Project – The Effect of Internal Control Systems on the Prevention of Fraud in Organisations: A Study of Selected Commercial Banks in Lagos State

CHAPTER ONE

INTRODUCTION

Topic: The Effect of Internal Control Systems on the Prevention of Fraud in Organisations: A Study of Selected Commercial Banks in Lagos State

1.1 Background to the Study

Internal control systems are essential to effective organisational management because they provide structures, policies, procedures, and monitoring mechanisms designed to safeguard assets, promote operational efficiency, improve the reliability of financial reporting, and ensure compliance with applicable laws and regulations. In modern organisations, internal control is not limited to checking financial records after transactions have occurred; it also involves identifying risks, assigning responsibilities, authorising transactions, maintaining accurate records, and monitoring activities to reduce the possibility of errors and misconduct. The Committee of Sponsoring Organizations of the Treadway Commission (COSO, 2013) identifies five integrated components of internal control: control environment, risk assessment, control activities, information and communication, and monitoring activities. Together, these components provide a framework through which organisations can establish accountability and reduce opportunities for fraudulent activities. Consequently, the effectiveness of an organisation’s internal control system is an important consideration in determining how well it can prevent, detect, and respond to fraud.

Fraud is a serious organisational problem involving deliberate deception, concealment, or abuse of entrusted responsibility for personal or other improper gain. It may take different forms, including asset misappropriation, fraudulent financial reporting, manipulation of accounting records, unauthorised transactions, bribery, and the diversion of organisational resources. Fraud can result in financial losses, damaged reputation, regulatory sanctions, reduced employee confidence, and diminished public trust. The Association of Certified Fraud Examiners (ACFE, 2024), in its Occupational Fraud 2024: A Report to the Nations, analysed 1,921 investigated occupational fraud cases from 138 countries and territories. The report identified lack of internal controls as the most frequently cited control weakness contributing to fraud, followed by the overriding of existing controls by management. These findings demonstrate that fraud prevention requires more than written policies; organisations must ensure that controls are properly designed, consistently implemented, and supported by management accountability. Effective internal control systems can therefore reduce opportunities for fraud, although they cannot eliminate every possibility of misconduct.

The banking sector requires particularly strong internal control systems because commercial banks manage substantial volumes of financial transactions and hold funds entrusted to them by individuals, businesses, government institutions, and other organisations. Banking operations involve cash deposits and withdrawals, electronic transfers, loan processing, account management, foreign exchange transactions, card payments, and digital banking services. Weaknesses in the control of these activities may expose banks to employee fraud, unauthorised account access, manipulation of records, collusion, identity-related fraud, and other forms of financial misconduct. Basel Committee on Banking Supervision (1998) emphasised that effective internal controls are fundamental to safe and sound banking operations and that deficiencies in internal control have contributed to significant banking losses. In addition, COSO (2013) explains that controls should be embedded in everyday organisational processes rather than treated as isolated compliance exercises. These principles are especially relevant to commercial banks because failures in internal control may affect not only individual institutions but also customers’ confidence in the wider financial system.

Control activities are among the most direct mechanisms through which banks can limit opportunities for fraudulent transactions. These activities include segregation of duties, authorisation procedures, verification of transactions, reconciliations, access restrictions, transaction limits, supervisory approval, and the maintenance of appropriate audit trails. Segregation of duties, for example, reduces the risk that a single employee can initiate, approve, record, and conceal an unauthorised transaction without independent review. Reconciliation and supervisory checks may reveal inconsistencies between transaction records, customer accounts, and cash balances, while access controls can limit employees’ ability to manipulate systems beyond their authorised responsibilities. COSO (2013) identifies control activities as a central component of an effective internal control system, while the ACFE (2024) reports that weaknesses or the deliberate circumvention of controls are common contributors to occupational fraud. In commercial banks, the effectiveness of these measures depends on their suitability for actual operational risks, the consistency of their application, and whether exceptions are investigated rather than ignored.

Risk assessment is another important component of fraud prevention because it enables an organisation to identify the activities, processes, and circumstances most vulnerable to misconduct. In commercial banks, fraud risks may arise from cash handling, loan approvals, customer identification, digital transactions, privileged system access, third-party relationships, and collusion among employees or between employees and external parties. Banks must therefore evaluate the likelihood and potential consequences of different risks and adjust their controls as banking products, technologies, and fraud techniques evolve. COSO (2013) states that risk assessment involves identifying and analysing risks to the achievement of organisational objectives, including consideration of fraud risk. Similarly, the Basel Committee on Banking Supervision (1998) stresses that banks require effective processes for identifying and controlling risks and that internal control should be supported by appropriate oversight. A bank that conducts regular fraud-risk assessments may be better positioned to identify control gaps, prioritise preventive measures, and allocate monitoring resources to high-risk activities. However, risk assessment is useful only when its findings inform actual control decisions and are reviewed as circumstances change.

Information, communication, monitoring, and internal auditing also contribute to fraud prevention by supporting the timely identification and investigation of suspicious activities. Employees need clear guidance on reporting irregularities, managers need reliable information to supervise operations, and internal auditors need sufficient independence to evaluate whether controls are operating as intended. Confidential reporting channels can encourage employees to raise concerns, while transaction monitoring and data analysis may help identify unusual patterns that require further examination. The Institute of Internal Auditors (IIA, 2020) explains that internal auditing provides independent, risk-based assurance and advice that can help organisations improve governance, risk management, and control processes. The ACFE (2024) also identifies reporting mechanisms, audits, and proactive data analysis as important tools in detecting fraud and reducing its consequences. In banks, these measures are especially relevant because a control system may appear adequate on paper yet fail in practice if employees do not report irregularities, monitoring is inconsistent, or management fails to act on audit findings. Effective communication and independent oversight therefore help reinforce the preventive value of other internal controls.

In Nigeria, the prevention of fraud is a major concern for the banking industry because public confidence depends on the safety of deposits, the reliability of transactions, and the ability of financial institutions to protect customers and comply with regulatory requirements. The Central Bank of Nigeria (CBN) issues prudential and supervisory requirements that shape the governance, risk management, and control responsibilities of financial institutions. Nigerian empirical studies have also examined the relationship between internal control effectiveness and fraud prevention in deposit money banks. For instance, Adetiloye, Olokoyo, and Taiwo (2016) examined fraud prevention and internal control in the Nigerian banking system and reported that internal control was relevant to fraud prevention, while staff commitment, qualifications, and technology were also important considerations. Molokwu et al. (2022) investigated internal control system effectiveness and fraud prevention in Nigerian deposit money banks, focusing on components such as the control environment, risk assessment, and control activities. These studies provide a basis for examining whether internal control mechanisms are implemented effectively and how they contribute to reducing opportunities for fraud in Nigerian banks. They also indicate that the presence of control procedures alone may not be sufficient if implementation and oversight are weak.

Lagos State is a particularly relevant setting for examining internal control systems and fraud prevention because it is a major centre of commercial, financial, and business activity in Nigeria, with commercial banks serving a wide range of individual and corporate customers. The volume and variety of transactions processed in such an environment make reliable authorisation, segregation of duties, risk assessment, information systems, monitoring, and independent auditing important aspects of banking operations. Although international frameworks and Nigerian studies establish the importance of internal control, their findings do not automatically reveal how effectively specific controls operate in the selected commercial banks in Lagos State. Differences in management commitment, employee compliance, technology, internal audit practices, fraud-risk monitoring, and the enforcement of procedures may influence the outcomes achieved by individual institutions. A focused study is therefore necessary to examine the internal control systems used by selected commercial banks and determine how their effectiveness relates to fraud prevention. This study seeks to provide evidence that may support stronger control practices, improved accountability, and more effective fraud-prevention strategies in the selected banks.

1.2 Statement of the Problem

Fraud remains a major challenge to organisational accountability, financial integrity, and operational performance, particularly in the banking sector, where institutions manage customers’ deposits and process large volumes of financial transactions. Fraudulent activities may involve unauthorised withdrawals, manipulation of financial records, abuse of staff privileges, collusion, and deliberate circumvention of established procedures. Such activities can cause financial losses, undermine customer confidence, expose banks to regulatory penalties, and damage their reputations. The Association of Certified Fraud Examiners (ACFE, 2024) found that a lack of internal controls and the overriding of existing controls were among the leading control weaknesses associated with occupational fraud. These findings indicate that the existence of internal control policies does not necessarily guarantee effective fraud prevention. The problem, therefore, concerns whether controls are adequately designed, implemented, monitored, and enforced to reduce opportunities for fraud in commercial banks.

A further problem is that internal control systems may become ineffective when employees fail to comply with procedures, management overrides established rules, duties are not adequately separated, or supervisory checks are insufficient. In a banking environment, an employee who can initiate and approve transactions without independent verification may have greater opportunities to commit or conceal fraud. Similarly, weak reconciliations, inadequate access controls, poor documentation, and failure to investigate unusual transactions may allow irregularities to continue undetected. The Committee of Sponsoring Organizations of the Treadway Commission (COSO, 2013) identifies the control environment, risk assessment, control activities, information and communication, and monitoring as interrelated components of an effective internal control system. However, the extent to which these components function effectively depends on management commitment, employee competence, organisational culture, and the quality of supervision. It is therefore necessary to examine whether the internal control systems operating in selected commercial banks in Lagos State effectively support fraud prevention.

The increasing use of electronic banking and technology-driven financial services creates additional challenges for fraud prevention. Digital banking, electronic transfers, automated transaction processing, and online customer services improve convenience and operational efficiency, but they also require appropriate controls over access privileges, transaction authentication, data integrity, system monitoring, and the identification of suspicious activities. Where technology-related controls are inadequate or poorly monitored, banks may face risks associated with unauthorised access, compromised credentials, transaction manipulation, and abuse of privileged access. The Basel Committee on Banking Supervision (1998) emphasised the importance of effective internal controls in maintaining safe and sound banking operations, while the ACFE (2024) highlighted the importance of proactive data analysis, audits, and reporting mechanisms in addressing occupational fraud. These considerations raise questions about whether the selected commercial banks have sufficiently effective monitoring, communication, and review mechanisms to complement their routine transaction controls.

Although previous research has examined internal control and fraud prevention in Nigerian deposit money banks, further investigation is necessary to understand the effectiveness of these systems within the selected commercial banks in Lagos State. Adetiloye et al. (2016) examined fraud prevention and internal control in the Nigerian banking system, while Molokwu et al. (2022) investigated internal control system effectiveness and fraud prevention in Nigerian deposit money banks. These studies provide a foundation for examining the relationship between internal controls and fraud prevention, but they do not automatically establish the current effectiveness of controls in every bank or branch selected for this research. Differences in management oversight, staff compliance, risk assessment, technology, and internal auditing may produce different outcomes across institutions. Consequently, this study seeks to investigate the effect of internal control systems on fraud prevention in selected commercial banks in Lagos State, focusing on the control environment, risk assessment, control activities, and monitoring and auditing mechanisms.

1.3 Objectives of the Study

The main objective of this study is to examine the effect of internal control systems on the prevention of fraud in selected commercial banks in Lagos State.

The specific objectives are to:

1. Examine the effect of the control environment on fraud prevention in selected commercial banks in Lagos State.

2. Determine the effect of risk assessment practices on fraud prevention in selected commercial banks in Lagos State.

3. Assess the effect of control activities, including segregation of duties, transaction authorisation, and reconciliation, on fraud prevention in selected commercial banks in Lagos State.

4. Evaluate the effect of monitoring and internal auditing mechanisms on fraud prevention in selected commercial banks in Lagos State.

1.4 Research Questions

The following research questions will guide the study:

1. What effect does the control environment have on fraud prevention in selected commercial banks in Lagos State?

2. What effect do risk assessment practices have on fraud prevention in selected commercial banks in Lagos State?

3. What effect do control activities, including segregation of duties, transaction authorisation, and reconciliation, have on fraud prevention in selected commercial banks in Lagos State?

4. What effect do monitoring and internal auditing mechanisms have on fraud prevention in selected commercial banks in Lagos State?

1.5 Research Hypothesis

The following null hypothesis will be tested at the 0.05 level of significance:

H₀: Internal control systems have no statistically significant effect on fraud prevention in selected commercial banks in Lagos State.

1.6 Significance of the Study

The findings of this study may be beneficial to bank management, internal auditors, employees, regulators, customers, researchers, and students.

Bank management: The study may provide evidence on the effectiveness of internal control systems in preventing fraud. The findings may help management identify weaknesses in existing procedures and strengthen accountability, supervision, risk assessment, and compliance with internal policies.

Internal auditors and risk management personnel: The study may assist internal auditors and risk officers in evaluating control procedures, identifying potential weaknesses, and improving the monitoring of transactions and organisational processes. It may also support the development of risk-based audit plans and more effective follow-up of audit recommendations.

Bank employees: The findings may increase awareness of the importance of adhering to internal control procedures, observing ethical standards, reporting suspicious activities, and complying with established authorisation and verification processes.

Regulatory authorities: The findings may provide additional evidence on the relationship between internal control systems and fraud prevention. Such evidence may be useful in informing supervisory discussions, institutional risk management practices, and efforts to strengthen compliance with applicable banking requirements.

Bank customers: Customers may benefit indirectly if the findings contribute to stronger safeguards for deposits, more reliable transactions, and improved protection of account information. Effective internal controls can help promote confidence in the integrity of banking services.

Researchers and students: The study may contribute to the literature on internal control, fraud prevention, banking operations, and corporate governance in Nigeria. It may also serve as a reference for further studies involving other financial institutions, geographical locations, or dimensions of fraud risk management.

1.7 Scope of the Study

The study focuses on the effect of internal control systems on fraud prevention in selected commercial banks in Lagos State, Nigeria.

The content scope covers four dimensions of internal control: the control environment, risk assessment, control activities, and monitoring and internal auditing mechanisms. The study will examine how these dimensions relate to fraud prevention, including the reduction of opportunities for unauthorised transactions, manipulation of records, misappropriation of assets, and other fraudulent activities.

The geographical scope is limited to the selected commercial banks in Lagos State. The population may comprise relevant bank employees and, where appropriate, internal control, audit, compliance, and risk management personnel. The specific banks, branches, sample size, and study period should be identified in the research methodology.

1.8 Limitations of the Study

The study may encounter limitations relating to access to respondents, confidentiality of banking information, time, and financial resources. Because fraud is a sensitive subject, some respondents may be unwilling to disclose information about weaknesses in their institutions’ control procedures or may provide socially desirable answers. Commercial banks may also restrict access to internal audit reports, fraud records, and other confidential documents.

To address these limitations, the researcher will seek the required institutional permissions, explain the academic purpose of the study, maintain respondents’ confidentiality, and avoid requesting restricted customer or transaction information. Data collection will focus on authorised research instruments and information that can be ethically obtained. If the study relies on questionnaires or interviews rather than independently verified fraud records, the findings will be interpreted as evidence of respondents’ perceptions and reported experiences rather than a complete measure of actual fraud incidence. These limitations will be acknowledged when interpreting the results.

1.9 Operational Definition of Terms

Internal control system: The policies, procedures, structures, and monitoring processes established by an organisation to provide reasonable assurance concerning the achievement of operational, reporting, and compliance objectives.

Fraud: Deliberate deception, concealment, or abuse of entrusted responsibility intended to obtain an unauthorised benefit or cause improper loss to an organisation or another party.

Fraud prevention: Measures designed to reduce opportunities for fraudulent activities and minimise the likelihood of fraud occurring within an organisation.

Control environment: The organisational culture, ethical values, management commitment, governance arrangements, and assignment of authority that provide the foundation for internal control.

Risk assessment: The process of identifying, analysing, and evaluating risks that may prevent an organisation from achieving its objectives, including risks associated with fraud.

Control activities: Policies and procedures such as segregation of duties, authorisation, verification, reconciliation, access restrictions, and supervisory approval that help manage identified risks.

Monitoring and internal auditing: Processes used to evaluate whether internal controls are properly designed, implemented, and operating effectively, including independent review and follow-up of identified weaknesses.

Commercial banks: Deposit-taking financial institutions authorised to provide banking services, including accepting deposits, processing payments, and providing credit facilities.

Selected commercial banks: The commercial banks chosen by the researcher for participation in the study within Lagos State.

Project – The Effect of Internal Control Systems on the Prevention of Fraud in Organisations: A Study of Selected Commercial Banks in Lagos State