• integrity and reliability of the financial statements;
• safeguarding of assets;
• economic and efficient use of resources;
• compliance with applicable legislation and regulations;
• verification of the accomplishment of established goals and objectives; and
• detection and minimisation of fraud, potential liability, loss and material misstatement.

Internal controls including information technology are established not only over financial matters, but also operational, compliance and sustainability issues. Controls are the means by which management seeks to mitigate risks to an acceptable level of exposure. Controls are contained in organisational policies and procedures, structures and approval frameworks. These provide direction, establish accountability and ensure adequate segregation of duties. Each contains self-monitoring mechanisms.

The board has mandated an initiative to design and embed an appropriate integrated framework that systematically evaluates and continuously improves controls across Eskom.

The internal audit department, which comprises corporate audit, corporate technical audit, corporate technical investigations and forensic and anti-corruption, reviews the internal control systems and reports findings and recommendations for improvement to management and the audit and risk committee. Internal audit provides a written assessment of the effectiveness of Eskom’s system of internal control and risk management.

The audit and risk committee monitors and evaluates the duties and responsibilities of management and of internal and external audit to ensure that all major issues reported have been satisfactorily resolved. Finally, the audit and risk committee reports all important matters considered necessary to the board.

Effective control is the responsibility of management at every level of the organisation.