Ombud Council AR 2026

PART C: GOVERNANCE

• Consumer awareness baseline study: Due to procurement delays and cashflow constraints, the study was deferred to financial year 2026/27. The Board accepted this residual risk, and the fact that the 2025/26 APP target would not be met. • Effectiveness of Risk Management In the opinion of management and the Audit and Risk Committee, the Council maintained an effective integrated GRC framework during the year under review. This conclusion is supported by:

• An internal audit of the risk management processes revealed no material breakdowns in risk management and recommended only minor improvements. • All risks that breached appetite or tolerance were actively managed with Board‑approved plans, resulting in no risks outside of appetite being carried forward to the next financial year. • The risk profile improved progressively from Q1 to Q4, with only one accepted residual risk (baseline study) recorded as outside of risk appetite by year end.

6. Internal Control, Internal Audit and Audit Committees The Council has appointed internal auditors, Nexia SAB&T, to perform its internal audits for a 5-year period until 31 July 2029. The auditors performed six audits for the year under review. The table below reflects the summary of the reports presented to the Audit and Risk Committee and the Board. Table 14: Internal Audit Reports

Number of findings

No.

Internal audit review

1 Reporting against Predetermined objectives 2 Procurement and contract management review

4 3 2 2 1

3 Internal financial controls review 4 Limited IT general controls review

5 Risk Management review

6 Follow up review

0 12

The Council received 12 internal audit findings during the 2025/26 audit review process of which none were

significant. The internal controls are operating effectively.

7. Compliance With Laws and Regulations As per the GRC Framework a comprehensive Regulatory Universe register of applicable laws binding the Council is maintained and reviewed by the ARC when there are legislative changes, and no incidents of non-compliance have been identified. A compliance policy, plan and framework were developed during the financial year, with implementation actions included in the GRC Plan to be implemented in the 2026/27 financial year.

tools. • Comprehensive governance logging registers and developed monitoring tools, to evaluate and strengthen policy adherence. • Developed integrated issue, incident, and exception registers to record and manage non-compliance, breaches, or deviations. • Completed a comprehensive Privacy Impact Assessment (PIA) and embedded aligned procedures, registers, and templates within the POPIA and PAIA Framework to ensure integrated data protection and information management compliance. • Awareness and training sessions on POPIA, PAIA, and employee compliance responsibilities. • Conducted a policy gap analysis and recommendations on new policies.

Various tools to ensure compliance with applicable laws were developed throughout the course of the year under review, including: • A comprehensive independent audit assessment of the Regulatory Universe (RU), governance requirements, and all existing policies and procedures. • A structured approach for the ongoing monitoring of legislative, governance, and policy changes through a set of compliance planning, monitoring and tracking

Ombud Council 2025/26 Annual Report

53