Services / Compliance
Few organisations can say which laws apply and where they stand. We map every obligation and show what to fix first.
Are we compliant?
A gap assessment against the framework you are answerable to, section by section, with a plan to close each gap.
POPIA, King V, PFMA, MFMA, Companies Act, ISO 27001, sector regulators
What must we comply with?
For organisations without one list of everything they must comply with. We build it, section by section, and map each obligation to an owner and a control.
Is the function working?
An independent view of the compliance function itself: how it is set up, how it monitors, how it reports.
The three services differ in scope. The way we work and what we hand over does not.
Obligations are drawn section by section from the Acts that apply to you, so nothing generic and nothing missing.
Each obligation links to the control that meets it and the person responsible, so “compliant” is a claim you can evidence.
The register sits in your workspace. Your team updates status and evidence, and the board report regenerates from it.
| Obligation | Source | Owner | Control | Status |
|---|---|---|---|---|
| Appoint and register an Information Officer | POPIA s55 to s56 | CECEO | Yes | Met |
| Operator agreements in writing | POPIA s21 | HEHead: Legal | Partial | Gap |
| Security breach notification | POPIA s22 | CICIO | No | Open |
| Board charter approved and reviewed | King V | COCompany Secretary | Yes | Met |
| Combined assurance model in place | King V | CACAE | Partial | Gap |
| Risk management policy approved | PFMA s51(1)(a) | CRCRO | Yes | Met |
A reliable and professional service provider on governance and risk management. Their services improved our risk management practices, with clearer risk assessments, named owners and better reporting.
SceloChief Director: Municipal Governance, COGTATop risks agreed in 5 days
If a regulator, auditor, customer or the board has asked whether you comply with a specific Act or code, start with the compliance assessment. If nobody can produce one list of everything you must comply with, start with the obligations register. If the question is whether the compliance function itself is working, start with the programme review. The free assessment settles it.
Any South African Act, code or standard. POPIA and King V are the most common, followed by PFMA, MFMA, the Companies Act, ISO 27001 and sector regulators such as the FSCA, NCR and OHSC. The framework is confirmed on the scoping call and the price is per framework.
Yes. The obligations register is the base. Assessments slot into it as sections and the programme review sits on top. Combined engagements are scoped and priced on the call.
We deliver the plan and, where asked, draft the policies and procedures. Implementation sits with your team, with our fractional support available on a retainer.
Both. Public sector engagements include PFMA or MFMA obligations and are structured for Auditor-General review. Private sector engagements include Companies Act and sector regulators.
It stays in your secure workspace. Your team keeps it current, and the board report regenerates from it each quarter. Optional support is available through the board reporting service.
Book with our team. A review of where your compliance stands today and a recommended next step.
Request a Free Assessment