• Identify potential risks and ways to address them proactively.
• Support the organisation’s ESG disclosures, ensuring the accuracy of disclosed ESG data.
• Inform stakeholders and leadership about shortcomings in reporting standards or ESG efforts.
• Prioritise critical issues that impact operations, products or services via an ESG materiality assessment.
• Quantify ESG risks, opportunities and impacts, and report their findings.

What does an ESG Audit Entail?

When evaluating and assessing ESG practices and performance, an independent examination is conducted to review the organisation’s policies, procedures, systems and activities. The audit also may identify whether the organisation aligns with recognised standards, guidelines, and best practices.

What Are the Benefits of Auditing ESG?

Although not mandatory in South Africa, ESG auditing is fast becoming necessary for organisations as it provides a mechanism for verifying ESG performance. This is important in meeting shareholder expectations. The assessment identifies and evaluates possible responses to risks that enable the organisation to develop and apply the appropriate strategies and controls to mitigate the risks proactively. ESG audits foster greater confidence among stakeholders in the organisation’s sustainability and responsible business practices.

The proactive risk management approach helps maintain the company’s broader brand reputation as it successfully navigates the torrid waters of ESG. At the same time, verifying ESG disclosures also increases the credibility of an organisation’s ESG claims in the public eye and to capital investors.
One of the most significant benefits of ESG auditing is ensuring compliance with industry standards and statutory regulations, further reducing risks.

In addition, there are opportunities to be found in ESG auditing. Organisations may identify areas for improvement in operations, identify improvements to social responsibility frameworks and to strengthen governance processes.

Conducting an ESG Audit for Your Company

It is evident that in today’s business landscape, ESG auditing is essential. It enables companies to address ESG related risks and seize opportunities proactively. It helps management to prioritise ESG risk management strategies, and the audits underpin compliance. ESG Audits enhance ESG disclosures’ accuracy and provide stakeholders with added assurance.

• General Health-Check Review: This review conducts a comprehensive evaluation of the organization’s operational, procedural and control systems, to pinpoint potential weaknesses and critical issues that require attention.
• Area-Specific Audit Review: This review zeroes in on particular segments of the business that are flagged by management as potential risk areas, with the aim of assessing adherence to regulations, operational efficiency and exposure to risks.
• Comprehensive Forensic Review: This thorough investigation delves into the company’s financial dealings, records, and operational practices to detect any discrepancies, fraudulent conduct or violations of compliance standards.

What areas are typically assessed during a general health check-up?

The process typically involves an assessment of various aspects of an organisation’s operations, processes and internal controls to detect and prevent fraudulent activities, including:

• General fraud risk assessments,
• Reviewing the code of conduct and ethics policies,
• Assessing the effectiveness of controls designed to prevent fraud,
• Reviewing financial processes and controls,
• Evaluating the due diligence processes for vendors and suppliers, as well as process for screening and hiring employees,
• Reviewing IT security measures, and
• Evaluating training and awareness programs, whistleblower hotlines, reporting mechanisms.

When is an ‘Area-Specific’ Audit Review Recommended?

These reviews are tailored to address unique risks and characteristics specific to higher risk business areas or processes within your organisation. Evidence is gathered, internal controls assessed, and compliance with relevant policies and regulations evaluated.

Areas typically focused on include revenue recognition, accounts receivable, purchasing and accounts payable, inventory acquisition (Supply Chain) management, payroll and employee expenses, as well as financial reporting and disclosures.

When is a Full Forensic Review Required?

A full forensic review is warranted when there is suspicion of fraud or misconduct, or when litigation support is necessary in the context of legal disputes or formal proceedings. This exhaustive examination aims to uncover potential fraud, misconduct, or irregularities. The review involves a comprehensive analysis of all relevant information to identify and document evidence of fraudulent activities.

The process includes:

• Gathering of financial and non-financial information,
• Performing detailed forensic accounting procedures and assessing the integrity and accuracy of accounting records and financial statements,
• Performing a detailed fraud risk assessment to evaluate the organisation’s susceptibility to fraud based on industry-specific risks, internal control weaknesses, and historical fraud incidents,
• Reviewing internal controls related to financial reporting, cash handling, inventory management, and other relevant processes, as well as testing their design and operating effectiveness,
• Preparation of necessary information and documentation to support legal proceedings where necessary.

Collaboration with a professional forensic team possessing the necessary specialized skills, knowledge and expertise in forensic accounting, investigative techniques and legal considerations, is vital for organizations to effectively identify and mitigate these risks.

Are you confident in your organisation’s ability to identify and mitigate risks associated with fraud?

• Increased Vulnerability to Cyber Attacks: Without regular ITGC audits, security weaknesses may go undetected, making systems more susceptible to cyber-attacks, e.g. hacking, malware and ransomware. This can lead to data breaches, public embarrassment and loss of sensitive information.
• Non-Compliance with Regulations: Many industries are subject to regulations that require robust IT controls. Failure to perform ITGC audits can result in exposure to non-compliance with legislative and regulatory obligations, which could lead to legal penalties, fines, and loss of business licenses.
• Data Integrity and Accuracy Issues: Without ITGC audits, there is a higher risk of data corruption, inaccuracies and inconsistencies, which can affect decision-making and operational efficiency.
• Operational Disruptions: Ineffective IT controls can lead to system downtimes, data loss, and operational disruptions, including Denial of Service (DoS) and Distributed Denial of Service (DDoS).
• Financial Loss: The absence of ITGC audits increases the risk of control lapses potentially resulting in fraud, unauthorised transactions and financial misstatements.
• Reputational Damage: Security breaches, data losses and compliance failures can severely damage an organisation’s reputation. Customers, partners, and stakeholders may lose trust in the organisation, leading to loss of business and market value.
• Inefficient IT Processes: Regular ITGC audits help identify inefficiencies and areas for improvement in IT processes.
• Lack of Assurance for Stakeholders: Stakeholders, including investors, customers, and regulatory bodies, require assurance that an organisation’s IT systems are secure and reliable. ITGC audits are a key part of a Combined Assurance framework.
• Increased Risk of Insider Threats: Without proper controls and regular audits, the risk of undetected insider threats increases. Employees or other internal users might exploit weaknesses in IT systems for malicious purposes or unintentional errors might go unnoticed.
• Inadequate Incident Response: ITGC audits assess the effectiveness of incident response plans and procedures. Without these audits, organisations may be inadequately prepared to respond to IT incidents.

 
Strengthening Your Essential IT Controls
 
ITGC audits encompass a broad range of controls that form the backbone of an organisation’s IT environment. These controls are essential for establishing a robust foundation that supports the effective and secure operation of business IT systems.

• IT Governance: An effective IT governance control framework provides for effective management and oversight of IT resources and activities. ITGC audits assess the organisation’s IT governance structure, policies, and procedures to provide assurance with regard to alignment with business objectives, regulatory requirements, and industry best practices.
• Access Controls: Access controls are paramount for safeguarding sensitive information and preventing unauthorised access to IT systems and data. ITGC audits assess the adequacy of controls related to user authentication, authorisation and access.
• Change Management: Effective change management processes are essential for implementing changes to IT systems and applications in a controlled and systematic manner. ITGC audits evaluate the documentation, approval procedures, and monitoring mechanisms associated with change management processes to ensure that changes are properly reviewed, tested, and authorised.
• Security Management: Security management controls are critical for protecting IT assets from various threats, including cyberattacks, malware and unauthorised access. ITGC audits assess the organisation’s adherence to security policies, procedures, and standards aimed at maintaining the confidentiality, integrity and availability of IT resources, including network security, system hardening, encryption, and security incident response capabilities.
• Backup and Recovery: Backup and recovery controls are essential for ensuring the availability and integrity of critical data and systems in the event of a disaster or disruption. ITGC audits examine the organisation’s backup processes, data retention policies and recovery capabilities to verify that adequate measures are in place to recover data and resume operations in a timely manner.

 
The Role of ITGC Audits in Risk Management and Compliance

Beyond enhancing the reliability and security of IT systems, ITGC audits play a critical role in risk management and compliance efforts. By identifying control deficiencies, weaknesses, and vulnerabilities within the IT environment, ITGC audits enable organisations to proactively address risks and strengthen their control environment. Moreover, ITGC audits help organisations demonstrate compliance with regulatory requirements, industry standards, and contractual obligations, providing assurance to stakeholders and enhancing trust and credibility.
 
Why Choose Moore in South Africa for your ITGC Audits?

At Moore in South Africa, our team of expert auditors merge profound IT expertise with regulatory acumen to deliver audits that not only ensure compliance but also fortify your IT systems’ security and efficiency. Here’s why partnering with us is a game-changer:

• Build Trust and Confidence Our audits demonstrate to stakeholders that your IT systems are robust and resilient, reinforcing your commitment to exemplary IT governance and security standards.
• Mitigate Risks Our expertise helps you establish a robust IT control environment, preventing system failures and minimizing downtime, thereby ensuring business continuity and mitigating financial risks from potential cyber incidents.

 
Our ITGC Audit

Unlock the potential of your IT systems with our comprehensive and customisable ITGC audit process. We offer unparalleled insights and tools to fortify your IT control framework, ensuring the utmost integrity, reliability and security of your information systems. Our tailored approach accommodates every business’s unique needs and budget, providing a flexible solution that drives success.
 
Our ITGC audit process can be segmented into one of three tiers based on your IT dependency: Low, Medium, or High. Beyond this, we also offer specialised Application Control Testing and Penetration Testing services to enhance your security posture.
 
Our process includes:

• Initial Assessment: We begin by meticulously understanding your IT environment, conducting thorough risk assessments and defining the audit scope to match your specific requirements and financial considerations.
• Control Evaluation: Our experts review critical IT general controls, including access management, change management, data backup and disaster recovery, ensuring robust protection.
• Detailed Testing: Through rigorous testing, we confirm that your IT controls operate flawlessly and effectively safeguard your assets.
• Comprehensive Reporting: We deliver detailed findings, risk assessments and actionable recommendations, empowering you to make informed decisions that strengthen your IT governance.
• Ongoing Support: Our commitment extends beyond the audit; we assist you in implementing enhancements and maintaining superior IT controls.

 
Choose our ITGC audit process to gain a strategic advantage and elevate your IT governance to new heights.

• Protection and maintenance of the integrity and stability of the financial system, by preventing the infiltration of illicit funds and mitigating the risk of large movements of illicit money.
• Combating of crime and terrorism, by disrupting the flow of finances that sustain criminal enterprises.
• Preventing criminals from using illicit gains to outcompete legitimate businesses and ensuring that all financial activities are transparent and taxable.
• Strong AML measures build trust and credibility with customers, local and foreign investors, and regulators – both locally and internationally.
• AML measures align with international standards. This compliance facilitates a good reputation and international cooperation in fighting money laundering and other financial crimes.
• Contributes to the broader goal of promoting good governance and transparency, which are essential for the development and well-being of societies and our economy.
• Helps detect and prevent fraudulent schemes that can harm consumers.

What frameworks and regulations have been implemented in South Africa to combat money laundering?

Enacted in 2001, the Financial Intelligence Centre Act (FICA) forms the cornerstone of South Africa’s AML framework, establishing the Financial Intelligence Centre (FIC), which is responsible for gathering, analysing, and disseminating financial intelligence to combat money laundering and terrorist financing.

In addition, the Prevention of Organised Crime Act (POCA), targets organised crime and money laundering and the Financial Sector Regulations Act (FSRA), which has established the Prudential Authority and the Financial Sector Conduct Authority (FSCA), are responsible for overseeing the financial sector and ensuring compliance with AML regulations.

Should we audit AML, and why is it important that we do?

Auditing AML practices in institutions that are part of the broader regulatory framework is crucial for several reasons, viz.:

• Regulatory Compliance and maintenance of good standing

Regular audits help ensure that programs comply with local and international laws, as well as help identify and rectify compliance issues before they result in regulatory action. Regular risk based audits reduce the prospect of licences being withdrawn by regulators and card association/s or banking partners in clearing and settlement systems.

• Risk Management

Audits can uncover gaps and weaknesses in an organisation’s AML controls, allowing the organisation to address these issues proactively. It also ensures that AML measures are effective, thereby reducing the risk of the organisation being exploited for illicit purposes.

• Maintaining Reputation

A strong AML program, verified through regular audits, helps build and maintain credibility. Effective AML practices contribute to overall market integrity and confidence, which is essential for the stability and functioning of financial systems.

• Operational Efficiency

Audits provide insights into how AML processes can be streamlined and improved, leading to more efficient operations. Identifying ineffective or redundant controls allows an organisation to allocate resources more effectively, focusing on areas of higher risk.

• Detection and Prevention of Fraud

Regular audits can provide independent assurance that the controls to detect suspicious activities and potential money laundering schemes are identified at an early stage. Auditing helps ensure that controls are not only in place but also functioning as intended to deter and detect fraudulent activities.

• Compliance Culture

Ensuring that staff are well-informed and vigilant about AML requirements fosters a culture of compliance within the organisation. Regular audits promote accountability at all levels of the organisation, ensuring that everyone understands their role in the AML framework.

• Adapting to Regulatory Changes

Regular audits help organisations stay current with regulatory changes and adapt their AML programs accordingly. It further encourages a cycle of continuous improvement, helping organisations refine their AML practices in response to emerging threats and regulatory updates.

• Supporting Law Enforcement

Effective AML audits help maintain thorough records and documentation, which can be crucial for law enforcement investigations into money laundering and related crimes. Audited and well-maintained AML systems facilitate better cooperation with regulatory authorities and law enforcement agencies.

Auditing AML practices is essential for ensuring compliance with legal requirements, managing risks, maintaining organisational reputation, enhancing operational efficiency, and contributing to the overall integrity and security of the financial system. Regular audits help organisations identify weaknesses, improve their AML controls, and stay ahead of evolving regulatory expectations and criminal tactics.

Are you confident in your AML measures?

In today’s complex financial environment, robust AML practices are not just a regulatory requirement but a crucial element for the integrity and success of your business. To ensure that your organisation is compliant and protected, take the first step towards stronger compliance and risk management by contacting your nearest Moore Firm today.

• Identify potential risks and ways to address them proactively.
• Support the organisation’s ESG disclosures, ensuring the accuracy of disclosed ESG data.
• Inform stakeholders and leadership about shortcomings in reporting standards or ESG efforts.
• Prioritise critical issues that impact operations, products or services via an ESG materiality assessment.
• Quantify ESG risks, opportunities and impacts, and report their findings.

What does an ESG Audit Entail?

When evaluating and assessing ESG practices and performance, an independent examination is conducted to review the organisation’s policies, procedures, systems and activities. The audit also may identify whether the organisation aligns with recognised standards, guidelines, and best practices.

What Are the Benefits of Auditing ESG?

Although not mandatory in South Africa, ESG auditing is fast becoming necessary for organisations as it provides a mechanism for verifying ESG performance. This is important in meeting shareholder expectations. The assessment identifies and evaluates possible responses to risks that enable the organisation to develop and apply the appropriate strategies and controls to mitigate the risks proactively. ESG audits foster greater confidence among stakeholders in the organisation’s sustainability and responsible business practices.

The proactive risk management approach helps maintain the company’s broader brand reputation as it successfully navigates the torrid waters of ESG. At the same time, verifying ESG disclosures also increases the credibility of an organisation’s ESG claims in the public eye and to capital investors.
One of the most significant benefits of ESG auditing is ensuring compliance with industry standards and statutory regulations, further reducing risks.

In addition, there are opportunities to be found in ESG auditing. Organisations may identify areas for improvement in operations, identify improvements to social responsibility frameworks and to strengthen governance processes.

Conducting an ESG Audit for Your Company

It is evident that in today’s business landscape, ESG auditing is essential. It enables companies to address ESG related risks and seize opportunities proactively. It helps management to prioritise ESG risk management strategies, and the audits underpin compliance. ESG Audits enhance ESG disclosures’ accuracy and provide stakeholders with added assurance.