Digital transformation journey

Performance against 2025-26 targets

The AGSA’s digital transformation journey is focused on digitising and advancing both audit processes and broader business operations by modernising core systems. Our key priorities included automating manual processes and strengthening technology governance to improve longterm efficiency and support our constitutional mandate. We intend to create sustained value for auditees, employees and citizens.

Digital transformation successes

• Successful piloting of the ASP in both the MFMA and PFMA cycles.
• The intelligent automation solutions not only reduced over-reliance on manual processes but yielded measurable efficiency gains, demonstrating improved adoption of digital tools across the institution.

Audit software programme

The ASP consolidates crucial audit data onto a secure, integrated digital platform, replacing fragmented and largely manual legacy systems. This is a milestone in our capability to generate insight, collaborate and make data driven decisions with stakeholders. ASP is expected to deliver audit efficiencies, improved reporting accuracy, enhanced audit quality and greater staff morale. These benefits, once fully rolled out, will be tracked over three years from 2027-28.

ASP comprises three projects: Audit process management, Audit portfolio management and AGSA Kopano, each including milestones.

During 2025-26, audit process management, audit portfolio management and AGSA Kopano adhered 100% to project plans across phase one (PFMA) and phase two (MFMA) pilots. All identified pilot audits were successfully completed, and important platform components were advanced. Performance monitoring and system enhancements are ongoing, particularly through Draftworx. In addition, proactive network assessments were conducted ahead of the PFMA audit rollout, enabling early identification of high risk connectivity areas and engagement with network service providers.

The audit process and audit portfolio management pilots took place simultaneously, demonstrating their full integration. Any remaining requirements will be addressed later through the enterprise integration programme. Following the successful completion of both the PFMA and MFMA pilot cycles in 2025-26 and the value they demonstrated, leaders approved the organisational rollout and governance of the ASP.

The ASP steering committee now convenes biweekly to oversee delivery. Nerve centre focuses include system performance and network connectivity, user training, release of working papers, audit progress and milestones, system adoption, rollout support, financial considerations, change management and communication, project governance and risk management. This enhanced governance structure enables exco to identify, escalate and resolve challenges timeously, ensuring a controlled, stable and value driven rollout.

Audit process management

The audit process management project, which replaces the legacy Teammate system, encompasses the full audit methodology and end to end execution of audits, from planning to reporting. During 2025-26, the project achieved all milestones through disciplined execution and alignment with the AGSA’s strategic objectives. Both the PFMA and MFMA pilots were completed.

As part of the pilot, we identified and completed 12 PFMA audits, with all audit files signed off. In addition, we identified 79 MFMA audits, 76 of which were approved for inclusion in the pilot and completed. Three-quarters of the audited files were signed off within prescribed timelines, with a further 24% finalised in December 2025 and the remaining 1% in January 2026.

Audit portfolio management

The audit portfolio management initiative introduced a new auditee database that provides a single, consolidated view of all audits. This enhances portfolio oversight, project management of audit engagements, budget management and milestone tracking through integrated dashboards. The project was 100% completed against the project plan across both PFMA and MFMA pilot phases.

Core components are fully implemented and in production, including auditee database, audit project management functionality, resource planning for Ahluma, contracted work capacity and pooled resources. Budget tracking is fully integrated with PeopleSoft. While these developments advance operational efficiency, portfolio oversight and decision making, system adoption has been slower than anticipated due to a steep learning curve and initial dependence on centralised support. To address this a structured self service support model, advanced and role based training, enhanced troubleshooting support and change management interventions are being rolled out.

Change management is centred on new ways of working through empowering support teams and PowerUsers, delivering advanced Microsoft project training and developing dashboard and reporting content. User guides are being provided, show-and-tell sessions being held and frequently asked questions carried across channels.

AGSA Kopano

AGSA Kopano is an internally developed, secure collaboration platform that streamlines, standardises and automates communication between the organisation and auditees. During 2025-26, both PFMA and MFMA pilot phases were completed in line with the project plan. All planned training, including PFMA train the trainer, were completed, ensuring stakeholder readiness and knowledge transfer.

The MFMA AGSA Kopano pilot identified 41 audits, 36 of which were approved and completed. An average completion rate of 100% was recorded across both pilots, affirming the planning, governance and delivery approach and confirming readiness for full implementation.

Infrastructure modernisation

Our digital transformation strategy relies on modernising our ageing infrastructure. This will deliver solutions such as ASP, enterprise resource planning, automation tools, business intelligence solutions and artificial intelligence enabled services. This addresses legacy risks sustainably, responds to audit findings, strengthens cyber-resilience, improves organisational agility and, crucially, protects sensitive information and brand reputation.

The AGSA infrastructure modernisation approach and its benefits

During the reporting period, modernisation was largely completed, with core elements migrated and operational. Integrated monitoring capabilities are in place and disaster recovery arrangements have built resilience. The institution has begun the move from on-premise data hosting to a secure private cloud environment to reduce downtime, ensure stable platform performance, bolster security controls and lower the operational risk and costs associated with ageing and unsupported infrastructure.

Key milestones achieved during the period include:

• Successful completion of disaster recovery simulation activities, materially enhancing the institution’s ability to restore crucial systems within reduced recovery timeframes
• Migration of all production and selected nonproduction systems to an Infrastructure as a Service (IaaS) environment
• Full migration and operational readiness of TeamMate servers.

Service level agreement and system availability

During the reporting period, system performance improved significantly, with a closure rate of 92,86%, up from 87% at the end of the 2024-25 financial year. This outcome exceeded the target of 80%, reflecting sustained commitment, enhanced operational efficiency and strengthened effectiveness in the delivery of high-quality ICT services.

IT security plan implementation

During the 2025-26 financial year, the institution approved the information and cybersecurity plan, comprising 20 initiatives for 2025-26. Of these, 15 (83%) were implemented as planned, while three (17%) remain active. Two initiatives – the firewall software licence renewal and the data-masking solution implementation – were deferred to the next financial year.

Key achievements during the period included completing a comprehensive security assessment of AGSA Kopano. The Security Operations Centre became functional and provides 24/7 monitoring, enabling proactive detection, analysis and response to cybersecurity threats and vulnerabilities.

In addition, continuous anti-malware scanning has been implemented across all AGSA devices to strengthen early detection of potential security risks. This is complemented by ongoing email monitoring to identify and block malicious content, as well as sustained user awareness initiatives aimed at reducing human error and reinforcing the institution’s overall cybersecurity.

Cybersecurity

The AGSA’s cybersecurity approach is anchored in the ISO 27001 international standard for information security management and is underpinned by a defencein- depth, multilayered security model. Should any control layer be compromised, additional safeguards remain to mitigate the impact and protect the integrity of our IT infrastructure and data. Continuous user awareness and security monitoring and proactive risk management remain central to strengthening the institution’s cybersecurity.

The KnowBe4 cybersecurity awareness platform was launched during the year, allowing us to deliver security training, conduct realistic phishing simulations and report comprehensively. These interventions have strengthened awareness, reduced human error and risk and improved management insight into cyber risk exposure. In October 2025, we observed Cybersecurity Awareness Month under the theme ‘Secure our world – a shared responsibility’. The campaign comprised awareness initiatives reinforcing cybersecurity consciousness across the institution. This annual campaign is more than a compliance exercise – it reflects our ongoing commitment to building a strong security culture, empowering every employee to play an active role in safeguarding the institution’s digital environment.

Intelligent automation: efficiency gains, value realisation and change enablement

Automation delivered measurable efficiency gains through time saved by bots and applications. These efficiencies are being redirected to higher-value audit activities, improved service delivery and optimisation of staff capacity and workforce planning. In parallel, the business unit strengthened change management and benefits realisation practices, drove adoption of digital solutions, enhanced tracking of realised versus planned benefits and more strongly aligned outcomes and business value.

We set out to implement 30 automations during the year and delivered 37. As the number of bots operating across the business increases, we anticipate a bigger focus on change management and the rollout of high-impact automation solutions to deliver audit and operational efficiencies. While automation releases staff capacity, the resulting man hours offer value redeployment plus cost savings. Solutions delivered by automation and business intelligence centres contributed improved operational efficiency, reduced the number of manual processes and enhanced audit and financial reporting capabilities.

Business value of key automations delivered in 2025-26

The following automation solutions are among the 27 initiatives implemented to drive operational efficiency, strengthen controls, reduce manual effort and enhance assurance outcomes across the institution:

Artificial intelligence strategic programme

The artificial intelligence strategic programme and associated governance guidelines were approved by exco, establishing a structured framework for responsible, ethical and value-driven artificial intelligence. It articulates our artificial intelligence vision, governance principles, priority business-led use cases and implementation guardrails in the interests of consistency, compliance, risk mitigation and value realisation.

Approving the programme positions us to move into a more structured and governed phase of artificial intelligence adoption, with scalable implementation in the next financial year. It also reflects a deliberate and measured approach to balancing innovation with strong governance to ensure that artificial intelligence capabilities enhance productivity, strengthen audit quality and support longterm institutional resilience.

Business intelligence

Business intelligence transforms data into timely, accurate and actionable insights that support decisionmaking, promote performance and advance accountability. Trusted dashboards and reports provide a single, integrated view of institutional performance across audit, finance, people and operations portfolios. During 2025-26, 36 dashboards were delivered, exceeding the annual target of 30. This reflects the institution’s growing business intelligence capability and reinforces its commitment to data-driven governance and performance management.

Digital challenges

CMS

The Case Management System (CMS) was designed to modernise and digitise the end-to-end management of material irregularities and related case processes. However, after two false starts, the system was suspended. A decision was taken by the CMS steering committee not to renew the current service provider contract, which expires on 31 May 2026, but to seek an alternative solution.

Notwithstanding this decision, we have realised tangible value, which includes establishing a comprehensive material irregularities database with supporting documentation and confirmation that the AGSA retains full ownership of all data within the CMS. This data asset will be used for reporting and to support the implementation of an alternative solution.

Project iMpilo

iMpilo is a centralised assurance and insights platform designed to streamline and automate core audit processes by enabling real-time access to clean, standardised and refreshable data directly from auditee systems. The platform was aimed at enabling data-led audit work, including reducing duplications and improving responsiveness to emerging audit risks. During the 2025-26 financial year, the tool was piloted but experienced challenges that necessitated the eventual decommissioning of its underlying Fraxis technology.

After an assessment into the iMpilo challenges, exco realised that the iMpilo challenges were due to a combination of factors including project scaling, tool adoption and usage by audit teams internally and change management dynamics. We need more time and upskilling in our change management capabilities and to improve our mechanisms for tracking and managing the benefits of not only this project but all our other large-scale digital projects.

Lessons learnt

The CMS and iMpilo projects provided several lessons that will stand subsequent digital transformation projects in good stead. Lessons learnt include:

• Digital project governance: Not only must governance structures be in place, but these must be made up of members that represent all key functional areas that either impact – or will be affected by – the digital solution under development.
• Continuous project risk management: More timely project risk identification, mitigations development and rollout are key components of keeping such a large-scale digital project on track and giving it the best chance of success.
• Collaboration across business areas: While the digital teams develop and deliver a solution, this must be cocreated with the business that will use the solution and there must be constant partnership with the finance team as the financial enablement function.
• Change management: One of the biggest learnings from the CMS challenges was how important early and ongoing change management efforts are to ensuring business adoption of the tools that the institution develops. On digital projects that have been launched after we began the CMS project, such as the ASP, this has been a particular focus for the institution.

Conclusion

Infrastructure modernisation remains a crucial enabler of the AGSA’s digital transformation strategy, providing the technological foundation required to support efficient, secure and high-quality audit services within an increasingly digital public sector environment.

Modern infrastructure enhances system reliability, scalability and performance, enabling audit teams to process large volumes of data, leverage advanced analytics and use digital audit tools more effectively. This gives audit professionals more time to focus on using their professional judgement, analysing risk assessments and generating insight. Digitalisation is a significant boost to institutional efficiency and value creation. This is particularly important given that audit cycles are largely dictated by statutory reporting deadlines under the PFMA and MFMA, resulting in concentrated audit workloads during defined periods. Investments in digital technologies, automation and data-enabled methodologies are therefore essential to using our resources optimally and ensuring that audit effort is focused on areas of highest risk and impact within constrained timelines.

Globally, cybersecurity risks are escalating in frequency, sophistication and complexity, requiring continuous monitoring, user awareness and proactive management. Emerging threats include cloud-based security risks, artificial intelligence enabled attacks, supply chain compromises, advanced ransomware models and multivector attack strategies. Cybersecurity remains paramount and calls for ongoing refinement of controls, deployment of preventive measures and a security conscious culture.

In our highly competitive environment, we compete for skilled ICT professionals with financial institutions, insurers, retailers and public and private sector entities. Rapid acceleration of artificial intelligence further amplifies the need for robust artificial intelligence governance, risk management and continuous monitoring of both internal and external environments.

The AGSA must remain an attractive and credible employer of technology talent, capable of sustaining critical skills and capability. Talent retention, governance maturity and risk informed digital execution are essential to guarantee resilience and a winning digital transformation journey.