President Bola Ahmed Tinubu has approved a comprehensive forensic audit of the Integrated Personnel and Payroll Information System (IPPIS), federal Ministries, Departments and Agencies MDAs.
This follows the reported findings by the Independent Corrupt Practices and Other Related Offences Commission (ICPC) concerning “fake agencies,” ghost workers and other weaknesses in government controls.
The audit will be coordinated by the Minister of Finance and Coordinating Minister of the Economy, Taiwo Oyedele, according to a State House press release issued on Friday.
The exercise is intended not only to identify questionable payroll entries or irregular public bodies, but to determine how such entities and individuals gained access to government funds, systems and official recognition in the first place.
The planned review will have two linked components. The first will examine IPPIS and related payroll, personnel, pension and public-finance platforms.
Auditors are expected to reconcile figures identified by the ICPC, trace how fictitious or ineligible persons were enrolled, and scrutinise identity, biometric, access and bank-account controls.
The review will also examine the links between IPPIS and other government platforms, including the Govt Integrated Financial Management Information System (GIFMIS), Remita, the Treasury Single Account and Sub- Treasury Single Account systems.
The stated objective is to establish whether reported losses resulted from software defects, weak procedures, poor separation of duties or the deliberate circumvention of controls.
The second component will cover federal agencies, departments, commissions, councils, parastatals and other government bodies.
It will seek to establish a definitive inventory of such institutions, verify their legal foundations and examine how they secure official recognition, budgetary treatment, correspondence privileges, office space and access to public systems.
“The exercise will establish the nature and extent of weaknesses in Govt’s control system, and determine how such weaknesses have been exploited,” the State House said.
Why the audit matters
The announcement points to a problem broader than an inflated payroll. It raises questions about the architecture through which Nigerian state creates institutions, recognises employees, approves spending and monitors public resources.
If an entity without a clear legal basis can obtain a budget line, occupy government premises or transact through official platforms, the vulnerability is institutional rather than merely clerical.
A credible audit could therefore produce three types of findings. It may identify genuine administrative bodies that have been poorly documented; entities whose status is unclear or duplicated; and organisations that exist mainly on paper but have acquired the privileges
of government institutions.
Those categories should not be treated as identical. An agency with an outdated enabling instrument presents a governance problem, while a fictitious
body created to channel funds may point to deliberate fraud.
The distinction is important because the phrase “fake agencies” can cover several different practices.
It may refer to bodies that have no valid law or executive instrument behind them, duplicate agencies performing substantially the same function, dormant institutions that remain active in budgets, or unofficial structures that have been made to appear legitimate through letters, websites, office addresses or administrative endorsements.
The audit will need to publish the criteria used to classify each case rather than relying on labels alone.
To establish whether an agency is legitimate, investigators will need to verify whether it was created by law, regulation or another valid government instrument.
This is essential to prevent public funds from being allocated to entities without lawful authority. They will also need to determine how each institution entered the national budget and identify the officials who approved its allocations.
That line of inquiry could reveal
weaknesses in budget preparation, legislative scrutiny or administrative review.
The audit should further establish which ministry, department or authority formally recognised each body.
This would help expose gaps in the certification process through which institutions gain official status.
Investigators will also examine whether the entities operate bank accounts, manage contracts, maintain payrolls or conduct procurement.
Such evidence would show whether
an irregular institution has become a channel for diverting public funds.
Finally, auditors will assess whether each body has audit committee, a supervising authority and clear reporting obligations.
Without these safeguards, irregularities can continue for long periods without detection or accountability.
The ghost-worker problem
Ghost workers are commonly understood as people who appear in official payroll or personnel records but are not entitled to receive public salaries.
That description can include entirely fictitious identities, duplicate records, former employees who remain on a
payroll, deceased or retired workers whose names are not removed, and real employees whose identities are used to generate unauthorised payments.
It can also include people who are listed under the wrong institution or grade and therefore receive payments to which they are not entitled.
The financial loss from each fraudulent entry may appear small when viewed separately, but payroll fraud is a recurring leakage.
A single compromised identity can generate monthly payments, pension deductions, allowances and other benefits until the record is detected and closed.
Where the payment is routed into an account controlled by an official or intermediary, the fraud may involve collusion across recruitment, verification, payroll approval and banking processes.
The planned IPPIS review is consequently significant because it is designed to trace the entire chain rather than simply delete names.
Removing an invalid record may stop future payments, but it does not by itself answer the central accountability questions: who created the record, who verified it, who approved the payment, where the money went, and whether supervisors ignored warning signs?
A proper reconciliation should compare payroll records with personnel files, appointment letters, attendance or deployment records, retirement and death registers, identity and biometric information, tax and pension data, and bank-account details.
It should also test for duplicate bank accounts, repeated identity numbers, unusual clusters of employees sharing contact details, payments to accounts associated with multiple institutions, and.staff whose records move between agencies without a documented transfer.
The audit must, however, distinguish deliberate payroll fraud from data-quality failures. A mismatch may result from a spelling error, an outdated identity record, delayed notification of retirement or a legitimate secondment.
Presuming criminality from every discrepancy could punish genuine workers and weaken confidence in the exercise. Each case should be classified, documented and subjected to due process.
How fake agencies and ghost workers can reinforce each other
The two issues may appear separate, but they can form a mutually reinforcing system.
A questionable agency can provide an administrative home for fictitious employees, while ghost workers can help inflate the apparent size and legitimacy of an entity.
A larger payroll may support requests for more budget, office space, vehicles and contracts. In turn, those resources can make a paper institution look operational to outsiders.
This is why the proposed audit of agencies and payroll systems should not be conducted as two isolated exercises.
Auditors should map each agency’s legal status, leadership, staff strength, budget, bank relationships, procurement activity and supervising ministry.
They should then compare the institution’s claimed functions with its actual personnel and spending patterns.
An agency with no verifiable mandate, a large unexplained payroll and substantial procurement activity would warrant deeper investigation than an institution with a simple documentation gap.
The interfaces named in the statement are also important. Fraud often occurs not because one system is entirely false, but because different systems do not reconcile.
A person may be valid in a personnel database but absent from an approved establishment; an agency may exist in one administrative register but not in the budget; or a payment may pass through financial platform without corresponding personnel or procurement record.
Weak links between systems create opportunities for manipulation and make responsibility difficult to assign. The audit’s credibility will depend on implementation.
The State House has directed that the exercise be independent, professional and forensically sound, and promised access to relevant government records in collaboration with the ICPC.
Those commitments will need to be matched by transparent procedures and safeguards against interference. First, the audit should define its scope, methodology and reporting timetable.
Second, it should preserve an evidence trail showing who accessed, changed or approved sensitive records.
Third, suspected cases should be referred to the appropriate investigative and prosecutorial authorities, while administrative errors should be corrected through a separate process.
Fourth, the final report should disclose aggregate findings and the basis for classifying agencies and payroll entries, subject to privacy and legal constraints.
The exercise should also lead to permanent controls.
These could include a continuously
updated government-entity register; mandatory verification of every agency’s legal foundation before budget access; regular payroll reconciliation; prompt removal of retirees and deceased persons; stronger separation between recruitment, verification and payment
approval; and automated alerts for duplicate identities, bank accounts and unusual payment patterns.
The audit should determine who added or retained questionable personnel records. In the long term, this weakness should be addressed through tamper- resistant audit logs, clear accountability for every change made to government records.
It should also establish how irregular bodies gained official recognition. A permanent solution would be the creation of a single authoritative register containing every legally constituted government entity.
Another key question is why existing controls failed to detect anomalies. Government should respond by introducing continuous reconciliation across personnel, identity, finance and banking systems rather than relying only on occasional reviews.
Where public officials or private collaborators may have been involved, the findings should lead to risk-based investigations, appropriate sanctions and the recovery of misappropriated funds.
Finally, the government must assess whether the same weaknesses could recur after the audit. Independent internal audits, periodic external reviews and regular public reporting would help prevent the problems from returning.
A test of institutional integrity
The audit announcement signals that the government views the reported problems as a test of fiscal governance and institutional integrity.
Its success should not be measured only by the number of names removed from payroll or agencies struck from a list.
The more consequential measure will be whether the exercise explains how irregularities entered the system, identifies those responsible, recovers public funds where appropriate and closes the pathways that allowed the abuse.
A narrow purge could produce short-term savings while leaving the underlying machinery intact.
A comprehensive review, by contrast, could clarify which government bodies are legally constituted, establish reliable public workforce database and connect payroll approval to verifiable work, identity and payment records.
The central challenge is to maintain both firmness and fairness. Allegations of fake agencies and ghost workers are serious, but they must be converted into evidence-based findings.
If that standard is met, the forensic audit could become more than an exercise in removing names and institutions from official records. It could serve as a structural examination of how public authority and public money are authorised, tracked and protected.
