Internal Control Systems and Revenue Generation in Nigerian Banks

Background to the Study

The banking industry sits at the centre of any economy, performing the essential function of financial intermediation — mobilising savings from surplus units and channelling them toward productive investment. In Nigeria, banks are integral to the functioning of the real economy, supporting trade finance, credit creation, payment systems, and foreign exchange transactions. The Central Bank of Nigeria (CBN) recognises this systemic weight, and regulatory frameworks such as the Banks and Other Financial Institutions Act (BOFIA) 2020 and the Revised CBN Code of Corporate Governance 2014 place substantial responsibility on banks to maintain sound internal control systems as a condition for sustainable operations.

Internal controls, broadly defined, are the policies, procedures, and mechanisms that management implements to provide reasonable assurance that an organisation's operational, reporting, and compliance objectives will be met. In banking, internal controls function as the institutional machinery through which banks manage risks tied to lending, fraud, regulatory non-compliance, operational failures, and liquidity crises. The COSO (2013) framework — the most widely referenced model in internal control literature — identifies five interrelated components: control environment, risk assessment, control activities, information and communication, and monitoring activities. Together, these components work to safeguard assets, ensure reliable financial information, and promote operational efficiency.

Revenue generation in banks stems from a range of activities, including interest income from loans and advances, fees and commissions from transactional services, foreign exchange income, investment income, and increasingly, non-interest income from digital banking services. For Nigerian banks operating in a high-inflation, high-risk environment shaped by credit default risk, exchange rate volatility, and cybersecurity threats, sustained revenue generation is closely tied to how well internal control systems are managed. Revenue leakages stemming from fraud, operational errors, weak credit appraisal, and inadequate monitoring directly erode profitability and, in severe cases, threaten institutional solvency.

Financial fraud remains a persistent challenge for Nigerian banks. The Nigeria Inter-Bank Settlement System (NIBSS) Fraud Report of 2023 estimated that Nigerian banks lost over N9.5 billion to various forms of electronic fraud in the preceding year, while the Nigerian Deposit Insurance Corporation (NDIC) Annual Report (2022) noted that insider-related fraud continued to account for a disproportionate share of total fraud losses. These figures point to real weaknesses in internal control systems across several banks, with direct implications for revenue sustainability. Research examining this relationship has consistently found a strong inverse link between effective internal controls and fraud losses, reinforcing the idea that stronger controls translate into better revenue protection and, ultimately, higher profitability.

Existing literature has approached internal controls from several angles — fraud prevention, corporate governance, and financial reporting quality among them. However, the direct link between the effectiveness of specific internal control components and revenue generation outcomes in the Nigerian banking sector has not received the depth of empirical attention it deserves, particularly as banks navigate the combined pressures of digital transformation, tightening regulation, and post-pandemic economic recovery. This gap motivates the present study.

This research focuses specifically on how the five COSO components of internal control systems affect revenue generation within selected Nigerian commercial banks in Lagos State. Lagos was chosen as the study area given its status as Nigeria's commercial and financial capital, hosting the headquarters or major branches of nearly all Tier-1 and Tier-2 banks in the country. By surveying bank employees — including internal auditors, compliance officers, operations managers, and finance personnel — the study draws insight directly from those most closely involved in implementing and overseeing internal control mechanisms.

At a broader level, this research adds to the growing body of knowledge on internal control governance within emerging market banking sectors. Its findings are intended to offer practical guidance to bank management, regulators, investors, and policymakers on the strategic value of robust internal controls — not simply as risk management tools, but as active drivers of revenue generation.

Statement of the Problem

Despite regulatory frameworks mandating adequate internal control systems — including the CBN's Risk-Based Supervisory Framework, BOFIA 2020, and guidelines issued by the Financial Reporting Council of Nigeria (FRCN) — Nigerian banks continue to record significant losses from fraudulent activities, operational failures, and revenue leakages. NDIC Fraud Reports spanning 2018 to 2022 consistently show fraud-related losses in Nigerian banks remaining alarmingly high, with the 2022 report alone documenting 49,062 fraud cases involving actual losses of N15.19 billion. These losses directly impact revenue generation and ultimately reduce returns to shareholders and depositors.

Several Nigerian banks have faced regulatory sanctions, recapitalisation requirements, and reputational crises as a direct consequence of control failures. Between 2016 and 2023, at least four commercial banks received CBN-mandated directives related to control deficiencies, and two regional banks had their operating licences withdrawn partly due to governance and control lapses. These developments make clear that internal control weaknesses are not merely technical shortcomings — they carry far-reaching consequences for the sustainability of revenue streams within affected institutions.

On the academic side, while considerable research exists on internal controls in Nigerian banks, most of it centres on fraud prevention, audit quality, and regulatory compliance, with limited attention to the specific channels through which internal control components affect revenue generation. The few studies that have examined this link directly have produced mixed findings and tend to be limited in scope. This points to a clear need for a comprehensive, empirically grounded investigation into how internal control system components affect revenue generation in Nigerian banks.

Compounding the problem is the accelerating digitalisation of banking services, which brings new risk vectors — cybercrime, system outages, digital identity fraud — that existing literature has not fully captured. This study addresses this problem by offering updated, context-specific evidence on the relationship between internal control systems and revenue generation within the Nigerian banking sector.

Aim and Objectives of the Study

The broad objective of this study is to examine the impact of internal control systems on revenue generation in Nigerian banks. The specific objectives are to:

•      1. Assess the impact of the control environment on revenue generation in Nigerian banks.

•      2. Examine the relationship between risk assessment procedures and revenue generation in Nigerian banks.

•      3. Determine the extent to which control activities influence revenue generation in Nigerian banks.

•      4. Evaluate the effect of information and communication systems on revenue generation in Nigerian banks.

•      5. Ascertain the role of monitoring and evaluation activities in enhancing revenue generation in Nigerian banks.

Research Questions

The study is guided by the following research questions:

•      1. To what extent does the control environment impact revenue generation in Nigerian banks?

•      2. What is the relationship between risk assessment procedures and revenue generation in Nigerian banks?

•      3. How do control activities influence revenue generation in Nigerian banks?

•      4. What effect do information and communication systems have on revenue generation in Nigerian banks?

•      5. In what ways do monitoring and evaluation activities enhance revenue generation in Nigerian banks?

Research Hypotheses

The following null hypotheses were formulated and tested at the 0.05 level of significance:

•      H01: There is no significant relationship between the control environment and revenue generation in Nigerian banks.

•      H02: Control activities do not have a significant impact on revenue generation in Nigerian banks.

•      H03: There is no significant relationship between information and communication systems and revenue generation in Nigerian banks.

Significance of the Study

This study carries significance across theoretical, empirical, and practical dimensions.

Theoretical Significance

From a theoretical standpoint, the study contributes to agency theory and stewardship theory by providing empirical evidence on how internal control mechanisms — deployed by principals such as shareholders and regulators to constrain agent behaviour — affect the revenue outcomes central to both parties' interests. It also extends the application of the COSO framework within the context of an emerging market banking sector.

Significance for Bank Management

For bank management and boards of directors, the study offers actionable insight into which specific components of internal control systems carry the strongest bearing on revenue generation, enabling more targeted investment in control mechanisms. In an era of shrinking net interest margins and intensifying competition, understanding the revenue implications of control decisions matters more than ever.

Significance for Regulators

For banking regulators — particularly the CBN, NDIC, and the FRCN — the findings may inform future regulatory guidelines and examination protocols by highlighting the specific control weaknesses most damaging to revenue performance. Regulators can also draw on this study to design capacity-building programmes for bank compliance and internal audit personnel.

Significance for Academics and the Public

For academics and researchers, this study adds to the relatively limited body of empirical work linking internal control components to revenue generation in Nigerian banks, offering a methodological template for further studies in related areas. For students and the wider public, the research provides accessible, well-grounded insight into how banks manage the delicate balance between risk control and revenue optimisation — a subject with real implications for depositor safety, investor returns, and national financial stability.

Scope of the Study

This study is limited to assessing the impact of internal control systems — specifically the five components identified in the COSO (2013) framework — on revenue generation in selected commercial banks in Lagos State, Nigeria. Five commercial banks were selected for the study: First Bank of Nigeria Limited, Zenith Bank Plc, Access Bank Plc, Guaranty Trust Holding Company (GTCO) Plc, and United Bank for Africa (UBA) Plc. These banks were chosen for their status as Tier-1 institutions with significant market share, long operational histories, and publicly available financial information that supports contextual analysis.

The study focuses on employees working in internal audit, compliance, risk management, operations, and finance departments — the cadres most directly involved in designing, implementing, and overseeing internal control systems. It covers the period 2020 to 2024, a window marked by significant regulatory change, accelerated digital banking adoption, and the lingering economic effects of the COVID-19 pandemic.

Limitations of the Study

Like most social science research, this study encountered several limitations worth acknowledging.

•      Response Bias: The use of a self-administered questionnaire as the primary data collection instrument introduces potential response bias, as respondents may provide answers they perceive as socially acceptable or professionally safe rather than accurate reflections of their organisations' control realities.

•      Restricted Access: Access to certain senior bank officials was limited due to the confidential nature of internal control information within financial institutions. This was mitigated by relying on employees at supervisory and managerial levels who are sufficiently knowledgeable about their banks' control systems.

•      Geographic Scope: The study is confined to Lagos State, which, though representative of the Nigerian banking industry, may not fully capture the experiences of banks operating primarily in other geopolitical zones where different risk environments may prevail.

•      Cross-Sectional Design: The cross-sectional nature of the research design means causal relationships cannot be established with certainty, and the findings represent a snapshot in time rather than a longitudinal trajectory. Future studies could address this by adopting panel data methods.

Operational Definition of Terms

•      Internal Control System: The totality of policies, procedures, and processes established and maintained by bank management to provide reasonable assurance regarding the achievement of objectives related to operational effectiveness, reliable financial reporting, and compliance with laws and regulations.

•      Control Environment: The set of standards, processes, and structures that provide the foundation for the execution of internal control across the organisation, encompassing the tone at the top, integrity and ethical values, organisational structure, and commitment to competence.

•      Risk Assessment: The process by which management identifies, analyses, and evaluates risks that may impede the achievement of organisational objectives, forming the basis for determining how risks should be managed.

•      Control Activities: The actions and procedures established by management to mitigate risks and achieve objectives, including authorisations, approvals, verifications, reconciliations, and physical safeguards over assets.

•      Information and Communication: The processes and systems through which relevant information is captured, processed, and communicated across the organisation to support the execution of internal control responsibilities.

•      Monitoring Activities: The ongoing and periodic assessments conducted by management and internal auditors to evaluate the quality and effectiveness of internal controls over time and to identify deficiencies requiring remediation.

•      Revenue Generation: The totality of income earned by a bank from its various business activities, including interest income, fees and commissions, foreign exchange income, investment income, and other non-interest income streams.

•      Nigerian Banks: Commercial banks duly licensed and regulated by the Central Bank of Nigeria and operating within the Nigerian financial system.

•      Fraud: Any intentional act or omission designed to deceive others, resulting in loss or harm to the bank or its customers, including but not limited to embezzlement, forgery, identity theft, cyber fraud, and misappropriation of assets.

Conclusion

The evidence from Lagos's Tier-1 banks makes a clear case: internal control systems are not just a defensive shield against fraud but an active driver of revenue performance. With control environment, control activities, and information and communication systems all showing significant, positive relationships with revenue outcomes, this study reinforces that banks investing in stronger internal controls are, in effect, investing directly in their bottom line. As Nigerian banks navigate accelerating digital transformation, tightening regulation, and evolving fraud tactics, treating internal control strength as a strategic revenue lever — rather than a mere compliance obligation — offers one of the clearest paths toward sustained profitability and financial stability.

Frequently Asked Questions (FAQs)

1. What is the relationship between internal control systems and revenue generation in Nigerian banks?

Research shows a significant positive relationship between effective internal control systems and revenue generation in Nigerian banks, with control activities, control environment, and information and communication systems all contributing meaningfully to revenue outcomes.

2. What are the five components of the COSO internal control framework?

The COSO (2013) framework identifies five interrelated components: control environment, risk assessment, control activities, information and communication, and monitoring activities.

3. How does a strong control environment affect bank revenue?

A strong control environment is significantly associated with increased customer confidence and deposit growth, as it reflects sound tone at the top, ethical values, and organisational commitment to competence.

4. How much has fraud cost Nigerian banks in recent years?

The NDIC's 2022 Annual Report documented 49,062 fraud cases involving actual losses of N15.19 billion, while the NIBSS Fraud Report of 2023 estimated over N9.5 billion lost to electronic fraud in the preceding year.

5. Which Nigerian banks were examined in this internal control study?

The study focused on five Tier-1 commercial banks: First Bank of Nigeria Limited, Zenith Bank Plc, Access Bank Plc, Guaranty Trust Holding Company (GTCO) Plc, and United Bank for Africa (UBA) Plc.

6. Why do control activities matter for fraud prevention?

Control activities — including authorisations, approvals, verifications, reconciliations, and physical safeguards over assets — directly reduce fraud losses and revenue leakages by making it harder for irregularities to go undetected.

7. How do information and communication systems support revenue generation?

Effective information and communication systems enable timely decision-making by ensuring relevant information is captured, processed, and shared across the organisation, which supports revenue optimisation efforts.

8. Which regulatory bodies oversee internal controls in Nigerian banks?

The Central Bank of Nigeria (CBN), the Nigerian Deposit Insurance Corporation (NDIC), and the Financial Reporting Council of Nigeria (FRCN) are key regulators overseeing internal control adequacy in Nigerian banks.

9. What happens when Nigerian banks have weak internal controls?

Weak internal controls have led to regulatory sanctions, recapitalisation requirements, and in some cases licence withdrawals. Between 2016 and 2023, at least four commercial banks received CBN-mandated directives related to control deficiencies.

10. How can Nigerian banks strengthen their internal control systems?

This study recommends that bank management invest continuously in updating and strengthening internal control frameworks to align with evolving operational and regulatory realities, particularly as digital banking introduces new risk vectors.