Can CAs assist clients with POPIA compliance?
It is permissible to assist clients with POPIA compliance provided that this does not threaten fundamental principles in terms of the IRBA Code of Conduct, i.e. Independence.
Ideally any form of POPIA compliance must first be considered and documented in working papers. Safeguards must be implemented for any identified threats to fundamental principles. It is also important that the client assumes responsibility for their organisation's POPIA compliance. This must be clearly stipulated in the engagement letter with the client.
The only other consideration to consider is Section 90 of the Companies Act. Section 90(2) prohibits an auditor to provide audit and certain specified services to the same client. After perusal of the SAICA and IRBA guidance issued on this section of the Companies Act, it is evident that providing assistance with POPIA compliance does not contravene this section for audit clients.