Imagine if you were audit ready. Every day

Are you audit ready today?

---

South African organisations prepare for audits far more reliably than they stay audit ready between them. Agentic artificial intelligence can now collect and validate control evidence continuously, and the same AI has just come under ISO's new standards for auditing AI, which puts audit readiness and AI governance in the same room for the first time.

Audit season has a rhythm that anyone who has worked inside a regulated South African institution will recognise immediately. Requests arrive, folders are opened, people who left 18 months ago are e-mailed for files they might still have, and a control that has been operating all year is reconstructed from screenshots because nobody kept the evidence as it was produced. The organisation passes or it does not, and then the folders close until the next cycle.

The national results of that habit are published every year.

The Auditor-General's 2024-25 general report on national and provincial audit outcomes, released on 26 March 2026, records that 151 of 417 auditees achieved clean audits, and describes "persistent and pervasive non-compliance with legislation" with accountability and consequence management named as "a critical weakness". In local government, the 2023-24 outcomes show 41 of 257 municipalities with clean audits, and the Auditor-General's diagnosis is blunt. Basic financial management processes, including record keeping, independent reviews and reporting, are "not functioning as they should", with a "continued reliance on audit process" to surface what management should already know.

The private sector reports differently, through King IV disclosures, ISO surveillance audits, regulator returns and client due diligence, and the pattern underneath is the same. Evidence is assembled for the auditor, and once the auditor leaves, it stops being kept.

"Audit readiness should be continuous," says JJ Milner, Managing Director of Global Micro Solutions. "An organisation must be able to show, at any point, that controls are operating, evidence is current, responsibilities are clear and corrective actions are being closed."

On a Tuesday afternoon without an auditor in the building, ask yourself these four questions?

Are the controls operating? Many organisations can produce the policy that says multifactor authentication is enforced or that privileged access is reviewed quarterly. Far fewer can show the current state of the control across the whole estate on request, because the state lives in a Microsoft tenant, a firewall console and a ticketing system that no one has joined together.

Is the evidence current? In Global Micro Solutions' experience across more than 1 400 managed tenants, control evidence most often sits in spreadsheets, shared folders, e-mail threads and the personal records of the person who owned the control when it was last audited. Evidence stored that way expires quietly, the same way e-mail is where knowledge goes to die. A screenshot of a conditional access policy taken in February says nothing about the policy in September.

Are responsibilities clear? Ownership is frequently assigned only after a finding is raised, which is the most expensive moment to assign it. "Watch a board or audit committee the moment a finding is tabled," says Claudia Correia de Araujo, Business Development Lead at Global Micro Solutions. "The chair asks who owns the risk or control, and the silence that follows is the answer. The control gets a name in that meeting, after the finding is already in the report and the corrective action is already too late." A control with no named owner will be reconstructed under pressure, and the corrective action attached to it stays open until the next audit finds it again.

Are corrective actions being closed? Leadership usually sees overdue actions through a manually prepared report, which means the report is as current as the last time someone had the capacity to prepare it. The Auditor-General's finding that 132 municipalities did not take the steps required of accounting officers in response to unauthorised, irregular or fruitless and wasteful expenditure is, at its root, a description of corrective actions that nobody was tracking to closure, because no audit action plan was being monitored and reported on between one audit and the next.

Global Micro Solutions introduced its Agentic GRC platform in June 2026. Since then the company has been working on the harder question of what an audit agent has to be in order for an audit committee to rely on it, and that work is what 421 GRC Microsoft, the company's agentic solution for everyday audit readiness, now represents in real-time.

The mechanics are simple to describe. The agents read the Microsoft estate and beyond every day, retrieving configuration state and activity evidence from Entra ID, Defender, Intune, Purview and Sentinel, and from the servers, network perimeter and Azure workloads around them. They map what they find to the control set the organisation is accountable for, ISO/IEC 27001 in the first instance, and to the registers an information security management system has to maintain. When evidence is missing, expired or incomplete, they say so and raise the corrective action against a named owner. When a control has drifted, remediation is ticketed the same day.

"The economics of evidence change completely," says Milner. "Collecting evidence by hand is expensive, so organisations do it once a year and hope the control behaved in between. When collection happens every day, the question the audit committee asks moves from 'did we pass' to 'what is our exposure this morning'."

The consequence for leadership is visibility without a request. Overdue actions, expired evidence and control exposure appear in a governed system as they arise, and the evidence trail behind every item runs from the finding back to the source record and the time it was retrieved.

Here the subject gets more interesting, and this is where Global Micro Solutions believes agentic audit has to go next. An AI platform that produces the evidence an organisation relies on for assurance is a high-consequence AI system, and the standards for governing such systems were completed between December 2023 and July 2025.

ISO/IEC 42001:2023 established the certifiable AI management system, covering how an organisation governs the AI it develops or uses. ISO/IEC 42005:2025, published in May 2025, provides guidance on AI system impact assessment, which is the formal exercise of documenting how an AI system and its foreseeable applications may affect people, groups and society. ISO/IEC 42006:2025, published in July 2025, sets requirements for the bodies that audit and certify AI management systems, supplementing ISO/IEC 17021-1 with AI-specific competence and evaluation rules.

Read together, those three documents mean that AI used in assurance work has become auditable in the formal sense. There is now a management system standard to certify against, and since 2025 there is also guidance for assessing an AI system's impact and a rulebook for the auditors who will check both. The Institute of Internal Auditors' Global Internal Audit Standards, effective since 9 January 2025, sit alongside them for the profession that will be asked to rely on agent-produced evidence.

"If we are going to put an agentic team between the tenant and the audit committee, the agents have to meet a higher evidence standard than the humans they support," says Milner. "Every finding they raise has to be reproducible by a person from the same records, with the name of whoever approved any action recorded against it. When the evidence is absent, the agents report that it is absent, and they are not permitted to fill the gap."

That principle shapes how Global Micro Solutions has built 421 GRC Microsoft. The agents operate under human accountability wherever a judgment is made, and their outputs can be reproduced from the underlying records. The platform's own operation also generates the evidence an ISO/IEC 42001 auditor would ask to see. Global Micro Solutions runs its own operations under ISO/IEC 27001, ISO 22301 and ISO/IEC 20000-1 certification and has aligned its platform to ISO/IEC 42001, on the basis that a company asking clients to trust an agentic audit team should be able to show its own governance of those agents first.

The concerns organisations raise about AI in audit are absolutely the right ones: accuracy of results, confidentiality of the data the agent reads, explainability, accountability for errors and the place of human oversight. ISO/IEC 42001 turns each of those into a requirement with evidence behind it.

"C-suite executives ask me whether they can trust what an agent tells them, and that is the correct question," says Correia de Araujo. "My answer is that verification is the only standard that matters for anything feeding an audit committee. Every finding an agent raises should carry the record it came from, the time it was read and the control it maps to, so that a director can trace it back to source without asking anyone for help. If the agent cannot show that, it has no place in the evidence chain, regardless of how fluent its summaries are. When a control fails, accountability stays with the accounting officer. The audit committee that accepted the finding and the software they relied on will not be in the room to answer for it."

An organisation adopting agentic audit without a management system around it will, sooner or later, be asked by its own auditor how the agents are governed.

The test is the one Milner set out at the start. On an ordinary working day, can leadership see that controls are operating, that evidence is current, that every control and corrective action has a named owner, and that overdue actions are visible without anyone preparing a report?

The obligations behind that test extend well past ISO, from the PFMA and MFMA to POPIA, the Companies Act and King IV, and 421 GRC Microsoft maps controls, evidence and corrective actions across all of them in one governed system.

Global Micro Solutions offers a complimentary workshop for 421 GRC Microsoft.

Book your workshop today.

Sources

ISO/IEC 42001:2023, Artificial intelligence management system

ISO/IEC 42005:2025, AI system impact assessment

ISO/IEC 42006:2025, Requirements for bodies providing audit and certification of AI management systems

The Institute of Internal Auditors: Global Internal Audit Standards effective 9 January 2025