Governance, risk and compliance: what it means for your IT

What GRC means for the people who run the business

The label is heavy, but the ideas are not, and each one has a plain meaning for your IT.

• Governance is who decides, and how. It covers who owns IT spend, who approves a change, and who answers when something goes wrong.
• Risk is what could go wrong, and how much it would matter. A lost laptop and a lost database are both risks. They are not the same size.
• Compliance is proving that you meet the rules that apply to you. Doing the right thing is only half of it. You must also show the evidence.

The three belong together: governance sets the rules, risk tells you where to focus, and compliance shows the rules were followed. Accountability stays with the owners and directors, even when the IT team runs the controls.

How clients, insurers and boards judge your IT

Smaller and mid-sized businesses often assume GRC is for banks and listed companies. In practice the pressure reaches them from several directions at once.

Your clients

Larger clients now send due-diligence questionnaires before they sign. They want to know how you protect their data and what happens if something goes wrong.

Your contracts

Those answers can end up in the contract. A supplier that can show its controls is easier to say yes to than one that offers reassurance.

Your insurer

Insurers ask similar questions before they quote cover. Do you have multi-factor authentication? Can you restore from backup? Is there an incident plan?

Your board

At a high level, directors are expected to oversee technology and information as part of running the business. They should not leave it to the IT team alone. That only works if IT can report in a way a director can read.

IT maturity is what lets you answer all four with evidence. If the evidence is on file, a questionnaire takes an afternoon. If it is not, the questionnaire becomes slow and uncomfortable.

Three routes to a more mature IT

THUSA is a South African managed IT services provider and has run IT for clients since 2000. Its work on governance, risk and compliance comes through three routes.

• IT maturity assessment. A complimentary, leadership-level view of where you are governed and where you are exposed. It measures your IT against COBIT-aligned controls, a widely used framework for governing IT, across the domains set out on the IT Maturity page. Senior engineers deliver it.
• Strategic Advisory. Vendor-independent advice on governance frameworks, risk management and security strategy, and compliance programme development, including POPIA. THUSA can also facilitate an IT steering committee, so IT and the business decide together. Read about Strategic Advisory.
• Managed IT services. Governance in practice, run through monthly service reviews and quarterly business reviews. See our managed IT services.

THUSA supports POPIA-aligned controls. The place to start is the complimentary maturity assessment. You walk away with maturity visibility, operational risk insights, governance observations and recommended next steps.

What mature IT governance looks like

Good governance is not a binder on a shelf, but a handful of habits that happen on schedule. In mature IT, ownership is clear, performance is visible and risk shows up early.

• Written policies people can follow. Cover acceptable use, access, data handling and incident response. Keep them short and name an owner.
• Regular access reviews. Ask who can reach what, and whether they still should. Remove ex-employees within hours, not weeks.
• An asset register. You cannot protect or update what you do not know you have. List devices, software, licences and suppliers.
• Backups that are tested. A backup that has never been restored is an assumption.
• A rehearsed incident plan. A breach is a bad day. A breach with no plan is a worse one.
• A risk register. List the top IT risks. Give each one an owner and a decision: fix, accept or transfer.
• Reports the board can read. Use plain measures of uptime, incidents, open risks and progress.

One more habit matters most: keep the evidence as you go, because compliance evidence should exist before the audit does.

Where GRC usually goes wrong

Weak IT rarely fails all at once. Systems get added to fix urgent problems, vendors arrive one by one and processes grow informally. The setup still looks fine, but ownership blurs and leaders see less of the risk.

• Nobody in particular owns a decision or an outcome.
• Security controls differ from system to system.
• Continuity rests on one person who knows how it works.
• Spend follows the latest crisis, not business priorities.

None of these is a technology problem first, because each is a governance problem that shows up as technology.

Does King V matter if we are not listed?

King V is South Africa's corporate governance code. The Institute of Directors in South Africa released it on 31 October 2025. It is "effective for financial years beginning on or after 1 January 2026". It supersedes King IV in its entirety.

King V is voluntary. It works on an "apply and explain" basis. You apply its principles and explain where you depart from a recommended practice. The code scales by size and complexity. Principle 10, "Data, information and technology", covers information security, privacy, resilience, cyber security, third-party risk and AI oversight. It matters even if you are not listed. It is a published standard for what a governing body should oversee in IT.

The law as supporting evidence

POPIA, the Protection of Personal Information Act 4 of 2013, is likely to apply if you hold personal information about clients, staff or suppliers. It asks you to protect that information and to say how you do it. This article is not legal advice, so check your own position with your legal adviser.

The Information Regulator enforces the Act. It can assess a body on its own initiative or on request, and it investigates complaints (section 40(1)). Section 22(1) says a responsible party must tell the Regulator about a security compromise. That is the business that decides why and how personal information is used. The people affected must be told too, subject to the Act's conditions.

If the Regulator serves an enforcement notice and you ignore it, you commit an offence (sections 95 and 103(1)). The Regulator may then serve an infringement notice. In the copy of the Act we checked (29 May 2025), R10 million is the maximum administrative fine on that notice (section 109(2)(c)). It is a ceiling, not a flat penalty for any breach, and the Minister may adjust it (section 109(10)).

When the Regulator sets a fine, it weighs several factors. One is any failure to carry out a risk assessment or to run good policies, procedures and practices (section 109(3)(g)). Good governance helps because it shows you took care before anything went wrong.

The path has been used to the end. The Regulator served Blouberg Local Municipality with an enforcement notice, then an infringement notice for R500 000. The municipality complied with neither. The Regulator then filed a certified statement under section 109(5). That gives a fine the effect of a civil judgment. In early April 2026 the Polokwane High Court confirmed the fine and cut it to R250 000. The Regulator reported this on 29 April 2026.

A notice can also be challenged. You may appeal to the High Court within 30 days (section 97). The Regulator fined the Department of Basic Education R5 million in December 2024. As reported by Werksmans and SAnews, the High Court set aside both notices on 12 December 2025. It refused leave to appeal on 3 June 2026. The Regulator has since applied to the Supreme Court of Appeal, as reported in July 2026. The matter was still before the courts at 3 November 2026.

A six-question self-check

Try this one-page self-check and answer yes or no, because every no is a gap worth checking.

1. Do we know our top five IT risks, and who owns each?
2. Can we restore our critical systems today, and have we proved it?
3. Are ex-employees removed from our systems within hours?
4. Do we measure uptime and response times?
5. Would a breach have a rehearsed response?
6. Could we show an auditor, client or insurer our policies and evidence in an afternoon?

This is our view: start with an honest picture of where you stand, not a policy template. Then fix the largest gap first. List your top IT risks and name an owner for each. Test your backups by restoring something that matters. Write down your incident plan and rehearse it once. Start keeping evidence now, so it exists before an audit asks for it.

What directors ask

What is governance, risk and compliance in simple terms?

It is three questions about how your business runs its IT. Who decides, what could go wrong, and can you prove you follow the rules that apply to you? Governance sets the rules, risk shows where to focus, and compliance gives you the evidence.

Does POPIA apply to a small business?

If you hold personal information about clients, staff or suppliers, POPIA is likely to apply. The Act asks you to protect that information and be able to say how. This is not legal advice, so ask your legal adviser how it applies to you.

How does IT maturity affect client due diligence and insurance?

Larger clients send due-diligence questionnaires before they sign, and insurers ask similar questions before they quote cover. If your evidence is on file, answering takes an afternoon. If it is not, the questionnaire becomes slow and uncomfortable. IT maturity is what lets you answer with evidence rather than reassurance.

Can the Regulator fine me R10 million?

In the copy of the Act we checked (29 May 2025), R10 million is the maximum administrative fine on an infringement notice under section 109(2)(c). It is not a flat penalty for any breach. In the Blouberg case, the first step was an enforcement notice. The Regulator also weighs factors such as a failure to run good policies and practices. The Minister may adjust the amount.

What should we do first?

Get an honest picture. List your top IT risks, name an owner for each, and test that your backups restore. Then fix the largest gap first and keep your evidence as you go. A complimentary maturity assessment can give you that picture with a second pair of eyes.

Where to start

Book the complimentary IT maturity assessment through our contact page. If security is your biggest gap, read why cyber security is a business risk.

Sources

• Protection of Personal Information Act 4 of 2013, sections 22, 39, 40, 95, 97, 103, 107 and 109, from the Department of Justice (justice.gov.za).
• The copy was downloaded on 29 May 2025. Later amendments were not checked.
• Information Regulator, media statement of 29 April 2026, "Information Regulator turns to the courts to fine Blouberg Local Municipality" (inforegulator.org.za).
• Information Regulator, media statement of 23 December 2024 on the notice to the Department of Basic Education (inforegulator.org.za). Werksmans (9 June 2026), SAnews (14 December 2025) and IOL (6 July 2026) report the court orders and the application.
• Institute of Directors in South Africa, King V page (iodsa.co.za/page/king-v), the King V Code and the King V Foundational Concepts, 2025.