Ever since allegations of corruption and mismanagement against State-owned entity the South African Bureau of Standards (SABS) started to surface late last year, the organisation has been under scrutiny.

A major cyberattack crippled the SABS in November 2024 and brought to the fore allegations made by whistleblowers that numerous questionable actions had paved the way for such a breach.

At the time of writing, the bureau still appeared to be recovering from the attack and the alleged managerial missteps that preceded it.

During a meeting of Parliament’s Portfolio Committee on the Department of Trade, Industry and Competition (dtic), held on February 5, it was revealed that the cyberattack was engineered by ransom-ware-as-a-service hacking entity Lynx.

Ransomware Group is described on the Dark Web as providing “everything an affiliate could want to breach and attack victims, including a quality-controlled recruitment system to engage even more criminals”.

Lynx has made a name for itself as a highly organised platform, complete with a structured affiliate programme and robust encryption methods.

Staff morale at the SABS is said to be low currently, partly because people cannot do their work and close observers fear the organisation is at risk of imploding unless decisive action is taken.

The SABS says several activities aimed at boosting employee morale, including employee engagement and culture change programmes, are scheduled to be rolled out in the new financial year.

An inside source also alleges that many of the SABS laboratories are not conducting tests and suggests that the Groenkloof campus “looks like a ghost town”, with almost no visitors or clients. This is apparently severely impacting on operations, revenue generation and the financial sustainability of the organisation.

However, the SABS denies this, claiming that the majority of its laboratories have uptimes of 90% and higher, with about 20% of the laboratories having historically lower volumes for reasons that are being addressed.

Investigation

The cyberattack resulted in several months of media scrutiny and calls for an independent investigation into the myriad allegations of suspect practices at the bureau, which Trade, Industry and Competition Minister Parks Tau eventually agreed to in February.

The investigation is under way, and is being carried out by independent contractor TSU International – the investigative arm of international security firm TSU Protective Services – with Elsje Oosthuizen as the lead investigator. A conclusion to the investigation is expected by May 31.

However, while the investigation continues, sources allege that in-house disciplinary processes continue unabated and that the lingering impacts of the cyberattack remain a hindrance to daily operations.

Amid the ongoing investigation, several layers of staff are yet to be interviewed. However, a potentially undermining aspect of the investigation is that the executive appears to be conducting its own investigations, which is making the staff nervous, an inside source claims.

“SABS acting CEO Lizo Makete, as the person alleged to have been responsible for many of the governance and management failures at the SABS, cannot also be instituting suspensions and disciplinary proceedings against current employees at the SABS, some of whom might be making these allegations.

“This will perpetuate the culture of fear that has infected the SABS since the whistleblower allegations surfaced last August, further aggravating this untenable situation,” says Democratic Alliance Trade, Industry and Competition spokesperson Toby Chance.

In addition, two high-profile disciplinary hearings are moving ahead regarding the bureau’s former company secretary and head of security.

“I support the investigation, but I am concerned that the disciplinary processes are continuing. I am expecting [Tau] to come before the portfolio committee to provide feedback on how the investigation is progressing,” Chance tells Engineering News & Mining Weekly.

However, the SABS believes there is no conflict of interest.

“There are no investigations which overlap with the investigations being undertaken by [TSU]. When . . . TSU started, the SABS had some employees on suspension pending ongoing investigations. These have since been brought to the attention of TSU, with the reports being shared with them,” the bureau says.

Some of the suspensions and disciplinary investigations have been at board level, indicating management instability. This has resulted in repeated calls for Tau to appoint a permanent CEO and stabilise the SABS board.

It is hoped that Tau will announce a new CEO soon, as Makete’s term ended on March 31. However, all the SABS can offer in terms of progress on this front is that a new CEO will be appointed “at an appropriate time”.

Human Resources Issues

While in-house disciplinary proceedings may serve to undermine the independent investigation by muddying the waters and spreading fear, even more concerning are allegations of tax and salary mismanagement.

The payroll and human resources systems were some of the worst affected by the cyberattack. These systems are integral to processing salaries and paying taxes.

Although these systems appear to be up and running once more, the SABS allegedly had to operate these processes manually in November and December 2024, which resulted in significant under-deductions for pay-as-you-earn (PAYE) tax.

It is alleged that, to make up the shortfall in employee deductions, the SABS has made massive corrective deductions on employees’ salaries. This has meant that, in some cases, more than 75% of some employees’ net salaries has been deducted all at once, leaving some workers earning as little as R1 900 on their most recent pay cheques.

“With February 2025 being the tax year-end month, the payroll system automatically recalculated tax, resulting in adjustments to tax deductions. This system calculation is in terms of the SARS tax tables, with no manual intervention,” SABS explains.

These reasons notwithstanding, under the Income Tax Act, employers are responsible for deducting and paying PAYE tax accurately and consistently on behalf of their employees. If an employer fails to do so or does it incorrectly, it is the responsibility of the employer, not the employee, to clear the shortfall with SARS. 

Making additional deductions to make up the PAYE shortfall without the employee’s written consent is unlawful, according to the Basic Conditions of Employment Act.

To smooth over the bungle, the SABS told its staff mid-March that it would offer voluntary interest-free loans to those employees who had been affected by the huge deductions. These loans will need to be repaid to the SABS in three months.

The National Education, Health and Allied Workers’ Union has disputed these deductions and the proposed loan offer in terms of its legality and impact on those affected.

Another questionable management decision is Makete’s recent announcement that the SABS retirement policy would now change to enable personnel to retire at the age of 65.

However, last year, management had announced a restructuring and offered voluntary retrenchment to save staff costs. Most of the employees aged between 55 and 59 took this option, leading to the organisation’s haemorrhaging its most experienced staff.

According to a reliable source, many from this group would not have taken voluntary retirement if they had known the policy would change to 65 a year later, and the new policy appears to be an attempt to correct this error and attract back some of the more experienced, former staff.

“The normal retirement age at . . . State institutions is 65 years, with the early retirement age from 55 years. The SABS decision to extend the retirement age to 65 is to align to the rest of . . . government, while . . . creating space to retain critical skills,” the SABS explains to Engineering News & Mining Weekly.

However, the bureau did not clarify the timing of the decision, given that it encouraged early retirement only a year prior.

Competency Concerns

One of the major concerns regarding alleged mismanagement at the SABS – preceding the cyberattack in November – was the partial suspension by the South African National Accreditation Service (SANAS) of the bureau’s cement laboratories, which will remain in effect until April 7.

The SABS intended to notify SANAS on March 24 of its readiness for the re-instatement assessment. Upon receipt of this notification, SANAS will then indicate the date for the re-instatement assessment, which will be within three months from April 7.

In the interim, the SABS has been issuing permits without the SANAS accreditation symbol.

Engineering News & Mining Weekly reached out to the dtic for comment, but received no response.