Internal audit: The internal audit plan presented to the audit committee was not adequately linked to the entity's risks, as the risk identification process is not yet complete. This is in contravention to Treasury Regulation 27.2.1, read with Treasury Regulation 27.2.6, which requires the internal audit function, in consultation with the audit committee to prepare a three rolling internal audit plan.