Who Audits the Borehole? Nigeria’s New Sustainability Rules and the Projects They Won’t Check
Eche Munonye, Founder and Chief Strategist, CSR Reporters 
Who Audits the Borehole? Nigeria's New Sustainability Rules and the Projects They Won't Check
Nigeria is about to get serious about sustainability reporting. But reporting rules and independent proof of community impact are not the same thing, and the gap between them is where trust is won or lost.
Picture a community a year after the ribbon was cut. The borehole has a plaque with a company logo on it. The photographs from the commissioning day are still on the company’s website. But the pump has been dry since the rains stopped, and the spare part is a two-day journey away.
This scene is imagined, a composite of stories many of us have heard.
Nothing in the company’s annual report is false. The borehole was built. The money was spent. The press release was accurate on the day it was written. And yet the question that matters most to that community, whether it still works, appears nowhere in any filing.
That question, and who is responsible for asking it, is what this article is about.
What is coming: real progress
Let us start with what deserves credit. In February 2026, the Financial Reporting Council of Nigeria (FRC) published an amended roadmap for adopting the IFRS Sustainability Disclosure Standards, together with its first Sustainability Reporting Guideline. The standards in question are IFRS S1, which covers sustainability-related financial disclosures in general, and IFRS S2, which covers climate.
Under the roadmap, adoption becomes mandatory for significant public interest entities for accounting periods beginning on or after 1 January 2028. Smaller entities follow later. Assurance is phased in too: it is required from the third year of reporting, starting with limited assurance and moving toward reasonable assurance in later years. The roadmap also provides for the licensing of sustainability assurance providers, so that the people checking the numbers are themselves accountable.
The Securities and Exchange Commission has now turned up the pressure. In a circular dated 23 September 2026, it directed public companies and significant capital market operators to submit their IFRS S1 and S2 implementation plans by 15 October 2026. Some industry commentators have already noted that the SEC’s deadline for companies that must report from 2028 appears to run ahead of the FRC’s own timetable, which is a reminder that the rollout is still being worked out.
None of this is small. For years, sustainability reporting in Nigeria has been largely voluntary, uneven and unchecked. A mandatory, assured regime is a genuine step forward.
What those rules check, and what they do not
Here is the part that rarely makes the headlines. IFRS S1 and S2 are built around a specific question: what do sustainability and climate matters mean for the company’s finances and prospects? They are designed to serve investors and lenders trying to understand risk.
That is a valuable question. It is not the same as asking whether a company’s community programmes delivered what they promised.
A company can produce an excellent, assured, standards-aligned report on its climate risks and governance, and still have no independent verification of whether its scholarship scheme reached the right students or its clinic is stocked. Assurance, in this setting, tests whether disclosed information is reliable. It does not walk to the borehole.
We have seen the practical edges of this in our own work. In The Verdict, we have commended companies for adopting IFRS S1 and S2 early, and in the same columns we have had to flag, more than once, that the named assurance provider was missing or unconfirmed. If the provider is not named, readers cannot even judge who is vouching for the report.
As far as we are aware, no general law requires Nigerian companies, outside specific sectors, to report the outcomes of their community programmes at all. Spending on CSR is a choice, and so is the story told about it.
The one place where the money is mandated
There is one major exception, and it is instructive. Under the Petroleum Industry Act, upstream oil and gas companies must pay three per cent of their prior-year operating expenditure into a Host Communities Development Trust for the benefit of the communities where they operate. This is not charity. It is a statutory obligation.
The regulator, the Nigerian Upstream Petroleum Regulatory Commission (NUPRC), said in August 2026 that 172 such trusts have been incorporated. Its chief executive told the Revenue Mobilisation Allocation and Fiscal Commission that oversight of how the trust funds are managed remains the exclusive preserve of the NUPRC, and she credited the trusts with funding schools, hospitals and other infrastructure.
That is a clear answer to the question of who audits. It is also an answer that deserves a follow-up question. When one regulator holds exclusive oversight, who can check its work? In April 2026, communities around OML 26 in Delta State publicly complained that the operators had not met their three per cent obligations, and a tripartite meeting convened by the NUPRC that month ended without a resolution. The NUPRC has since said it will look into a separate disagreement between another operator and its host community in Anambra State.
We are not suggesting the regulator is failing. We are saying that a mandated fund with a single overseer is exactly the kind of arrangement in which independent, public verification would add the most trust.
Four things people call “an audit”
Part of the problem is that the word is stretched to cover very different checks.
- A financial audit tests whether accounts are fairly stated. It can confirm money was spent. It cannot confirm the spending changed anything.
- Assurance on a sustainability report tests whether disclosed data are reliable, within the scope the report claims. It does not reach beyond the report.
- Regulatory oversight tests compliance with a rule, such as whether a payment was made on time. It is only as broad as the rule.
- Independent impact verification goes into the field: project visits, beneficiary voices, evidence of what changed and whether it lasted. This is the only one that answers “did it work?”, and it is voluntary and rare.
A company can pass the first three and still be unable to answer the last.
The fair case for companies
Companies would make several reasonable points. Reporting standards are moving quickly, and the phased timeline exists precisely so that firms can build capability. Assurance and licensing take time to put in place. Independent field verification costs money, and a company that does it voluntarily takes on a reputational risk its competitors avoid. And regulators, not corporations, set the scope of what must be checked.
Those arguments have weight. They explain why the gap exists. They do not explain why it should be allowed to stay open, because the cost of a gap is carried by the people at the end of the pipe.
What better looks like
No new law is needed to start. Five habits would close much of the distance.
- Report outcomes, not just spend. Use recognised frameworks such as GRI 203 on indirect economic impacts and GRI 413 on local communities.
- Name the assurance provider and the scope. Say who checked what, and what was left out.
- Publish a project register. List the projects, locations, partners and status, so communities and journalists can find them.
- Verify flagship projects independently. Commission field-based checks for the largest programmes, and publish the findings, including the awkward ones.
- Give communities a way to be heard. Report complaints received and how they were resolved.
For regulators, the matching request is simple: make the annual reports of Host Communities Development Trusts publicly searchable, so that the people they are meant to serve can see what has been funded.
Three questions for the next big announcement
- Who verified it, and are they independent of the company?
- What exactly did they check: the numbers, or the result on the ground?
- Can the community see the findings?
If the answers are vague, the project may still be good. But a good project nobody has checked is, for the people affected, a promise and not yet a fact.
CSR Reporters runs awards and rankings, and so we sit inside the very recognition ecosystem we write about. We hold ourselves to the same standard we are asking of others.
Nigeria is right to move toward assured sustainability reporting. Let us make sure the next question we learn to ask is not only “is the report reliable?” but “did it work, and who checked?”
Responsible leadership has to be earned, tested and accountable. A claim is only as credible as the person who verified it.
