Congratulations — your proposal has been accepted, and you have been engaged as an independent Governance Auditor. The excitement of winning the mandate quickly gives way to a practical question: what happens next? For any auditor stepping into a listed company, a State Corporation, or a pension scheme, the answer starts with a clear, well-structured introductory email to the client, setting out objectives, scope and the road ahead. That email is your professional handshake; disciplined execution of the audit itself is what follows.

A Governance Audit is an independent assessment of whether an organisation’s governance policies, systems and practices are functioning as they should. It gives boards, regulators, members and the public assurance that the entity is being directed and controlled responsibly, strengthens accountability, and surfaces gaps before they become legal, financial or reputational crises. As auditor, you owe every engagement integrity, objectivity, confidentiality and professional scepticism — qualities that build the trust on which repeat mandates are won.

Each entity type carries its own statutory anchor:
✔️ NSE Listed companies: the CMA Code of Corporate Governance Practices, 2015, mandates an annual audit by an ICS-accredited professional, covering eight parameters from leadership to CSR
✔️ State Corporations: Mwongozo and the ICS Governance Audit Manual require an annual audit across nine governance parameters, coordinated through the committee responsible for governance matters.
✔️ Pension schemes: the RBA’s Good Governance Practices Guidelines, 2018, allow the Authority to direct a governance audit by a certified professional, covering six parameters

Map your stakeholders early. Every engagement has a Board or Board of Trustees, a Corporate or Trust Secretary, Management or a Scheme Administrator, an Audit and Risk Committee, and, for pension schemes, a sponsor and the regulator. Each carries distinct responsibilities: the Board approves and formally adopts the self-assessment; the Secretary coordinates documents, access and scheduling; Management or the Administrator furnishes evidence and responds to the management letter.

The ICS Governance Audit Guidelines set out seven stages: engagement, management representation, self-assessment, self-assessment report, desk review and field work, management letter, and the final governance audit report.

The inception meeting: This first meeting is where an audit either gains momentum or loses it. Use it to confirm scope and terms of engagement, agree realistic timelines, clarify document and evidence requests, identify your key contacts, and address Board concerns before fieldwork begins — so every stakeholder walks out knowing exactly what is expected of them.

A well structured, code-anchored approach from day earns you a credible seat at the table, and hopefully, a future engagement.
hashtagCorporateGovernance hashtagGovernanceAudit hashtagICS hashtagMwongozo