Services
Audit, Risk and GRC Services
Independent assurance and advisory for organisations where controls, compliance and accountability matter
Muzamani (Pty) Ltd provides internal audit, IT audit, SCM probity, risk and governance advisory services to public-sector entities, private organisations, NGOs and donor-funded programmes.
The practice is principal-led by David Muzamani Chauke, MBA, drawing on senior experience across internal audit, IT audit, finance, procurement and risk. Engagements are scoped around the client’s objectives, risk profile, applicable requirements and reporting needs.
Our work is evidence-based, clearly documented and focused on findings that management can act on.
Our Services
1. Internal Audit & Co-Sourcing
Independent internal audit support for organisations that require additional capacity, specialist skills or an experienced practitioner to deliver part or all of the internal audit cycle.
We can support:
- Risk assessment and internal audit planning
- Annual and rolling audit plans
- Operational, financial and compliance audits
- Governance and control reviews
- SCM and procurement audits
- Fraud risk and control reviews
- Follow-up of previous audit findings
- Audit committee and management reporting
- Co-sourced or managed internal audit assignments
Typical deliverables:
- Risk and control assessments
- Audit planning documentation
- Risk and Control Matrices (RACMs)
- Audit workpapers and evidence records
- Internal audit reports
- Management action plans
- Follow-up reports
Suitable for:
Organisations strengthening an existing internal audit function, addressing capacity gaps, or requiring independent specialist support.
Engagement basis:
Assignments can be structured as individual reviews, co-sourced support, managed internal audit services or defined project engagements.
2. IT Audit & IT General Controls
Independent assurance over the controls that support critical information systems, financial systems and technology-enabled business processes.
Areas of review may include:
- User access and identity management
- Privileged access
- Joiner, mover and leaver controls
- Change management
- IT operations and system administration
- Backup and recovery
- Cybersecurity controls
- Network and endpoint security
- Logging and monitoring
- Configuration controls
- Business continuity and disaster recovery
- IT policies, procedures and governance
- Controls supporting ERP and other critical business systems
Reviews may cover systems such as SAP, Microsoft Dynamics and other significant financial or operational applications, depending on the engagement.
Typical deliverables:
- IT control assessment
- Risk and Control Matrix
- Control design and operating-effectiveness findings
- Evidence register
- Detailed IT audit report
- Management action plan
Suitable for:
SOEs, municipalities, public institutions and private organisations requiring independent assurance over technology controls or preparing for financial, regulatory or external audit requirements.
Relevant criteria may include:
COBIT, ISO/IEC 27001, applicable information-security policies, internal control frameworks and organisation-specific requirements.
3. SCM Probity & Procurement Compliance
Independent review of procurement and supply chain management processes, transactions and controls.
The focus is on whether procurement was conducted in accordance with the requirements applicable to the organisation and whether key controls operated as intended.
Areas of review may include:
- Procurement planning
- Demand management
- Quotations and competitive bidding
- Bid evaluation and adjudication
- Delegations of authority
- Segregation of duties
- Supplier due diligence
- Conflicts of interest and declarations
- Contract completeness
- Contract variations and extensions
- Deviations and exceptions
- Goods and services received
- Payment controls
- Irregular expenditure indicators
- Supplier master and transaction data
Where suitable data is available, analytical procedures can be used to identify patterns and exceptions such as duplicate payments, unusual supplier activity, split transactions and other indicators requiring investigation.
Typical deliverables:
- Transaction testing results
- Exception register
- SCM compliance and probity findings
- Root-cause analysis
- Probity or compliance report
- Management action plan
Suitable for:
SOEs, municipalities, public institutions, NGOs and donor-funded programmes requiring independent assurance over procurement processes and expenditure.
Reviews are scoped against the applicable legislation, National Treasury requirements, regulations, instructions and approved SCM policies relevant to the organisation and period under review.
4. ERM & GRC Advisory
Advisory support for boards, executives, risk committees and management teams seeking to strengthen risk management, governance and control arrangements.
Areas of support include:
- Enterprise risk management framework reviews
- Risk assessments
- Risk appetite and tolerance
- Risk registers
- Governance and committee structures
- Fraud risk management
- Risk and Control Matrices
- Policies and procedures
- Internal control assessments
- Audit and Risk Committee support
- GRC maturity assessments
- Governance, risk and compliance improvement initiatives
The work can be aligned, where applicable, with COSO, ISO 31000, King V, PFMA, MFMA and other relevant regulatory or organisational requirements.
Typical deliverables:
- Risk assessment reports
- Risk registers
- RACMs
- Framework and policy reviews
- Governance assessments
- GRC improvement plans
- Management and committee reports
Suitable for:
Boards, Audit and Risk Committees, executives and organisations reviewing or strengthening their governance and risk arrangements.
5. Managed Advisory & Specialist Reviews
Defined-scope advisory assignments for organisations requiring experienced support on a specific control, governance, risk, compliance or assurance issue.
Assignments may include:
- Targeted control reviews
- Special internal audit investigations and reviews
- Compliance assessments
- Governance reviews
- Procurement and contract reviews
- Risk and control assessments
- Audit remediation support
- Second-opinion reviews
- Independent assurance over management improvement initiatives
The scope is agreed before work begins, including objectives, criteria, information requirements, deliverables, reporting arrangements and commercial terms.
How We Deliver an Engagement
Muzamani uses a structured audit and advisory approach designed to maintain clear evidence trails and accountability throughout the engagement.
1. Understand
We establish the organisation’s objectives, processes, risks, regulatory environment and reporting requirements.
2. Scope
The engagement scope, objectives, criteria, information requirements and deliverables are agreed before fieldwork begins.
3. Assess
We review documentation, interview relevant personnel, test controls and analyse available data according to the agreed scope.
4. Report
Findings are documented using a structured approach covering:
Condition | Criteria | Cause | Risk/Impact | Recommendation | Management Action
This provides management with a clear link between the evidence identified, the requirement or expected control, the underlying cause and the action required.
5. Follow Up
Where included in the engagement, agreed management actions are tracked and follow-up procedures are performed to assess progress.
Standards, Legislation and Frameworks
The criteria applied to an engagement depend on its scope, sector, objectives and applicable requirements. Not every framework applies to every assignment.
Professional and governance standards
- IIA Global Internal Audit Standards
- King V
- Relevant professional and ethical requirements
Technical frameworks
- COBIT
- ISO/IEC 27001
- ISO 31000
- COSO Internal Control and Enterprise Risk Management frameworks
Public-sector legislation and requirements
- Public Finance Management Act (PFMA)
- Municipal Finance Management Act (MFMA)
- Applicable National Treasury regulations, instructions and requirements
- Applicable procurement legislation and regulations
- Approved organisational SCM policies and delegations
Other legislation, regulations, standards and organisational requirements are considered where relevant to the engagement.
Independence and Objectivity
Muzamani maintains professional independence and objectivity in assurance engagements.
Management remains responsible for decisions, implementation and operation of controls. Muzamani provides independent assurance and advisory support without assuming management or operational responsibilities.
Where advisory and assurance services are provided to the same organisation, potential self-review, conflict or independence threats are considered during engagement scoping. Appropriate safeguards are agreed where necessary, and material independence considerations are disclosed to the relevant governance authority.
A Principal-Led Delivery Model
Muzamani is a principal-led practice. David Muzamani Chauke, MBA, leads engagements and remains directly involved in the work.
Where an assignment requires additional specialist capacity, suitably qualified associates or specialist resources may be engaged for defined components, subject to appropriate quality, confidentiality and independence requirements.
This model provides clients with direct access to senior experience while allowing specialist capability to be brought in where the engagement requires it.
Who We Work With
Our services are suited to:
- State-owned entities and municipalities requiring PFMA/MFMA-aligned assurance and SCM probity
- Public institutions requiring independent ITGC, governance or control reviews
- Private-sector organisations in sectors such as energy, transport and mining
- NGOs and donor-funded programmes requiring procurement, grant compliance and internal control assurance
- Boards and Audit and Risk Committees requiring an independent assessment of control effectiveness
- Internal audit functions requiring co-sourced or specialist support
Need a Defined Scope?
If you know the service you need, tell us about the organisation, objectives and reporting deadline.
If you are not sure which service is appropriate, describe the issue or requirement and we can help define a suitable engagement scope.