Landline: +27 (0)10 595 9610
Email: info.vga@pkf.co.za

Compliance Audit Methodology

Compliance Reviews

Our compliance reviews are based on a structured Compliance Framework designed to help organisations identify, manage and monitor their legal and regulatory obligations.

We assess:

• The completeness of the organisation’s compliance universe
• Allocation of compliance responsibilities and ownership
• The effectiveness of monitoring and reporting processes
• The use of compliance calendars and diaries
• Escalation procedures for non-compliance
• Reporting to management and the Audit Committee

Where compliance activities are embedded into daily operations (e.g. PFMA, POPIA and transaction screening), we evaluate their effectiveness, level of automation, external referencing and exception handling processes.

We also engage with Board members and senior management to assess the effectiveness of compliance oversight and the assurance provided through the Combined Assurance model.

Regulatory Change Management

We review how legislative updates are identified, communicated and incorporated into compliance processes. This includes assessing:

• Subscription to regulatory update services
• Updating of compliance calendars and responsibilities
• Staff training following regulatory changes
• Sample testing of how new or amended legislation was implemented

Compliance Function Effectiveness

We evaluate the compliance functions:

• Staffing, skills, capacity and budget
• Systems and software tools
• Performance measures and reporting structures
• Integration within the broader Risk and Combined Assurance framework

This includes assessing coordination with other risk functions and the effective use of technology.

Comply and Declare Solution

We have developed our own solution for managing compliance which we call “comply and declare”.

This solution identifies relevant compliance activities and assigns the responsibilities and escalations that ensures compliance has been achieved. We know of at least 21 activities that every company should attend to each month. The solution is content rich with compliance requirements, forms to be submitted and links to regulators systems for submissions. Compliance requirements can be included for the business sector and to include internal compliance requirements – like financial close.

Our clients use the solution on their own platforms, our cloud platform or we complete the compliance on their behalf using the compliance diary.

The declare element is used to record declarations, gifts and PFMA/ MMFA reportable matters. It can be used for other purposes such as independence signoffs, ethics education and sign off, and conflicts of interest declarations.