IT Governance Failures in Nigeria: Lessons for CISA Professionals

With Nigeria rapidly adopting technologies in order to advance its digital journey, there is a significant amount of investment by various businesses in the banking, telecommunications, government, healthcare, and energy sectors. Despite the huge investments, many firms are still grappling with poor IT governance practices, ineffective cybersecurity practices, unsuccessful digital initiatives, and poor risk management strategies.

For professionals working as Certified Information Systems Auditors (CISA), it is crucial to understand the importance of the aforementioned elements in the evolving Nigerian digital business landscape.

TLDR

• The fast-paced digital revolution in Nigeria has revealed significant weaknesses in IT governance in banking, government, healthcare, telecommunication, and energy.
• Some examples of weak governance practices are lack of effective cybersecurity, failed IT projects, inadequate compliance systems, no accountability, and poor risk management.
• This has created a high demand for CISA professionals with competencies in IT governance, IT auditing, cybersecurity, compliance, and control.
• With the increasing penetration of artificial intelligence in Nigeria, companies will require IT professionals who can govern artificial intelligence, ensure cybersecurity, and compliance.
• Fintechs, telecommunication companies, healthcare, oil and gas companies, consulting firms, and governments have been hiring CISA professionals.

Understanding IT Governance in the Nigerian Context

IT Governance is the process through which technology investments are aligned with organizational objectives, with considerations of risks, security, compliance, and efficiency.

The importance of IT governance includes:

• Enhancing Accountability
• Mitigating Cybersecurity Threats
• Compliance With Regulatory Laws
• Digital Asset Protection
• Promoting Business Continuity
• Improving Technology Investments

Nevertheless, IT governance issues remain rampant among various Nigerian organizations, including inadequate oversight, outdated technology, poor internal controls, lack of enforcement of policies, and cybersecurity immaturity.

For instance, NITDA of Nigeria estimates that more than 56 percent of IT projects within public sector organizations fail due to poor planning, lack of interoperability, and weak governance systems.

Major IT Governance Failures in Nigeria

Failed Government IT Projects

The main issue of governance in Nigeria revolves around the high rate of failure of technology projects in the public sector. Most projects lack sufficient risk assessment, adequate audit procedures, and alignment with organizational goals.

According to NITDA, some of the factors that contribute to the failures of projects include:

• Deficient governance for projects
• Non-compliance monitoring
• Procurement malpractices
• Lack of value of the business
• Stakeholder oversight deficiency

The above factors lead to wastage of resources, abandonment of IT systems, and low-quality service delivery.

In relation to CISA professionals, the above factors indicate that there is a need for:

• Project auditing in IT
• Evaluation of governance framework
• Vendor assessment
• Risk-based auditing
• Compliance monitoring

Cybersecurity and Internal Control Weaknesses

Cybersecurity threats in Nigeria have been on the rise due to poor governance and a lack of proper security measures.

In 2025, there were allegations that Union Bank experienced a breach in its operational system, with unauthorized withdrawal of money from client accounts. Poor governance and oversight mechanisms were among some of the factors blamed for the breach.

Also, during audit investigations at governmental departments, it was found that:

• Internal control systems were poor
• Documentation was substandard
• Transparency was lacking
• Procurement processes were questionable
• The organization had poor cybersecurity measures

Lack of Accountability and Compliance

One other significant issue with governance in Nigeria is poor regulatory compliance and accountability enforcement.

From recent assessments on transparency and integrity, many federal organizations have not met the required standards of governance.

Some challenges include:

• Lack of consistent policy implementation
• Lack of good audit trails
• Poor data governance
• Poor segregation of duties
• Poor executive oversight

For CISA professionals, these issues reinforce the importance of:

• Conducting governance audits
• Assessing internal controls
• Regulatory compliance
• Data governance
• Continuous monitoring

Lessons for CISA Professionals

Governance Must Start at the Leadership Level

One of the important lessons learned from the experience of poor IT governance in Nigeria is that both cybersecurity and governance issues are executives’ issues and not just technical issues.

If the support from the board level and the accountability of executives are missing, even state-of-the-art security measures might fail in providing adequate protection to organizations.

CISA professionals need to make sure that:

• IT governance is consistent with the organizational strategy
• Leadership knows cyber risks
• There is clarity regarding governance responsibilities
• Risk management strategies are periodically reviewed

Risk Management Cannot Be Ignored

Most Nigerian entities concentrate more on embracing technology innovations than on governance and risk assessments.

Ineffective risk management may result in:

• Data security threats
• Failing digital transformations
• Financial scams
• Regulatory sanctions
• Negative publicity

CISA experts perform vital roles in recognizing governance vulnerabilities prior to serious incidents.

Major considerations include:

• Enterprise risk management
• IT controls testing
• Third-party risk assessments
• Business continuity management
• Incident response reviews

Importance of Continuous Auditing and Monitoring

Conventional year-end audits are no longer adequate for the rapidly changing digital world.

Organizations require constant governance monitoring to detect weaknesses and comply with regulatory requirements.

CISA-certified professionals can assist organizations in implementing:

• Continuous auditing systems
• Compliance automation tools
• Real-time risk reporting mechanisms
• Security governance dashboards
• AI governance controls

The Importance of AI Governance Is Growing

As more Nigerian companies use AI, the dangers associated with governance become more pronounced.

Some of the issues highlighted by scholars include:

• Potential data breaches
• Poor AI regulation
• Ethical loopholes
• Inadequate institutional readiness
• Lack of governance capability

Why CISA Professionals Are in High Demand in Nigeria

The burgeoning digital economy in Nigeria has been fueling the need for experts in governance, risk management, cybersecurity, and auditing.

Sectors where CISA certification is highly sought after are:

• Financial services/fintech
• Telecommunications
• Public sector
• Healthcare
• Oil and gas industry
• Consultancy firms
• Tech firms

It has become evident to organizations that good governance is crucial for successful digital transformation and cybersecurity.

Skills Nigerian Organizations Need From CISA Professionals

To solve these kinds of problems, there is a need to have professionals who specialize in:

• IT Governance
• Cybersecurity Auditing
• Risk Management
• Compliance
• Cloud Security Governance
• Data Protection
• Incident Response Auditing
• Internal Controls Evaluation
• Vendor Risk Management

CISA certification will assist professionals to gain credibility in these domains, along with equipping themselves for taking up leadership positions in Information Systems Audit and Control.

Wrap Up

The failure of IT governance in Nigeria is an important learning experience that can be learned from by organizations and cybersecurity experts. Poor governance, weak internal controls, IT project failures, and poor risk management pose great dangers to companies and governments alike in terms of their operations and cybersecurity.

For CISA professionals, these issues have highlighted the need to understand how auditing and compliance can be achieved through sound governance principles. The future digitalization of Nigeria’s economy would make it even more necessary for organizations to employ people with expertise in governance and audit.