Internal audit units and independent audit committees are the governance mechanisms the PFMA (Public Finance Management Act) requires to help accounting officers evaluate controls, manage risk and sustain compliance.
Working together, they give executive leaders the objective, evidence-based assurance needed to maintain financial integrity, prevent irregular and wasteful expenditure, and sustain credible performance reporting. This guide sets out what the Act requires, how internal and external assurance combine, and how to make findings get resolved while there is still time to act.
Why the PFMA requires internal audit and audit committees
Under Chapters 5 and 6 of the Act, accounting officers and the accounting authorities of public entities carry non-delegable fiduciary duties — operating basic financial-management systems and internal controls, preventing overspending, and reporting monthly and annually. As set out by the National Treasury, Chapter 9 then empowers Treasury to issue regulations that oblige institutions to establish and maintain independent audit committees and adequately resourced internal audit units.
These are not administrative burdens but statutory imperatives aimed at eliminating waste and corruption in the use of public assets. Through continuous, objective evaluation of financial and operational management, they protect leaders from governance failures and keep resources pointed at service delivery.
What an effective audit committee actually does
An effective committee does not wait for a year-end review; it tests the control environment through the year across four areas:
- Risk management — confirming management identifies, assesses and mitigates strategic, financial and operational risks as a live discipline, not a static register.
- Internal control — overseeing leadership, financial-management and IT-governance controls, and monitoring management action plans that fix root causes.
- Supply-chain compliance — interrogating procurement against the section 217 standard (fair, equitable, transparent, competitive, cost-effective) to curb irregular and wasteful expenditure.
- Financial-statement integrity — reviewing draft statements before the two-month submission deadline to confirm they are free of material misstatement and conform to Generally Recognised Accounting Practice (GRAP).
Combined assurance: internal and external oversight
Internal audit units and independent audit committees are the governance mechanisms the PFMA (Public Finance Management Act) requires to help accounting officers evaluate controls, manage risk and sustain compliance.
— Synthesis of South African regulatory guidance
A resilient institution runs an integrated assurance model where each party has a clear role — avoiding duplication while closing blind spots. Internal assurance is the entity's own lines of defence: management maintains day-to-day controls, reconciliations and record-keeping; internal audit gives independent assurance on controls, risk and governance; and the audit committee oversees both and advises the accounting officer on deficiencies and corrective measures.
External assurance is provided by the Auditor-General South Africa (AGSA), established under section 188 of the Constitution and the Public Audit Act. AGSA's annual audit opines on whether the financial statements are free of material misstatement, whether reported performance is useful and reliable, and whether the entity complied with key legislation. When internal audit and the committee keep controls disciplined through the year, the external auditor can rely on that environment — internal assurance improves continuously inside the institution, while AGSA provides published, transparent reporting to Parliament and the public.
Resolve findings through the year, not at audit time
The common failure is treating audit as an annual event. Treasury and AGSA guidance is that matters reported by internal and external auditors should get timeous management attention through the year. Three disciplines make that real:
- Maintain daily and monthly processing controls and reconciliations — waiting until year-end to reconcile the general ledger guarantees misstatements.
- Approve and track leadership action plans that address the root causes internal audit identifies, with the committee monitoring milestones quarterly.
- Prevent material irregularities early — AGSA defines a material irregularity as non-compliance, fraud, theft or a breach of duty that causes or is likely to cause significant financial loss or harm; resolving control failures during the year stops minor gaps escalating into one.
What good looks like
Good is a sustained clean audit outcome — which AGSA defines as a financially unqualified opinion with no material findings on performance reporting or compliance. It signals proper records, effective controls and disciplined management supported by an active audit committee. A clean audit does not prove service delivery is perfect, but it shows a credible foundation of accountability on which public trust is built.
Sources
- National Treasury — Public Finance Management Act (PFMA) — National Treasury
- What we do (mandate, audit process, material irregularities, clean audits) — Auditor-General South Africa
Frequently Asked Questions
What is the Public Finance Management Act (PFMA)'s role in requiring internal audit and audit committees?
The Public Finance Management Act (PFMA) mandates internal audit units and independent audit committees as crucial governance mechanisms. These structures are required to assist accounting officers in evaluating controls, managing risk, and sustaining compliance within public entities. Treasury circulars, empowered by Chapter 9 of the Act, further oblige institutions to maintain these adequately resourced units.
Who is required to establish internal audit units and audit committees under the PFMA?
The PFMA requires accounting officers and accounting authorities of public entities to establish and maintain independent audit committees and adequately resourced internal audit units. This is a statutory imperative aimed at upholding fiduciary duties and ensuring sound financial management. These requirements are further detailed through regulations issued by the National Treasury. They apply to all public entities under the Act's purview.
What is the primary purpose of the PFMA's requirements for internal audit and audit committees?
The primary purpose of the PFMA's requirements for internal audit and audit committees is to eliminate waste and corruption in the use of public assets. These structures provide continuous, objective evaluation of financial and operational management, protecting leaders from governance failures. Ultimately, they ensure resources remain focused on service delivery and prevent irregular or wasteful expenditure.
What does effective compliance with the PFMA's requirements for internal audit and audit committees entail?
Effective compliance involves an active audit committee continuously testing the control environment across risk management, internal control, supply-chain compliance, and financial-statement integrity throughout the year. It also means running an integrated assurance model where internal audit, management, and the audit committee work together to provide objective, evidence-based assurance. Ultimately, good compliance leads to a sustained clean audit outcome, as defined by the Auditor-General South Africa (AGSA).
Where do organisations commonly fail in their approach to audit findings and compliance under the PFMA?
Organisations commonly fail by treating audit as merely an annual event, rather than addressing findings timeously throughout the year. This often leads to deferring critical reconciliations and corrective actions, which can result in material misstatements or escalating control failures. Treasury and AGSA guidance emphasises that matters reported by auditors require continuous management attention to prevent minor gaps from becoming significant issues.