The evidence gap: what South Africa’s 2025 inspection themes tell assurance teams
Judgement-heavy areas remain difficult when the link between risk, procedure, evidence and conclusion is not explicit.
A completed procedure is not automatically sufficient evidence
Assurance files often show that work happened but not why the work was responsive to the risk. The chain should be explicit: risk, assertion, procedure, population, result, exception and conclusion.
Judgement needs a record of challenge
Where management relies on assumptions, the file should show which assumptions mattered, what contradictory evidence was considered and why the final position was reasonable. Professional scepticism should be observable, not inferred.
System-generated information cannot be treated as self-proving
Before relying on a report or extract, teams need to understand the source, logic, access, changes and reconciliation points that affect completeness and accuracy. Data analytics strengthens assurance only when the underlying data is trustworthy.
Quality management belongs in delivery, not only methodology
Templates and policies do not replace timely supervision, consultation and review. Engagement leaders need defined quality checkpoints before positions harden and reporting deadlines compress.