External audit and assurance: a guide for boards of complex organisations

An external audit is an independent examination of an organisation's financial and performance records that tests their accuracy, their compliance with legislation and the reliability of what the organisation reports. For boards and audit committees of complex South African organisations, understanding what that assurance does — and does not — cover is central to real oversight.

What independent external audit provides

Independent external audit underpins public confidence, tests stewardship and promotes accountability. It gives stakeholders an objective view of whether an organisation's records present a fair and accurate picture of its financial position and results. In the public sector, the Auditor-General South Africa (AGSA) is the supreme audit institution, mandated by the Constitution and the Public Audit Act to audit and report on the accounts, financial statements and financial management of state departments and public entities.

In the corporate sphere, the Companies Act 71 of 2008 sets the framework for company incorporation, financial record-keeping and the statutory audit or assurance of companies, while the PFMA, as administered by National Treasury, requires timely, transparent reporting and the annual audit of public entities. Together these statutes require governing bodies — boards of directors under the Companies Act 71 of 2008, and accounting officers or authorities under the PFMA — to maintain assurance processes that validate financial integrity and compliance.

The three things an external audit covers

A public-sector external audit evaluates three distinct aspects. The first is the audit of the financial statements, which expresses an independent opinion on whether they fairly present the organisation's financial position and results and are free from material misstatement — misstatement being incorrect or omitted information, improper classification of transactions, or inaccurate values placed on assets and liabilities. The second is the audit of reporting against predetermined objectives in the annual performance report, which tests whether the reported performance information is useful and reliable — valid, accurate and complete against predetermined criteria.

The third is the audit of compliance with the key legislation applicable to financial matters, under which auditors identify material non-compliance and report instances of unauthorised, irregular, and fruitless and wasteful expenditure.

How a board should read the audit opinion

The audit opinion gives the board a clear read on the organisation's financial and performance reporting, and the AGSA frames five outcomes. A clean audit outcome is the highest level of assurance — financial statements free from material misstatement (a financially unqualified opinion) with no material findings on performance reporting or compliance, signalling proper records, effective controls and disciplined management. A financially unqualified opinion with findings means the statements carry no material misstatement, but auditors raised material findings on performance reporting, on compliance, or both.

A qualified opinion means the statements contain material misstatement in specific amounts, or there was insufficient evidence to confirm specific entries. An adverse opinion means the misstatement is not confined to specific amounts or represents a substantial portion of the statements, undermining their overall reliability. A disclaimer of opinion arises when the organisation cannot provide sufficient documentary evidence across substantial areas, so the auditor cannot express an opinion at all.

What an external audit does not do

Together these statutes require governing bodies — boards of directors under the Companies Act 71 of 2008, and accounting officers or authorities under the PFMA — to maintain assurance processes that validate financial integrity and compliance.

— Synthesis of South African regulatory guidance

Effective oversight also means understanding the audit's limits. Because an audit relies on selective testing and works within the inherent limitations of auditing methods and of internal control itself, it cannot guarantee that every material misstatement will be detected, and it does not provide absolute assurance over the complete accuracy of reported information. Because compliance testing focuses on key legislation in selected areas, the audit does not assure that the organisation has complied with all applicable law.

Auditors stay alert to signs of irregularity, but fraud detection is not the main purpose of an external audit. And the audit assures only that the annual performance report is useful and reliable — not that the underlying service delivery was actually achieved; a clean audit reflects strong financial management and compliance, not perfect service delivery.

Turning assurance into action

Assurance earns its value only when the board acts on it. At the end of the audit the AGSA prepares an unpublished management report for management and the executive authority, setting out the findings, their root causes and practical recommendations. Leadership must approve and actively monitor formal action plans that resolve the internal-control deficiencies for good, rather than patching symptoms.

The oversight itself is structural. Under the Companies Act 71 of 2008 and the PFMA, the audit committee evaluates audit findings, assesses financial management and monitors internal-control improvement, supported by an adequately resourced, functioning internal audit unit that tests risks and controls through the year. When internal audit, the audit committee and executive leadership work the root causes together, institutional risk falls and sustained clean outcomes become achievable.

What good looks like

For a complex organisation, good is an integrated governance architecture in which external-audit assurance feeds continuous improvement. A proactive control environment is led from the top; statutory ownership is clear under the Companies Act 71 of 2008 or the PFMA; financial reporting is accurate, performance information valid and complete, and compliance monitored continuously. The findings in the AGSA's management reports are used as strategic tools to fix systemic weaknesses and refine control design, with the audit committee and internal audit tracking remediation to the root cause — turning assurance into durable transparency, credible reporting and long-term resilience.

Related insights

• Risk maturity assessment: what the result should tell the board
• Enterprise risk management: connecting strategic objectives and operational decisions
• Internal controls: connecting design, ownership and reliable operations