Tag: CorporateGovernance

The demands on internal audit are changing as organisations deal with risks that increasingly affect different parts of the business. Boards need to understand how these risks connect. They must also assess whether the assurance they receive provides a reliable picture of the organisation's exposure.

Fraud has become one of those business risks that most owners acknowledge, but very few believe will happen to them. That mindset is becoming increasingly dangerous.

The growing use of so-called “advisory boards” is one of the most encouraging developments in modern corporate governance. Businesses increasingly recognise that, in a world shaped by artificial intelligence, cyber security, digital transformation, geopolitical uncertainty and rapidly evolving markets, no board of directors can reasonably possess all the skills required to govern effectively.

An internal data breach, even an accidental one, can trigger formal breach notification obligations under the Protection of Personal Information Act (POPIA). The Information Regulator recently fined Central Johannesburg TVET College R500,000 for failing to comply with an enforcement notice. This decision shows that organisations must also complete the corrective actions that the Regulator requires.

Consider a regulatory institution with an enviable compliance record. Its enabling legislation contains robust independence provisions. Its annual report is filed on time. Furthermore, its external audit is clean. It has a conflict-of-interest policy, a risk management framework, and a signed memorandum of understanding with each of its peer regulators. By many conventional measures, its governance arrangements appear sound.

Every meeting is now recorded and transcribed by an Artificial Intelligence (AI) notetaker, but nobody knows where the files reside or who has copied them. In August 2026, Dark Reading discovered a vulnerability in tl;dv’s backend. It allowed an authenticated user to access meeting information belonging to other customers. The vulnerability put more than 180,000 meeting records across 80,000 or more users at risk.

For businesses considering an acquisition, falling below South Africa’s mandatory merger notification thresholds might seem to mean one less regulatory hurdle to worry about. But that is not always the case. Recent developments show that smaller deals can still attract the attention of the Competition Commission, particularly where a transaction could affect competition or involves a business whose true value may not yet be reflected in its turnover or assets.

Most advice about selling a business focuses on the seller as an individual. It considers the founder, the entrepreneur, or the person whose name appears on the door. However, family businesses complicate that picture. The person sitting across the table from a buyer represents more than themselves. They represent a family. In my experience, family members rarely approach a sale with the same objectives.

Read our exclusive cover story titled - Operational resilience – adapting to geopolitical instability by Nashikta Angad, Movashan Moodley and Mishana Pillay, KPMG Southern Africa, plus a host of other topical management articles written by professionals, consultants and academics.

The latest regulatory action against a major financial institution resulted in a R28 million administrative penalty. The penalty followed shortcomings under the Financial Intelligence Centre Act (FICA). It is a timely reminder that compliance cannot become a once-off exercise.