Governance, Risk & Compliance Advisory
Good governance supports sound decisions instead of adding paperwork. SRC gives boards and executives a clear view of risk, accountability and controls — so they understand their exposure and know what to fix first.
Built for these clients.
- Boards, audit and risk committees, and executive teams
- Public institutions and state-owned entities
- Private-sector organisations, including those processing personal information under POPIA
Where clients come to us.
- A risk register that no longer reflects real operational exposure
- Boards that don't receive the information they need for effective oversight
- Gaps between regulatory requirements and day-to-day practice
- Uncertainty about POPIA obligations and how to implement them
- Unclear risk ownership and untested controls
Specialist capabilities.
- Enterprise & operational risk
Risk identification, register review and control assessment.
- Board oversight & governance
Review of governance structures, reporting and decision processes.
- Regulatory & compliance analysis
Gap analysis against relevant regulation and good practice.
- POPIA implementation
Practical support to meet South Africa's Protection of Personal Information Act.
Typical deliverables: a governance and risk gap assessment, an updated risk register and control view, compliance findings, and prioritised, practical recommendations.
Our governance work is led by a team that combines legal, public administration and risk training — including an Associate of the Institute of Risk Management of South Africa (IRMSA).
A clear, disciplined process.
- 01
Scoping conversation
- 02
Review of policies, registers, governance documents and controls
- 03
Interviews with key role-holders
- 04
Gap analysis against relevant regulation and good practice
- 05
Prioritised findings report and recommendations
- 06
Optional implementation support
Methods, deliverables and scope are agreed after an initial scoping discussion.
Questions clients ask.
What is a governance and risk review?
A structured assessment of how decisions are made and overseen, how risks are identified and owned, and whether controls work in practice.
Can you help us comply with POPIA?
Yes. We provide POPIA implementation support for South African organisations, from gap analysis to practical policy and process recommendations. We do not provide legal opinions.
Do you replace our internal audit function?
No. We provide an independent advisory view that complements internal audit and your risk function.
Do you work with public-sector entities?
Yes. Public institutions and state-owned entities are a core client group.
Can the review cover other countries' regulations?
Regulatory requirements are assessed in their relevant jurisdiction. POPIA support is specific to South Africa.
Related offerings: Strategy & performance · Financial & economic analysis
Local context. An integrated perspective.
SRC welcomes enquiries from Kenya, Zimbabwe, South Africa, Mauritius, Botswana, Zambia and Namibia. Our offices are in Sandton, Johannesburg; Rondebosch, Cape Town; and Harare. The scope and delivery arrangements for each mandate are agreed with the client.
Meet the team behind this work