Opinion piece by Ms Lumka Pani, Chief Audit Executive, Coega Development Corporation:
Internal Audit is often misunderstood. Many perceive auditors as the compliance police or the team that shows up to scrutinise financial records and catch people “red handed.”
An email from Internal Audit induces panic instead of fostering partnership. As we mark International Internal Audit Awareness Month this May, it is time to demonstrate how Internal Audit is a value-adding, risk-focused partner in achieving organisational objectives.
Internal Audit is not about ticking boxes, nor is it exclusively focused on financial records. Internal Audit examines how the organisation works in practice and provides independent assurance that controls are fit for purpose and aligned with strategic objectives. When done right, it is a collaborative exercise that helps organisations navigate risk, strengthen controls, and embed sustainable good governance.
Good governance is not a once-off tick-box activity; it is a culture of consistent integrity, accountability and transparency demonstrated across daily operations. It is also driven by ethical leadership, the clear ownership of decisions, and embedded risk management and controls. Good governance underpins performance, informed decision-making, and long-term value creation.
At Coega, alignment between Risk Management and Internal Auditing is foundational. We adopt a risk-based audit approach guided by the IIA Standards and frameworks such as COSO ERM and ISO 31000. Our audit plans are driven by the organisation’s risk profile, drawing focus to areas of high impact.
Internal Audit provides independent assurance that risks are identified, managed, controlled, and regularly reported to management and the Audit and Risk Committee to address key risks and control weaknesses.
When we step into a Business Unit, we are not there to disrupt. We aim to understand business objectives, identify the risks that could prevent the achievement of those objectives, and evaluate whether controls are strong enough to mitigate those risks. For example, if a communication’s policy requires every opinion piece to be pre-approved, this requirement constitutes a key internal control. Our role in assessing the effectiveness of this control is to evaluate a sample of published opinion pieces to confirm that the control is indeed implemented. If we find gaps, we do not merely list the failures. We diagnose the root causes – from training gaps to overly complex processes – so that we can recommend practical, sustainable improvements that strengthen the control environment and support improved future compliance.
A foundational element of our work is our deep co-dependency with the risk management team and other assurance providers. We do not work in a silo. The Enterprise Risk Management Framework is the foundation of our Strategic Audit Plan. Risk management identifies hurdles to the achievement of corporate objectives and goals included in the corporate strategy, and Internal Audit aligns its work to those priorities.
The public sector faces relentless and evolving challenges, from fraud and ethical failures, data breaches and artificial intelligence risks, cybersecurity threats, and shifting environmental, social and governance expectations. Internal Audit must therefore remain curious, agile, and dynamic to respond to these challenges. We must understand the environment in which the organisation operates to remain a trusted advisor.
While internal auditors are not forensic/fraud investigators and detectors, we are trained and expected (as per the IIA standards) to recognise red flags, unusual trends, and potential indicators of fraud. At Coega, Internal Audit and Forensic Audit fall within the same business unit and work closely so that any anomalies can be seamlessly referred and investigated.
The aim is a clean audit environment, which is a natural outcome of consistent ethical behaviour and sound controls. When compliance and good governance are embedded, they become second nature rather than a year-end scramble.
During this Internal Audit Awareness Month, consider this an open invitation to view Internal Audit as a pillar of transparency, accountability, and responsible stewardship. Through independent assurance and practical recommendations, we help to ensure that risks are managed, controls are robust, and that the organisation delivers on its mandate with integrity. We remain committed to upholding these standards and to being a strategic partner in governance and performance.
