King IV is the King IV Report on Corporate Governance for South Africa 2016, published by the Institute of Directors in South Africa. It sets 17 principles and recommended practices for governing bodies of every kind, applied on an apply-and-explain basis, and took effect for financial years starting on or after 1 April 2017. King V replaces it from 2026.

What does King IV Principle 12 require of boards?

King IV Principle 12 requires the governing body to govern technology and information so that they support the organisation's strategy. In practice the board sets direction, approves policy, delegates management, and oversees risk, resilience, incident response, suppliers, value from investments, ethical use and legal compliance, including POPIA. Under King V it becomes Principle 10: data, information and technology.

What is the difference between King IV and King V?

King V replaces King IV for financial years beginning on or after 1 January 2026. It cuts the principles from 17 to 13, drops the sector supplements and the institutional investor principle, keeps apply and explain with a new Disclosure Framework, tightens director independence, and turns technology governance into Principle 10 on data, information and technology, including artificial intelligence.

Is King IV compulsory?

No, King IV is voluntary for most organisations, but the JSE Listings Requirements make parts of the King Code binding on listed companies. Many public entities, municipalities and non-profits apply it because funders, regulators and stakeholders expect it, and courts have referred to the King principles when judging directors' conduct. From 2026, King V is the current code.

What does apply and explain mean in King IV?

Apply and explain means an organisation is taken to apply every King IV principle and must explain how: which practices it implemented and how they advance the governance outcomes. It replaced King III's apply or explain, which allowed an organisation to explain non-application instead. King V keeps apply and explain and standardises the disclosures through its Disclosure Framework.

What is the combined assurance model in King IV?

The combined assurance model is King IV's approach to coordinating all assurance providers, from management and risk and compliance functions to internal audit, the external auditor and other external assurers. Together they should cover the organisation's significant risks, including technology risks, without gaps or duplication. The governing body decides the model's design, and the audit committee usually oversees it.

What does King IV recommend for board composition?

King IV recommends a majority of non-executive members, most of them independent, with at least two executives, usually the chief executive and the finance director. The chair should be an independent non-executive, separate from the chief executive, and a lead independent director should be appointed. Boards should also set targets for race and gender representation.

King IV and technology governance: what boards must know

King IV, the King IV Report on Corporate Governance for South Africa 2016, sets 17 principles for governing bodies, including Principle 12 on governing technology and information. King V replaces it for financial years beginning on or after 1 January 2026. Arke Technologies, in Johannesburg, helps boards govern technology under both.

Talk to us about IT governance Compare King IV and King V

Insights

King IV and technology governance: what boards must know

Last reviewed: September 2026, 17 min read

On this page

What is King IV?

Last reviewed: September 2026.

King IV is the fourth King Report on corporate governance, published on 1 November 2016 by the Institute of Directors in South Africa (IoDSA), custodian of the King Reports. Its full title is the King IV Report on Corporate Governance for South Africa 2016. At its heart sits Part 5, the King IV Code on Corporate Governance, which most people simply call the King IV code of corporate governance. The King IV effective date was financial years starting on or after 1 April 2017, when it replaced King III in its entirety (IoDSA, 2016).

The purpose of the King IV report was to move governance from box-ticking to mindful application: ethical and effective leadership that achieves four governance outcomes, namely an ethical culture, good performance, effective control and legitimacy. King IV corporate governance speaks of governing bodies and organisations rather than boards and companies, so it applies to companies, municipalities, state-owned entities, non-profits and retirement funds alike, with sector supplements for municipalities, small and medium enterprises, state-owned entities, non-profit organisations and retirement funds.

King IV is not law. It is voluntary, although the JSE Listings Requirements make parts of the King Code binding on listed companies and require them to report on the rest, and courts have referred to the King principles when judging the conduct of directors (Cliffe Dekker Hofmeyr, 2025). This guide, part of our insights and guides, explains what King IV asks of boards on technology, and what changes under King V.

Directors review printed figures at a boardroom table beneath a chart on screen.

King IV vs King V: what changed from 2026

King V, the King V Code on Corporate Governance for South Africa 2025, was launched on 31 October 2025. It supersedes King IV for financial years beginning on or after 1 January 2026, with early adoption encouraged, and it is an evolution rather than a revolution (IoDSA, 2025; Werksmans, October 2025).

	King IV (2016)	King V (2025)
Effective	Financial years starting on or after 1 April 2017	Financial years beginning on or after 1 January 2026
Principles	17, with Principle 17 for institutional investors only	13; responsible investment now sits with the Code for Responsible Investing in South Africa (CRISA 2)
Structure	One report in seven parts, with sector supplements	Four documents: Foundational Concepts, the Code, a Glossary and a Disclosure Framework; no sector supplements
Application	Apply and explain	Apply and explain, with a standardised Disclosure Framework and a concluding statement on the governance outcomes
Technology	Principle 12: technology and information	Principle 10: data, information and technology, including artificial intelligence
Governance outcomes	Ethical culture, good performance, effective control, legitimacy	Ethical culture, performance and value creation, conformance and prudent control, legitimacy
Independence	Criteria weighed as factors; long tenure reviewed	Three-year cooling-off for former executives; tenure beyond nine years a strong indicator against independence
Committees	Risk and social and ethics committees with a majority of non-executive members	Both also need at least one independent non-executive member
Materiality	Materiality as used in integrated reporting	Double materiality: financial and impact

Which code applies depends on your financial year. A year that began before 1 January 2026 is still reported against King IV, so an organisation with a 1 April 2025 to 31 March 2026 year reports on King IV this year and on King V next year. King IV Principle 12 becomes King V Principle 10 and gains data in its title, with new practices on the data lifecycle, cybersecurity, outsourced technology and artificial intelligence.

The underpinning philosophies and the triple context

The underpinning philosophies of King IV are ethical leadership; the organisation as an integral part of society, and therefore a corporate citizen; sustainable development; stakeholder inclusivity; integrated thinking; and integrated reporting. The triple context in the King IV report is the economy, society and the environment in which an organisation operates. King IV asks boards to weigh the organisation's effect on that context and on the capitals it uses and affects: financial, manufactured, intellectual, human, social and relationship, and natural capital.

King IV's ethical leadership characteristics are integrity, competence, responsibility, accountability, fairness and transparency, often shortened to ICRAFT (IoDSA, 2016). King V keeps the philosophy and names the Ubuntu-Botho philosophy, corporate citizenship and stakeholder inclusivity as expressions of integrated thinking (King V Code, 2025).

The 17 King IV principles: a summary

This King IV principles summary paraphrases each principle of the King IV report and shows where it sits in King V. Each principle states an aspiration, supported by recommended practices.

King IV principle	What the governing body should do	Where it sits in King V
1	Lead ethically and effectively	Principle 1, Leadership
2	Govern ethics so that an ethical culture takes root	Principle 2, Ethics
3	Make sure the organisation is, and is seen to be, a responsible corporate citizen	Merged into Principle 2
4	Treat purpose, risks and opportunities, strategy, business model, performance and sustainable development as one value-creation process	Principle 3, Strategy, performance and sustainable value creation
5	Make sure reports let stakeholders judge performance and prospects	Principle 4, Reporting
6	Act as the focal point and custodian of corporate governance	Principle 1, Leadership
7	Hold the right balance of knowledge, skills, experience, diversity and independence	Principle 5, Composition of the governing body
8	Delegate within its own structures in a way that promotes independent judgement and a balance of power	Principle 6, Committees of the governing body
9	Evaluate its own performance and that of its committees, chair and members	Folded into Principle 1
10	Appoint and delegate to management so that roles and authority are clear	Principle 7, Appointment and delegation to management
11	Govern risk so that it supports strategy and objectives	Principle 8, Risk
12	Govern technology and information so that they support strategy and objectives	Principle 10, Data, information and technology
13	Govern compliance with laws and adopted non-binding rules, codes and standards	Principle 9, Compliance
14	Remunerate fairly, responsibly and transparently	Principle 11, Remuneration
15	Make sure assurance services support an effective control environment and the integrity of information	Principle 12, Assurance
16	Take a stakeholder-inclusive approach that balances material stakeholders' needs over time	Principle 13, Stakeholders
17	Institutional investors should invest responsibly	Removed; covered by CRISA 2

Sources: IoDSA, 2016; King V Code, 2025.

Seven of these are the key principles of King IV for technology governance: King IV principle 1 (ethical, effective leadership, which sets the tone for how technology is used), principle 3 of King IV (responsible corporate citizenship, including how the organisation's activities affect its workplace, society and the environment), King IV principle 7 (the skills on the board, technology included), King IV principle 8 (which committee oversees technology), King IV principle 11 (risk), King IV principle 12 (technology and information) and Principle 15 (assurance).

Apply and explain: how the King IV code principles are applied

Apply and explain in King IV means every principle is assumed to be applied, and the organisation explains how: which practices it implemented and how they advance the governance outcomes. King III, published in 2009, used apply or explain, which let an organisation explain why it did not apply a principle. King III vs King IV therefore differs less in content than in approach: outcomes, transparency about judgement, and proportionality, so that practices scale to an organisation's size, resources and complexity (IoDSA, 2016).

King IV disclosures usually appear in the integrated report or a governance report, often as a register that addresses each of the 17 principles. King V keeps apply and explain, but adds a standardised Disclosure Framework and a concluding statement on whether the governance outcomes were realised (King V Code, 2025).

Board composition, independence and committees

The King IV report on the preferred structures of board members does not prescribe a single model, but its recommended practices for King IV board composition are clear (Cliffe Dekker Hofmeyr, 2025):

a majority of non-executive members, most of whom are independent;
at least two executive members, usually the chief executive and the finance director;
an independent non-executive chair, with the roles of chair and chief executive held by different people;
a lead independent director, whatever the chair's status;
targets for race and gender representation, and staggered rotation of members.

An independent non-executive director under King IV is judged on substance over form, weighing factors such as financial interests, recent employment, family ties and material business relationships. King V tightens this: former executives need a three-year cooling-off period, and tenure beyond nine years is a strong indicator against independence.

Board committee	King IV recommended composition	King V change
Audit	At least three members, all independent non-executive	Unchanged
Nominations	All non-executive, majority independent	The chair of the board should chair it
Remuneration	All non-executive, majority independent	Unchanged
Risk	Executives and non-executives, majority non-executive	At least one independent member
Social and ethics	Executives and non-executives, majority non-executive	At least one independent member

Source: Cliffe Dekker Hofmeyr, King V overview, 2025.

Principle 8 of King IV asks the governing body to delegate within its own structures in a way that promotes independent judgement and a balance of power; each board committee under King IV needs formal terms of reference and at least three members. The Companies Act adds legal duties: public and state-owned companies need an audit committee, and listed and state-owned companies, and others with a public interest score of 500 or more in two of the previous five years, need a social and ethics committee (Cliffe Dekker Hofmeyr, 2025).

Principle 11: King IV on risk management

King IV principle 11 asks the governing body to govern risk so that it supports the organisation's strategy. King IV defines risk as uncertainty, its likelihood and its effects, positive as well as negative, so risk includes opportunity, and it recommends a risk committee with a majority of non-executive members (IoDSA, 2016).

The King IV report on risk management matters for technology because cyber attacks, outages, failed projects, supplier failures and data breaches are business risks, not IT housekeeping. Each belongs on the organisation-wide risk register with an owner, an appetite and a treatment, reported to the risk committee. King V's Principle 8 keeps this approach, frames risk more around opportunity and treats cybersecurity and technology risks as strategic business risks (Werksmans, October 2025).

Principle 12: technology and information governance

King IV principle 12 makes the governing body responsible for governing technology and information so that they support the organisation's strategy. King IV deliberately spoke of technology and information rather than information technology, because the two overlap but carry different value and risks (IoDSA, 2016). In practice, the governing body sets direction, approves policy, delegates implementation to management, and oversees that technology and information management delivers:

people, technologies, information and processes that work together across the organisation;
technology and information risks built into organisation-wide risk management;
business resilience, with recovery arrangements that are tested;
proactive monitoring to detect and respond to incidents, including cyber attacks and adverse social media events;
managed performance and risk of third-party and outsourced service providers;
value from significant technology investments, assessed through each project's life;
responsible disposal of obsolete technology and information, with regard to the environment and to information security;
ethical and responsible use of technology and information, and compliance with laws such as POPIA and PAIA;
for information: protection of its confidentiality, integrity and availability, privacy of personal information and continual monitoring of security.

These are the King IV IT governance principles in practice: direct, delegate, oversee and disclose. The recommended disclosures cover the arrangements for governing technology and information, the key areas of focus in the year, the actions taken to monitor effectiveness, and planned areas of future focus. This is where IT and corporate governance meet: the board does not run IT, but it must be able to show that it governs it.

King V Principle 10 adds the full data lifecycle, from acquisition to disposal, data classification and quality, cybersecurity strategy and minimum assurance requirements for outsourced technology. For artificial intelligence it adds values such as human centricity, transparency, explainability and fairness, with human oversight and override in proportion to the risk (King V Code, 2025). Our AI governance service builds those controls.

Principle 15 and the combined assurance model

King IV principle 15 asks the governing body to make sure that assurance services and functions support an effective control environment and the integrity of information used for decisions and in external reports. The combined assurance model in King IV brings every assurance provider together, from management and specialist risk and compliance functions to internal audit, the external auditor and other external assurers, so that between them they cover significant risks without gaps or duplication. King IV does not prescribe the model's design; the governing body decides it, and the audit committee usually oversees it (IoDSA, 2016).

For technology, a combined assurance map shows who gives assurance on each significant risk: management's monitoring and reports, ISO/IEC 27001-aligned control reviews, penetration tests and retests, backup restore tests, access reviews, internal audit's IT audits and the external auditor's work on IT general controls. King V's Principle 12 keeps this flexibility and asks the board to explain how assurance over its disclosures is achieved.

A technology governance framework a board can run

Approve direction and policy
A technology and information governance policy, with a committee mandate for oversight.
Register the risks
Technology risks on the organisation-wide risk register, with owners and an agreed appetite.
Set the reporting pack
A regular report on incidents, availability, projects, suppliers, security and spend, written in board language.
Define escalation
Which incidents reach the board, including security compromises involving personal information that POPIA section 22 requires to be reported to the Information Regulator.
Manage suppliers
A register of critical third-party and outsourced providers, their service levels and the assurance each gives.
Test value
Business cases before significant technology investments, and reviews after them.
Map assurance
A combined assurance map for technology risks.
Build competence
Technology knowledge on the board, the balance Principle 7 asks for, through appointments, training and briefings.
Disclose
Report on arrangements, focus areas, monitoring and future focus, and move to the King V Disclosure Framework.

King IV training and board briefings

King IV training, and now King V corporate governance training, is offered to directors by the IoDSA and other training providers. Formal training explains the code; boards also need regular briefings on their own technology risks, in plain language, with evidence behind them. Our IT governance, risk and compliance service prepares that reporting and takes the board or audit and risk committee through it, and a virtual CISO gives security oversight without a full-time appointment.

How Arke helps boards govern technology

Governance. Policies, risk registers and audit-ready evidence for King IV Principle 12 and King V Principle 10, with POPIA and PAIA controls.
Reporting. Every client gets a monthly service review and report on the systems we manage. Incidents are prioritised on a P1 to P4 scale, with response and resolution targets agreed in your SLA.
Monitoring. Automated monitoring checks each managed computer every 15 minutes and logs faults as tickets, so the incident figures in a board pack come from records, not recollection.
Security. Controls aligned with ISO/IEC 27001, the NIST Cybersecurity Framework and the CIS Controls; our guide to what cyber security is explains the basics for directors.
Privacy. POPIA built into the systems we run; see our POPIA compliance checklist.
Public bodies. For departments, public entities and municipalities, King IV sits beside the PFMA and MFMA; see PFMA, MFMA and ICT procurement.
Procurement fit. A Level 1 B-BBEE contributor, giving 135% procurement recognition (sworn affidavit available on request); company documents, our CSD supplier number and SARS tax compliance status on request.
Continuity. You own your data, credentials and documentation, and exit is planned from the start.

Last reviewed: September 2026, 17 min read

Give your board a clear view of technology

We prepare the policies, registers and reporting that let a governing body govern technology under King IV and King V.

Talk to us about IT governance

Get our guides by email

Plain, sourced guides for the people who decide on and buy technology, sent to your inbox.

Frequently asked questions

What are the King IV principles?

The King IV principles are 17 statements of what good governance achieves. They cover ethical leadership, ethics, corporate citizenship, strategy, reporting, the governing body's role, composition, committees, evaluation, delegation to management, risk, technology and information, compliance, remuneration, assurance, stakeholders and, for institutional investors, responsible investment. Recommended practices support each one, applied in proportion to the organisation.

What is King IV?

King IV vs King V: what changed from 2026

The underpinning philosophies and the triple context

The 17 King IV principles: a summary

Apply and explain: how the King IV code principles are applied

Board composition, independence and committees

Principle 11: King IV on risk management

Principle 12: technology and information governance

Principle 15 and the combined assurance model

A technology governance framework a board can run

Approve direction and policy

Register the risks

Set the reporting pack

Define escalation

Manage suppliers

Test value

Map assurance

Build competence

Disclose