GoTo.

Governance and compliance

Written for procurement, not for marketing.

For procurement officers, supply chain management units and institutional finance offices. Standing compliance documents are maintained continuously rather than assembled when a bid appears, because a technically superior bid with an unsigned declaration or an expired tax compliance status is disqualified before anyone reads it.
Ownership
100 percent black-owned
Registered
South Africa (CIPC)
CSD
Registered, number on request
Information Officer
Named and registered
01Ownership

100 percent black-owned.

Under the generic Codes of Good Practice, an entity with annual total revenue at or below the exempted micro enterprise threshold qualifies as an EME and may confirm its status by sworn affidavit, and a 100 percent black-owned EME qualifies for the highest recognition level.

Marketing, advertising and communication work may instead fall under the Marketing, Advertising and Communication Sector Code, which sets its own thresholds. The applicable code affects both the affidavit used and the preference points claimed, and it is confirmed against the requirements of each individual bid rather than assumed.

What this means for your bid evaluation
Ask for the affidavit applicable to the code your bid cites, and it will be supplied against that code rather than a generic one. Where the correct code is ambiguous in the bid documents, we will say so in writing rather than claim the more favourable reading.
02Compliance pack

Maintained continuously, with a stated validity period.

DocumentSourceValidity
CIPC company registration documentsCIPCPermanent, updated on any change
CIPC annual return confirmationCIPCAnnual, due in the month of the incorporation anniversary
Central Supplier Database registration and supplier numberNational Treasury CSDContinuous
Tax compliance status PINSARS eFilingVerified before each submission
B-BBEE affidavit or certificateSworn affidavit or verification agencyTwelve months
VAT registration certificate, where registeredSARSPermanent
Bank confirmation letterBankTypically three months
Company profile and capability statementInternalRefreshed quarterly
CVs of key personnelInternalRefreshed quarterly
Letters of good standing and referee lettersClientsRefreshed annually
Professional indemnity and public liability coverInsurerAnnual
03POPIA and data protection

The responsible party or operator role is established and recorded at the start of every engagement.

The obligations differ materially, and the distinction is reflected in the contract rather than negotiated afterwards.

A named Information Officer is responsible for compliance. Where GoTo processes information on a client’s instruction, it processes only on documented instruction, keeps the information secure, and notifies the client of any compromise.

Universities, government departments and municipalities increasingly ask suppliers for evidence of POPIA compliance, and the request is not ceremonial. See the POPIA statement and the privacy policy for how this site itself handles personal information.

Applied to our own work first
The firm advises on AI adoption and governance and applies the same governance to its own work, on the principle that a firm which cannot demonstrate its own data governance cannot credibly sell it.
04Due diligence

Every claim has a document behind it.

ClaimWhat can be produced on request
We diagnose before designingThe Discovery and Diagnostic Protocol: interview structure, six audit types, and the nine-dimension GoTo360™ scoring guide.
We control qualityA four-level review standard. Nothing leaves the firm on the strength of the person who made it.
We control scope and costA gated engagement procedure with a one-page change order signed before any additional work is performed.
We transfer knowledgeA handover and knowledge transfer standard specifying eight sections of content.
We protect informationA POPIA and data protection policy covering both responsible party and operator roles, with a named Information Officer.
We can transact with institutionsA public sector compliance pack maintained continuously rather than assembled when a bid appears.
Worth knowing for evaluators
Institutional buyers, particularly universities and public entities, increasingly score suppliers on documented quality management, data protection and delivery methodology. GoTo maintains that documentation as a standing operating requirement, and it is available for inspection as part of any bid or due diligence process.
05Operating documentation

Seventeen operating documents across four clusters, and an eighteen-procedure SOP library.

Client delivery, commercial and bid, administration and finance, and governance. Documents are versioned, reviewed annually in October, reissued in November, and reviewed immediately after any failure the documentation should have prevented.
06Digital standards applied to every build

Seven standards, applied to client work and to this website.

  1. 01
    Mobile-first responsive design, tested across current browsers and down to a 320 pixel viewport without horizontal scroll.
  2. 02
    Accessibility to WCAG 2.1 AA as a minimum: semantic structure with one first-level heading per page, skip-to-content, visible focus states, keyboard operability, descriptive alternative text, and contrast that passes at AA.
  3. 03
    Performance: preloaded hero media, lazy loading with intrinsic aspect ratios so there is no layout shift, subsetted fonts, and deferred scripts.
  4. 04
    Search readiness: unique titles and meta descriptions, canonical URLs, Open Graph tags, structured data, sitemap and robots file.
  5. 05
    Security and privacy: HTTPS, no secrets in client code, external links protected, configured backups, and a privacy notice aligned to POPIA.
  6. 06
    Motion and reduced motion: entrance animation is disabled where the visitor has requested reduced motion, and no animation blocks reading.
  7. 07
    Ownership: domains, hosting and accounts are registered in the client’s name with the client as account holder, and every account created is listed in the handover register.
Including this site
This website is built to the same standard it describes. See the accessibility statement for the conformance position and how to report a barrier.

Book a Discovery Session

The most useful first step is a discovery conversation.

A structured session that produces a written problem statement, whether or not it leads to an engagement. If the problem is not one we should be paid to solve, we will say so.

Book a sessionSend an enquiry instead

Enquiries acknowledged within one business day, always.