The eThekwini Municipality has addressed issues on spaza shops such as non-compliance with municipal by-laws and application forms for the informal trading permit reflecting citizenship status of the applicant
Image: Supplied
The eThekwini Municipality’s Audit Risk Committee (ARC) was concerned about the deficiencies identified in the audit of spaza shop permits.
Issues such as non-compliance with municipal by-laws, fragmented permit management, and municipal forms not accounting for applicant's citizen status were highlighted in the findings of the ARC report for the second quarter, between October 1, 2025, and December 31, 2025.
Siboniso Shabalala, the former chairperson, stated that as of December 31, 2026, there were 111 items still not resolved on the ARC audit log while 52 of these items are over 180 days overdue for implementation. Shabalala urged the municipal leadership to pay attention to ensuring that these matters are resolved timeously, as they compromise the control environment and expose operations to further risks.
The ARC also highlighted that the municipality’s Information and Communication Technology (ICT) governance and control needs to be improved. A ethical hacking review found that while the internal network demonstrates a positive security posture, several vulnerabilities were identified and exploited during testing.
Shabalala said the weakness allowed Internal Audit to disrupt services, access a database server without a password, and upload and delete an unauthorised application package.
The ARC found that the Supply Chain Management (SCM) migration to a software has not yet achieved its intended operational efficiency and transparency outcomes.
“Multiple contract extensions, escalating the contract value from R124 million to R143,7m, reflected inadequate scope control and weak cost monitoring. At the same time system adoption remains low, with suppliers continuing to submit bids manually despite user training,” Shabalala said.
About the productivity management human capital review, the ARC found the project impact assessment branch was not operating in line with its approved Standard Operating Procedures (SOP) as no evidence of project impact assessment reports was provided.
Responding to the ARC report, Musa Mbhele, eThekwini City Manager, said that a number of action plans linked to ethical hacking have been addressed, and relevant information has been shared with the internal audit team to verify.
With regard to ethical hacking, Mbhele said the process has been initiated, and it is currently at the evaluation stage. The cost to implement the solution as a managed service for over 10,000 users was approximately R20 million, for a 3-year cycle.
Mbhele said the spaza shop business permit and informal trade bylaw was reviewed to address pre-existing deficiencies as well as align with Cooperative Governance and Traditional Affairs (CoGTA) standard draft bylaws.
Mbhele said the draft review of informal trade bylaw was formulated and tabled with the trader leadership for consultation.
“This engagement was held during the eThekwini municipality informal economy forum meeting and later presented at a broader trader constituency during the informal economy summit,” he said.
He added that legal services and economic development directorates are currently finalising a report requesting council approval for public consultation on the bylaw review anticipated completion by June 30, 2026.
“The municipal application form for informal trading permit has been edited to reflect, among others, citizenship status of the application from March 2026,” Mbhele said.
The ARC is an independent advisory body that must advise the eThekwini management of internal financial control, internal audit, risk management processes, performance management, and financial reporting.
zainul.dawood@inl.co.za