When the scandal fades, so does the audit IDAC's real test is what comes next

"Within days of the Madlanga Commission of Inquiry hearing evidence that suspended Crime Intelligence Major-General Feroz Khan addressed then-IDAC head Advocate Andrea Johnson as "you gorgeous" in WhatsApp messages spanning several years, government moved. Justice Minister Mmamoloko Kubayi and National Director of Public Prosecutions Advocate Andy Mothibi announced a six-month "reset" of the Investigating Directorate Against Corruption, including lifestyle and skills audits of its staff, due for completion by 14 August."

It's the right instinct. An anti-corruption agency cannot credibly do its job while serious questions hang over its own former leadership: an NPA decision still pending on whether to prosecute Johnson over an alleged 2018 docket leak to Khan, and an unexplained gap between what Khan told Johnson about the size of a 2021 cocaine seizure and the official quantity later recorded, a discrepancy Johnson herself told the commission was "a real conundrum." But instinct isn't strategy. South African institutions have a habit of ordering audits in the heat of a scandal, then quietly letting them lapse once the headlines move on.

"A lifestyle audit conducted once, under pressure, in the full glare of a commission of inquiry, tells you what someone's finances and conduct looked like on the day they were checked," says Leon Towsen, Executive of Digital Solutions at XTND, whose lifestyle and intelligence review work spans public and private sector clients, including departments in South African government. "It does not tell you what happens six months later, once the commission has closed, the minister has moved to the next crisis, and the person being audited knows exactly when the next check is coming."

That's the deeper problem the IDAC story exposes, beyond the individuals named in it. None of what surfaced at the commission, the WhatsApp exchanges, the visits through a VIP entrance without signing in, the questions over the docket and the cocaine bust, was hidden from a system that failed to look. It was hidden from a system that only looks episodically.

Properly designed integrity reviews are built to work in tiers, not as a single event. A basic review, checking financial declarations and disclosed interests against what's actually on record, is meant to be the first layer of a graduated process. Only where it turns up something unexplained does it escalate into a deeper investigation of income against expenditure, and only where that points to potential criminality or materially unexplained wealth does it move to forensic investigators and law enforcement. "The Johnson-Khan relationship is a good example of why the conflict-of-interest and relationship-mapping side of a proper review matters as much as the bank balance," Towsen says. "An undisclosed close relationship between a prosecuting authority's own leadership and the subject of investigations connected to it is exactly what a structured review is designed to catch, not through suspicion, but by routinely mapping the relationships around people who hold power over sensitive decisions."

None of this is an argument against IDAC's audit, which is a necessary and overdue step. It's an argument for treating it as a floor, not a ceiling. A once-off audit, done properly, is a useful diagnostic tool. But diagnosis without ongoing monitoring is like a single blood test standing in for a health plan: it tells you where things stood on one date and says nothing about the months either side of it. Institutions serious about avoiding a repeat of the IDAC story need integrity checks built into how they operate day to day, not scheduled around whichever scandal is currently making headlines.

"Every institution in South Africa watching the IDAC story right now should be asking itself the same question," Towsen says. "If a commission of inquiry hadn't forced our hand, would we have found this ourselves? If the honest answer is no, a once-off audit this year won't change that answer next year."

There's a harder truth in this for boards, regulators and government departments watching from the sidelines: the pressure to act only arrived once the damage was already public. IDAC's reset happened because journalists sat through weeks of commission testimony, not because an internal system flagged the conduct earlier. That is the real lesson of this scandal, and it reaches well beyond one prosecuting authority. Lifestyle audits are a start. What determines whether South Africa ends up with a genuinely cleaner IDAC, or simply a quieter one until the next commission, is whether its institutions start treating integrity as an ongoing discipline rather than a crisis response. ENDS

XTND is a well-established, South African-owned forensic investigations company specialising in the prevention, detection, and response to white collar crime and corruption. Our team of internationally certified Certified Fraud Examiners brings over a decade of experience in delivering forensic services to businesses, industry bodies, and the public sector. As a corporate member of ACFE SA, the professional body for forensic practitioners, XTND is committed to upholding the highest standards in the forensic community and contributing to the integrity of the South African economy.

Samantha Hogg-Brandjes | GinjaNinja | samanatha@ginjaninja.co.za | +27 84 458 4857