Imagine if you were audit ready. Every day

South African organisations are more reliable than ever in preparing for audits, thanks to the advent of agentic artificial intelligence. This AI technology continuously collects and validates control evidence, and recently, it has been included in ISO's new standards for auditing AI. For the first time, audit readiness and AI governance are being addressed together.

Audits in South African institutions follow a predictable rhythm. Requests arrive, folders are opened, and files are retrieved from individuals who may have left the organisation years ago. Control processes that have been in place all year are reconstructed from screenshots because evidence is not kept up to date. If the organisation passes or fails, the folders remain closed until the next audit cycle.

The 2024-25 Auditor-General's report on national and provincial audit outcomes revealed that only 151 out of 417 auditees achieved clean audits. Persistent and pervasive non-compliance with legislation was identified as a critical weakness, particularly in accountability and consequence management. Local government also presented concerning results, with only 41 out of 257 municipalities achieving clean audits.

The Auditor-General noted that basic financial management processes, such as record keeping and reporting, are not functioning as they should, relying heavily on audit processes to uncover what management should already know.

In the private sector, organisations follow various disclosure methods, including King IV disclosures, ISO surveillance audits, regulator returns, and client due diligence. The underlying pattern remains similar: evidence is collected for auditors, but once the auditor leaves, the evidence collection process stops.

JJ Milner, Managing Director of Global Micro Solutions, emphasizes that audit readiness should be continuous. An organisation must be able to demonstrate at any given moment that controls are operating, evidence is current, responsibilities are clear, and corrective actions are being closed. To assess this, the reporter suggests asking four questions on a Tuesday afternoon without an auditor present: Are the controls operating? Is the evidence current? Are responsibilities clear? Are corrective actions being closed?

The reporter introduces Global Micro Solutions' Agentic GRC platform, which was launched in June 2026. This platform continuously monitors the Microsoft estate and beyond, retrieving configuration state and activity evidence from various Microsoft services and servers. When evidence is missing, expired, or incomplete, the platform alerts the responsible owner and creates a corrective action ticket.

This real-time monitoring transforms the economics of evidence collection, moving from annual, ad-hoc collection to continuous daily monitoring. Consequently, leadership becomes immediately aware of overdue actions, expired evidence, and control exposure, enabling proactive measures without waiting for an audit request.