Guide8 min read
What Is a Risk Register? Definition, Purpose & Examples
Learn what a risk register is, why it matters, and how to use one effectively in your organization. Includes real-world examples and best practices.
Learn Risk Management
Master enterprise risk management with expert guides, frameworks, and best practices.
Guide
Inherent vs Residual Risk: Key Differences Explained
Understand the difference between inherent and residual risk, and why tracking both matters for ERM.
Guide
Risk Likelihood and Impact Scoring: A Practical Guide
Master risk scoring with likelihood and impact matrices. Includes examples and best practices.
Guide
Types of Risk Controls: Preventive, Detective & Corrective
Learn the 3 types of risk controls with examples. Build a balanced control framework for effective risk management.
Guide
Risk Registers & Internal Audit: How They Work Together
Discover how risk registers support internal audit planning, execution, and follow-up for stronger governance.
Guide
Risk Registers vs Compliance: Understanding the Difference
Learn how risk management and compliance differ, and how to integrate them for stronger governance.
Guide
POPIA Compliance Checklist: A Practical Guide
A step-by-step POPIA compliance checklist to help South African organisations meet their obligations under the Protection of Personal Information Act.
Guide
Risk Appetite vs Risk Tolerance: Understanding the Difference
Risk appetite and risk tolerance sound similar but serve very different purposes. This guide explains both concepts and helps you avoid common mistakes.
Guide
What Is a Risk Heat Map and How Do You Build One?
A practical guide to risk heat maps — what they are, how to create one, and how to use them to communicate risk clearly to leadership.
Guide
FICA Compliance in South Africa 2026: A Complete Guide
Everything accountable institutions need to know about FICA compliance in 2026 — CDD, RMCP, PEP screening, and technology solutions.
Guide
Building an ERM Framework in Africa: A Practical Guide
How to build an enterprise risk management framework for African organisations — COSO ERM, ISO 31000, King IV alignment, and 6-step implementation.
Guide
Data Governance Framework for South African Organisations
How to build a POPIA-aligned data governance framework — roles, policies, data inventory, data quality, and breach response.
Guide
Internal Audit Software for South African Organisations
How to choose internal audit software in South Africa — IIA standards alignment, must-have features, King IV combined assurance, and evaluation criteria.
Guide
GRC Certifications in South Africa 2026: Which Should You Pursue?
A practical comparison of CIA, CRISC, CISA, CGAP, and GRCP certifications for South African GRC professionals — with guidance on choosing based on your career goals.
Guide
Third-Party Risk Management in South Africa
Practical framework for managing vendor and supplier risk in South Africa — POPIA operator agreements, TPRM lifecycle, vendor risk assessment, and technology.
Guide
B-BBEE Compliance Automation in South Africa
How automation transforms B-BBEE compliance management — scorecard tracking, supplier certificate management, verification preparation, and GRC integration.
Guide
What Is a Risk Management Policy? Purpose, Contents & How to Write One
A risk management policy is the document that turns risk management from an activity into a mandate. Here is what it contains and how to write one.
Guide
What Is a Risk Appetite Statement? Appetite, Tolerance & Capacity Explained
A risk appetite statement tells the organization how much risk it is willing to take to pursue its objectives. Here is how to build one that actually guides decisions.
Guide
What Is a Risk Assessment and How Do You Run One? Step-by-Step Guide
A risk assessment is the engine of your risk program. Here is a practical, step-by-step process for running one from scope to documented output.
Guide
What Is a Risk Treatment Plan? The Four Options Explained
A risk treatment plan turns a list of risks into a set of committed actions with owners, deadlines, and measurable targets.
Guide
What Is a Controls Register? Fields, Testing & Best Practices
A controls register is the inventory of everything your organization relies on to keep risk in check, and the evidence that it actually works.
Guide
What Is a Board Risk Report? Purpose, Contents & Best Practices
A board risk report gives directors the one view they need: are our biggest risks within appetite, and are they moving in the right direction?
Guide
What Does a Risk Workshop Look Like? Agenda, Facilitation, and Outputs
A good risk workshop turns scattered opinions into a scored, owned set of risks in a single session. Here is exactly how to run one.
Guide
What is Combined Assurance? The Three Lines Model Explained
Combined assurance coordinates everyone who provides assurance so the board gets one coherent picture, with less duplication and fewer gaps.
Guide
What Is a Compliance Register and How Do You Build One?
A compliance register turns a wall of regulations into a tracked, owned, and auditable list of obligations. Here is how to build one that works.
Guide
What Is Regulatory Obligation Mapping? A Practical Guide
Regulatory obligation mapping turns dense legislation into a structured library of discrete, ownable requirements. Here is how it works.
Guide
What Is a Compliance Policy? Purpose, Contents & Review Cycle
A compliance policy states what your organization commits to and why. Here is what it contains and how to keep it credible.
Guide
What Is a Compliance Gap Analysis? Steps, Scoring & Examples
A compliance gap analysis measures the distance between what regulations require and what you actually do, then turns that distance into a remediation plan.
Guide
What Happens During a Regulatory Inspection? A Complete Guide
An inspection is not a test you cram for. It is a snapshot of how you already operate. Here is what to expect and how to be ready.
Guide
What Is Compliance Evidence and Why Does It Matter?
Compliance evidence is the proof that your controls actually work. Without it, even a well-run program collapses under audit scrutiny.
Guide
What Goes into a Compliance Report for the Board?
A board compliance report is not a data dump. It is a decision tool. Learn the sections, the framing, and the discipline that make directors trust it.
Guide
What Is a Compliance Calendar and How Do You Build One?
A missed filing deadline is one of the most avoidable compliance failures there is. A compliance calendar is how disciplined teams make sure it never happens.
Guide
What Is a Risk-Based Internal Audit Plan? Definition, Method and Example
Stop auditing on a fixed rotation and start directing audit effort where risk actually lives. This guide shows you how to build a risk-based internal audit plan.
Guide
What Is an Audit Charter? Purpose, Contents and How It Establishes Independence
The audit charter is the single document that grants internal audit its authority, defines its scope, and protects its independence. Here is what belongs in one.
Guide
What Does an Internal Audit Actually Look Like? The Full Lifecycle Explained
From the engagement letter to the closing meeting, here is what an internal audit actually involves, step by step, with a realistic timeline.
Guide
What Is an Audit Finding? The 5 C's, Severity Ratings and How to Write One
A good audit finding does more than point out a problem. It makes the case for action. Here is the structure, the severity scale, and a worked example.
Guide
What is a Follow-Up Audit? Verifying Remediation Actually Worked
Agreeing a fix is not the same as fixing the problem. A follow-up audit verifies remediation actually happened, and actually works.
Guide
What Is an Audit Universe? Definition, Examples and How to Build One
The audit universe is the complete map of everything internal audit could examine, and the foundation of a credible, risk-based audit plan.
Guide
What Is Control Effectiveness and How Do You Assess It?
A control only reduces risk if it is both well designed and actually working. Control effectiveness is how you prove which.
Guide
What Goes Into an Internal Audit Report? Structure & Examples
An internal audit report is only as valuable as it is clear. Here is exactly what goes into one and how to write it for the people who will act on it.
Guide
What Is an Incident Register and How Do You Set One Up?
An incident register turns scattered tickets, emails and war-room notes into a single, auditable record of what went wrong and what you did about it. Here is how to build one.
Guide
What Is Root Cause Analysis? Techniques and Worked Examples
Fixing a symptom feels like progress until the same incident comes back. Root cause analysis finds the underlying reason so your corrective actions actually stick.
Guide
What Goes Into an Incident Report? Sections and Examples
A good incident report does more than record what happened. It explains, for the right audience, why it happened and what changes because of it.
Guide
What Does Good Incident Management Look Like? The Lifecycle, Roles & SLAs
Good incident management is not about heroics during a crisis. It is a calm, repeatable lifecycle with clear roles, timeframes, and learning built in.
Guide
What Is a Post-Incident Review? Purpose, Agenda, and Lessons Learned
An incident that teaches you nothing is just damage. A good post-incident review turns it into a permanent improvement. Here is exactly how to run one.
Guide
Zimbabwe Cyber and Data Protection Act: What Businesses Must Know
POTRAZ registration, data subject rights, cybercrime provisions and enforcement penalties explained.
Guide
Kenya Data Protection Act 2019: Business Compliance Guide
Meet your obligations under Kenya's Data Protection Act, including ODPC registration, DPIAs and penalties.
Guide
Mauritius Data Protection Act 2017: FSC Compliance Guide
Meet your obligations under the Mauritius Data Protection Act, with a focus on FSC requirements for financial services.
Guide
What Is Enterprise Risk Management (ERM)? A Complete Guide
A practical guide to building and running an enterprise risk management programme.
Guide
Nigeria Data Protection Act (NDPA) 2023: Compliance Checklist
DPO requirements, breach notification and NDPC enforcement, in a checklist you can work through.
Guide
Tanzania Personal Data Protection Act 2023: Compliance Checklist
PDPC requirements, DPO appointment and breach notification under Tanzania's PDPA 2023.
Guide
What Is Compliance? A Beginner's Guide for African Organisations
What compliance means, why it matters, the key regulations to know and how to build a programme from scratch.
Guide
What Is GRC? Governance, Risk & Compliance Explained
Why an integrated approach to governance, risk management and compliance matters for organisations across Africa.
Guide
What Is ISO 31000? A Simple Guide to Risk Management Standards
A beginner-friendly explanation of the ISO 31000 risk management standard.
Guide
What Is a Risk Management Framework?
What risk management frameworks are, why they matter, the major ones compared and how to implement one step by step.