020, with annual dues;
• inspecting audit firms and monitoring the quality of their audits;
• keeping a national repository of the financial statements of Public Interest Entities; and
• applying sanctions for breaches.

The 2023 amendment widened the definition of Public Interest Entities to include governments and government organisations, listed entities, regulated non-listed entities and public companies, among others. Registration on the National Audit and Assurance Firms Register is mandatory for audit and assurance firms from 1 April 2026.

The duties of the auditor

The primary duty is to examine the financial statements and issue a report to the members under section 404(1) of CAMA 2020, giving an opinion on whether they give a true and fair view and have been prepared in line with the applicable framework. Section 404(2) requires the report to state the matters in the Fifth Schedule, which the auditor must say whether or not they are met:

• whether the auditors obtained all the information and explanations needed for the audit;
• whether proper books of account have been kept, and proper returns received from branches not visited;
• whether the statement of financial position and profit or loss account agree with the books and returns;
• whether the statements give the information the Act requires and a true and fair view of the state of affairs and the profit or loss; and
• for a holding company, whether the group financial statements are properly prepared to give a true and fair view.

The report is an opinion, and that is a limit of the statutory audit: it is open to disagreement, and the auditor does not check every transaction.

The rights of the auditor

CAMA 2020 gives the auditor rights so that the duties can be performed. Under section 407(3) the auditor has a right of access at all times to the company's books, accounts and vouchers, and may require from the company's officers the information and explanations he thinks necessary.

Other rights are:

• to receive notice of general meetings of the shareholders and to attend them
• to speak at them on matters that affect the audit or the auditor, which is important when the auditor disagrees with the directors and has no other way to reach shareholders
• to receive a copy of written resolutions where the company uses them

Section 406 protects the audit from improper influence on its conduct.

The responsibilities of management and those charged with governance

The public often think the auditor is responsible for the accounts. But it is management and those charged with governance who must prepare the financial statements, prevent and detect fraud, and design and run effective internal controls. They must also give the auditor access to information and people, provide additional information the audit needs, and give written representations at the end of the audit.

The audit committee of a public company

Section 404(2) requires a public company to establish an audit committee, and the auditor reports to it as well. Under section 404(3) it has five members: three members (shareholders) and two non-executive directors. They are not paid, and are elected annually. All must be financially literate and at least one must belong to a professional accounting body in Nigeria created by an Act of the National Assembly (section 404(5)).

Any member may nominate another member by written notice to the company secretary at least 21 days before the annual general meeting (section 404(6)).

The committee examines the auditors' report and makes recommendations to the meeting (section 404(4)), and under section 404(7) it checks that accounting and reporting policies follow the law, reviews the scope and planning of the audit, reviews findings on management matters with the external auditor, keeps the control system under review, recommends the appointment, removal and remuneration of the external auditors, and authorises the internal auditor to investigate matters of concern.

Worked examples

1. (a) is an officer or servant: disqualified by s. 403(1)(a).
2. (b) is a partner of an officer or servant: disqualified by s. 403(1)(b).
3. (c) is a consultant engaged for more than one year in preparing the statements: disqualified by s. 403(4)(e).
4. (d) qualifies, because every partner qualifies (s. 403(5)).

1. The disqualification applies only to debts above ₦500,000.
2. ₦450,000 is below the limit, so this rule does not bar her, though the auditor must still consider whether the debt threatens independence.

1. Turnover is above ₦120 million, so it fails the small company test.
2. It is not exempt under s. 402 and must be audited.

1. Section 404(3) needs five members: three members and two non-executive directors.
2. One more non-executive director is needed, and at least one member must belong to a professional accounting body in Nigeria.

How to score full marks

• Cite the section for each rule: 401, 402, 403, 404, 407 and 408.
• Give all the small company conditions when asked, with the figures.
• Use the Fifth Schedule matters as a list when asked what the auditor must state.
• Separate self-regulation by ICAN from regulation by the FRC.

Common mistakes in the exam

• Saying a body corporate may be an auditor.
• Omitting that all small company conditions must be met.
• Confusing the audit committee members with the board: three shareholders and two non-executive directors.
• Saying the auditor is responsible for preventing fraud.

Quick revision

• s. 401 appoint; s. 402 exempt; s. 403 disqualify; s. 404 report and committee; s. 407 rights; s. 408 pay.
• Small: ₦120m turnover, ₦60m net assets, 51% directors, no alien or government members.
• FRC registers auditors and inspects audits of Public Interest Entities.

Practice questions

Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.

Model answers

Spotted a mistake? Tell us and we will check it.