A Clean Audit Does Not Mean Nothing Went Wrong
This article will count 0.25 units (15 minutes) of unverifiable CPD. Remember to log these units under your membership profile.
A public sector entity tells you they got a clean audit. You congratulate them. Everybody moves on. But a clean audit does not necessarily mean nothing went wrong during the year. Sometimes it means the mistakes were found and fixed before the opinion was signed.
What people think a clean audit means
Ask most people what a clean audit means and they will tell you the same thing. The money was handled properly. The controls worked. Nothing went wrong.
That is not what it means.
A clean audit means three separate things passed:
the financial statements were free of material misstatement.
the performance report was useful and reliable, and
there was no material non-compliance with key legislation.
It tells you what the position looked like on the day the opinion was signed. It does not tell you how the institution got there.
How a clean opinion can be built after year-end
Here is what happens in practice. The institution submits its financial statements to the Auditor-General by the end of May. The audit team tests them and finds errors. Management is then given the chance to correct those errors before the opinion is signed. Most take it. That is allowed, and there is nothing improper about it.
Now look at what that produced in 2024-25.
A total of 159 auditees, 41% of them, submitted financial statements containing material misstatements. Without the chance to correct during the audit, only 59% of auditees would have received unmodified opinions. Eighty-one percent actually did.
The gap is twenty-two percentage points. Those opinions were produced by the audit, not by the institution.
So two annual reports can go to Parliament with the same opinion paragraph. One institution ran its controls all year. The other did not and was corrected on the way through. Nobody reading the annual report can tell the difference.
This is why the question to ask a client is never just what opinion did you get. Ask two more. With findings, or clean? And how many adjustments were processed during the audit?
So what is good governance
Good governance is not a committee, a policy document or a clean opinion. It is a simple thing. Problems get caught at the cheapest possible point.
There are only three points where a problem can be caught. Think of them as three gates.
Gate 1 is prevention. It works before the transaction happens. An order approved before the goods are ordered. A delegation checked before the payment goes out. This gate costs a form and a signature.
Gate 2 is detection. It works during the month, while management can still do something about it. A reconciliation. A register kept up to date. A review by somebody who did not prepare the thing. This gate costs an afternoon and a second pair of eyes.
Gate 3 is the auditor. It works fourteen months after the decision was made. By then the year is over, the money is gone, and the service was either delivered or it was not. This gate costs a qualification, an investigation and sometimes a career.
Good governance means gate 1 catches most things and gate 2 catches the rest. Gate 3 should find almost nothing, because gate 3 cannot prevent anything. It can only report.
Now the number that shows where we actually are. Of the 159 auditees that submitted materially misstated financial statements, 3% were rated good on in-year and year-end reporting controls.
Five institutions. Out of 159. Gate 2 is barely operating.
What gets caught too late
When gates 1 and 2 fail, spending falls into one of three categories. They get used interchangeably and they are not the same thing. Each one has its own test.
Unauthorised expenditure asks whether you had the budget. You either overspent a vote or a main division, or you spent the money on something it was not voted for. It applies to departments only, because entities do not have votes. When a public entity overspends, the same behaviour is classified as irregular expenditure instead. R6,11 billion in 2024-25.
Irregular expenditure asks whether you followed the law. Usually the procurement rules. It says nothing about whether the money was well spent. The supplier can be excellent, the price fair and the work delivered, and it is still irregular if the process was wrong. R42,58 billion in 2024-25.
Fruitless and wasteful expenditure asks whether reasonable care was taken. Interest and penalties for paying suppliers late is the classic example, and it makes up roughly a third of the national total. R1,42 billion in 2024-25.
One transaction can fail all three tests independently. We set the categories out in more detail in Irregular, Unauthorised, Fruitless: Three Different Disasters.
And do not expect the legislative rewrite to buy anyone time. As we reported when the ConCourt declared the Public Procurement Act 2024 invalid, procurement continues under the PFMA and the existing regulations. The findings carry on.
One contract, followed through a year
Imagine a provincial health department that runs twelve clinics and a district hospital. The financial year runs from April to March. The medical waste removal contract expires on 31 March and the collection is a legal requirement.
At the begining of the year, April, the R4,2 million for the renewal is sitting in the annual performance plan. No procurement plan is drawn up, so no date is put against it.
In February, eleven months later, nothing has changed except the time left. It is approved as an emergency deviation. The contract expired on a date that was printed on the contract.
In March, the service is delivered first and the requisition is raised afterwards, to match an invoice that has already arrived.
Also in March, that invoice arrives with no date stamp. It sits on a desk for three weeks. Nobody can prove when the thirty days started, so the payment rule cannot be complied with, monitored, or even calculated for the disclosure note.
In July, the auditor finds all of it. It was never entered in the irregular expenditure register. The result is a qualification on completeness, plus a compliance finding.
There were four failures in total. Not one of them was complex, and not one of them required a system, a consultant or a budget line to prevent. Each could have been avoided on the day it happened, by the person who was already holding the document, at no cost whatsoever.
The plan was never dated, so there is no way to show when it was approved or whether it preceded the work it authorised. Writing the date on it at the time would have taken a second.
The requisition was raised after the goods had already been ordered. Raising it first is not an additional step, it is the same step in the correct sequence.
The document was filed without a date stamp, leaving no record of when it was received. The stamp was on the desk.
The transaction was never entered in the register, so it exists nowhere in the audit trail. The register was open and the entry was one line.
Why simple things do not get done
It is not capacity, knowledge, not it is systems. Operating a control costs you something today. An afternoon, a difficult conversation. A signature chased. That cost is immediate and it lands on a person.
Skipping it costs nothing today. The consequence arrives fourteen months later, usually on somebody else's desk, because by then people have moved on.
If anyone tells you it comes down to vacancies and budget, the Auditor-General's own data says otherwise. Sixty-three auditees have held clean audits every single year since at least 2020-21. Same fiscal environment. Same labour market. Same budget cuts. The difference is that their controls were written down and institutionalised instead of living in one person's head. When that person leaves, the control leaves with them.
And when it goes wrong, responsibility does not move up the chain. We covered that in Government Said Sign It. The PFMA Says Otherwise. Verbal approval is not approval, and section 38 does not care who told you to process it.
What to do on Monday
Ask better questions about a clean opinion.
With findings, or clean? And how many adjustments were processed during the audit? That second number tells you the truth, and it will never appear on the front page of an annual report.
Look at all the deviations on the budget.
Plot the deviations against the date the need first appeared in the plan. Anything older than three months was never an emergency.
Date-stamp invoices at reception.
Then age them weekly to the accounting officer. It costs nothing and it is provable.
Move one control from gate 2 to gate 1.
A system block on payments against an expired contract beats a monthly exception report by a wide margin.
Test the audit action plan on four questions.
Which control is changing, who owns it, by when, and what evidence will prove it worked. If any answer is missing, the finding comes back next year.
There is a commercial point in this too. Fixing year-end errors is crowded, low margin work. Preventing them is not, because almost nobody is selling it. Control design, monthly close discipline, register maintenance, action plan testing. That is advisory work, and it should be priced as advisory work.
None of this is complicated. These are simple processes that were not followed. The interesting question was never how. It was why.
Want to know more? Watch CIBA’s Public Finance Management Act Processes and Reporting: Where Things Go Wrong webinar.
Trending
