Every month, BarnOwl GRC compiles a list of leading Governance, Risk and Compliance (GRC) articles and thought leadership from South Africa and around the world.
This article is my summary of the key themes emerging from BarnOwl’s review of 53 GRC articles for September 2026, with a particular focus on what risk managers, executives and boards should be watching.
September feels different.
After months of debate about decision-centric risk management, culture, AI accountability and resilience, the conversation has moved much closer to a fundamental governance question:
Does governance actually work when it matters?
For South African organisations, that question has become particularly relevant. September’s articles were dominated by the arrival of King V, the continuing lessons from Tongaat Hulett, concerns about governance in state-owned entities, and a growing recognition that AI, reputation and organisational culture require much stronger assurance.
The message for risk managers and executives is increasingly clear:
Governance cannot be demonstrated by frameworks alone. It must be visible in decisions, behaviour, accountability and outcomes.
1. King V Changes the Question from “Do We Comply?” to “Can We Demonstrate the Outcome?”
The publication of King V is arguably the most important South African governance development highlighted in September.
The articles reviewed suggest continuity with King IV’s outcomes-based approach, but with strengthened attention to areas including board effectiveness, ethical culture, technology and information governance—including AI—stakeholder inclusivity and sustainability.
GRC_Themes_September_2026.docx
For risk managers, the important question is therefore not simply:
“What changed from King IV to King V?”
It is:
“What needs to change in the way we govern, assure and evidence these areas?”
Risk functions should be considering how existing King IV disclosures map to King V, whether the assurance universe adequately addresses the strengthened areas, and whether board and committee reporting provides evidence of outcomes rather than merely activities.
King V should not become another compliance project.
It is an opportunity to ask whether governance is actually achieving what it was designed to achieve.
2. Tongaat Hulett Reminds Us That Warning Signs Matter Only If Someone Acts
The continuing Tongaat Hulett story provides a sobering counterpoint to the arrival of King V.
The September synthesis highlights the pattern of audit signals and governance concerns that preceded the company’s eventual business rescue and current liquidation battle.
For risk managers and executives, there is an important lesson here.
Organisations rarely fail because absolutely no warning signs existed.
The bigger question is whether those signals were:
- connected,
- escalated,
- challenged,
- understood in their strategic context, and
- acted upon.
That creates a powerful question for every Audit Committee:
If we looked across the last 12 months of audit findings, control weaknesses, whistleblowing reports and risk indicators as one picture, what story would they tell us?
The role of governance is not simply to receive warning signals. It is to recognise when seemingly separate signals are collectively telling a much bigger story.
3. Public-Sector Governance Is Also a Private-Sector Risk
Another important South African theme is the gap between governance frameworks and governance outcomes in the public sector.
The September review highlights commentary arguing that South Africa’s challenge is not necessarily a shortage of governance frameworks, but problems including consequence management and interference with board independence.
This should matter to private-sector executives too.
If your organisation depends on SOEs or public institutions for utilities, contracts, approvals, infrastructure or payments, weaknesses in public governance can translate directly into:
- payment delays,
- supply disruption,
- project delays,
- regulatory uncertainty, and
- reputational exposure.
Governance failure elsewhere in your ecosystem can become operational risk inside your organisation.
Risk managers should therefore consider whether public-sector governance dependencies are adequately reflected in third-party and strategic risk scenarios.
4. AI Governance Has Entered the “Trust but Verify” Phase
August’s question was: Who is accountable for AI?
September adds another:
How do you know the AI is right?
This is particularly important for risk and Internal Audit functions that are themselves beginning to use AI.
Norman Marks raises the issue directly: auditors cannot outsource professional scepticism to the same technology they are using to perform assurance.
The September synthesis therefore suggests a practical control: where AI assists with audit fieldwork, evidence analysis or reporting, there should be an identifiable human verification step and evidence of that verification.
The same principle should apply to risk management.
If AI analyses your risk data, identifies trends or drafts board insights:
Who verifies its judgement before executives rely on it?
“AI reviewed 100% of the data” is not, by itself, assurance.
5. Reputation Risk Is Becoming a Governance Discipline in Its Own Right
One of the more interesting developments in September is the emergence of reputation risk as something more than a consequence of another risk.
The reviewed articles connect reputation with culture, stakeholder trust and the extraordinary speed at which reputational damage can now spread through social media.
I particularly like the underlying idea that:
Reputation is what organisational culture looks like from the outside.
That changes the way we think about reputation risk.
Instead of asking only what event could damage the organisation’s reputation, risk managers could ask:
- What would cause customers to stop trusting us?
- What would cause employees to stop believing our leadership?
- What would cause regulators to question our integrity?
- What behaviour would make investors reconsider their confidence in us?
Reputation therefore becomes a useful external indicator of whether governance and culture are working internally.
6. The Risk Register Debate Has Reached the Boardroom
The debate over risk registers, appetite statements, scoring and risk reports continued for another month.
By September, however, the recurring message is becoming difficult to ignore:
Risk artefacts have value only when they influence decisions.
That does not mean abandoning risk registers or appetite frameworks.
It means expecting more from them.
For every significant board decision, executives should be able to see the connection between:
Objective → uncertainty → options → risk → decision.
The question for the CRO is therefore not:
“How comprehensive is our risk register?”
It is:
“Which important decisions have been improved because of the insights contained in it?”
That is a much more demanding measure of risk-management effectiveness.
7. Internal Audit Cannot Afford to Wait for Relevance
September’s articles also continue to challenge the traditional Internal Audit model.
The issues raised include whether organisations should wait for regulators to require Internal Audit, whether Internal Audit is involved early enough in strategic developments, whether independence is sufficiently protected, and whether the profession is developing people for the rapidly changing environment they are entering.
For executives and Audit Committees, the message is important:
Internal Audit should not be judged only by whether the annual plan was completed.
Ask instead:
What has Internal Audit helped us see earlier than we otherwise would have?
As AI, cyber, geopolitical and interconnected risks accelerate, retrospective assurance alone will become increasingly insufficient.
8. Resilience Begins Where Controls Fail
August challenged organisations to distinguish business continuity from resilience.
September pushes that thinking further.
What happens when the control itself fails?
The emerging resilience test is not simply whether controls operate effectively under normal conditions. It is whether the organisation can continue pursuing critical objectives when an important control or capability is unavailable.
For the organisation’s three most critical processes, executives could ask:
“How would we continue achieving the underlying objective if our primary control failed for 72 hours?”
If the answer is simply “activate the Business Continuity Plan”, more work may be required.
Resilience is not merely restoring what failed.
It is continuing to achieve what matters.
9. Culture and Accountability Are No Longer “Soft” Governance Issues
September also reinforces a theme that has been building throughout the year: culture, ownership and accountability are converging.
Issues such as harassment, ethical behaviour, risk ownership and people’s willingness to raise difficult issues increasingly need to be understood as enterprise governance signals, rather than isolated HR or cultural concerns.
King V makes this particularly relevant for South African organisations through its emphasis on ethical culture.
Risk managers therefore need to become better at identifying indicators of culture.
Whistleblowing trends, employee turnover, repeated policy exceptions, unresolved audit findings and reluctance to challenge senior leaders may tell us more about governance effectiveness than another completed compliance checklist.
What Should Risk Managers Prioritise Now?
September’s themes suggest several practical priorities:
- Understand King V directly. Map the changes against existing King IV practices and determine what needs to change in governance, assurance and reporting.
- Connect weak signals. Look across audit, risk, culture and whistleblowing information for patterns that individual reports may hide.
- Verify AI-assisted risk and assurance work. Build human verification into the evidence trail.
- Treat reputation as a measurable risk. Monitor stakeholder trust, not just adverse media.
- Model public-governance dependencies. Particularly where operations depend on SOEs or government institutions.
- Make the risk register earn its place. Demonstrate which decisions it has influenced.
- Stress-test control failure. Ask whether critical objectives can still be achieved when primary controls fail.
Questions Executives and Boards Should Be Asking
September leaves boards with some uncomfortable—but valuable—questions:
- What does King V require us to do differently, rather than simply disclose differently?
- Which warning signals are we currently seeing but perhaps not connecting?
- How do we know that AI-generated assurance or risk insights are reliable?
- What does our reputation tell us about our culture?
- Could governance weaknesses elsewhere in our ecosystem disrupt our organisation?
- Which board decisions have actually changed because of our risk information?
- Can we continue achieving critical objectives when controls fail?
- Are we measuring governance activity—or governance effectiveness?
Final Thought
For me, the most important message from September is that the gap between governance on paper and governance in practice is becoming increasingly visible.
King V raises expectations.
Cases such as Tongaat Hulett remind us of the consequences when warning signs fail to drive action.
AI forces us to rethink what constitutes reliable evidence.
Reputation exposes culture to the outside world.
And resilience asks whether the organisation can continue delivering when its controls and assumptions fail.
The next evolution of GRC may therefore not require more governance.
It may require us to become much better at demonstrating that the governance we already have changes behaviour, improves decisions and protects value when it matters most.
That may ultimately be the real test of good governance: not whether the framework exists, but whether it works.
This article is based on BarnOwl’s synthesis of 53 Governance, Risk and Compliance articles included in its September 2026 GRC article review, with the themes distilled specifically for risk managers, executives and boards.
Applied Risk Management Solutions (ARMS)