WhatsApp starts charging in October, SARS wants to replace the VAT return, and your staff's browser quietly became the place your company data actually lives. Plus a twenty-minute test worth running.

Replying to customers on WhatsApp starts costing money on 1 October. This hits the WhatsApp Business Platform API, not the free WhatsApp Business app on a phone, so it lands on anyone running customer messaging through a provider. Meta has not published rates and has said it will on 1 September. What you pay is set by how many messages it takes to resolve a job, which is a systems question before it is a pricing one. (TechCentral)

SARS wants comment on replacing the VAT return, and the deadline is 16 October. The proposal is e-invoicing that pre-fills your return rather than you filing one. Four outlets covered it and none printed the closing date; the media release on sars.gov.za dated 17 August gives 16 October 2026. Nothing is mandatory yet, and the reported full rollout near 2033 still rests on a single source. (sars.gov.za)

A court confirmed SARS can reopen an assessment older than three years. Three years is the normal limit under section 99(1)(a) of the Tax Administration Act. The exception applied here requires SARS to show fraud, misrepresentation or non-disclosure of a material fact. It is not a general power to reopen anything, but your records need to outlast the filing deadline by a wide margin. (CSARS v Meiring Citrus, Western Cape High Court, 26 June 2026)

Electricity pricing policy was due to be gazetted today. The revised policy would require NERSA to publish a ten-year price forecast and would unbundle tariffs so the components are visible. Municipal bad debt, currently between 1% and 2.5% of what you pay, may stop being recovered through the tariff. A ten-year forecast is only useful if you know what power costs you per site. (Miningmx, SAnews)

Inflation slowed to 4.3% in July, the first decline in five months. Down from 5.0% in June, with monthly growth at 0.2% against 0.7%. Analysts read it as strengthening the case for the Reserve Bank to hold rates through the rest of 2026. If you have been deferring a financing decision on the assumption of another hike, that assumption is weaker this week than last. (TechCentral, News24)

Your staff's browser is now the main place company data lives. As more work happens inside web applications, the browser sits between your people, their logins and your data. The argument is that browser policy, extensions, work profiles and session controls now belong in the same conversation as laptops and antivirus, instead of being left unmanaged. For most South African small businesses the browser is currently managed by nobody. (TLDR IT)

Microsoft is consolidating Copilot into a single app. Consumer and Microsoft 365 Copilot began merging on 18 August ahead of a wider overhaul this quarter. Work and personal identities stay separated through Microsoft and Entra accounts, and tenant controls hold. Worth knowing before a staff member signs into a personal account on a work machine and starts pasting client data into it. (TLDR IT)

France's tax authority confirmed a breach affecting more than two million taxpayers. Stolen credentials and a bypassed multi-factor prompt, discovered during a June audit. In the same week a US lender disclosed a third-party cloud breach exposing 1.2 million people, including bank details and government IDs. Both were third-party or credential failures rather than clever attacks, and both are the shape POPIA would treat as a reportable incident here. (TLDR InfoSec)

Software spend is being treated as a procurement problem, not an IT one. Vertice and RSM launched an alliance aimed at midmarket companies, pooling procurement data across more than $75 billion of software and cloud spend to move buying away from reactive renewal negotiations. The underlying observation applies at any size: nobody renegotiates a renewal they forgot was coming. (TLDR IT)

A GitHub outage took down more than code. Monday's outage disrupted repositories, APIs, automated build pipelines, Copilot and enterprise sign-in. The lesson is not about GitHub. It is that single-sign-on turns one supplier's bad afternoon into your staff being unable to log into things that have nothing to do with that supplier. (TLDR IT)

What shipped. Nothing, in the sense of a product. What changed is where the risk sits. Ten years ago your company data was on a server in a back room and the thing you protected was the building and the laptops. Today it is in a payroll web app, an accounting web app, a shared drive and a CRM, and the single thing standing between all of them and the outside world is a browser session on somebody's personal Chrome profile.

What it costs. Nothing to fix badly and nothing to fix well, which is unusual. Browser profile separation, forced sign-out, and control over which extensions can be installed are already included in the Microsoft or Google licences most businesses are paying for. The cost is somebody's afternoon, not a purchase order.

What it means for forty staff here. It means the highest-risk device in your business is probably a personal laptop with a browser signed into both a personal Gmail and your accounting package, with six extensions nobody has ever looked at. It also means an ex-employee's access does not end when you take the laptop back, because the session lives in an account you do not control.

What blocks it locally. Two things. Load shedding pushed a lot of South African businesses onto personal devices and phone hotspots as a matter of survival, and that habit stuck. And most companies under fifty people have no IT function at all, so there is nobody whose job it is to notice that browser management is now a thing that exists.

What to do about it. Not a project. Make work accounts a separate browser profile from personal ones, so signing out of one does not depend on remembering the other. Turn on the extension allow-list you already have. And write down which web applications hold client or staff data, because you cannot secure a list you have never made.

1. Pick three payments. From last month, to suppliers, over R20 000. Take a routine one, a large one, and one from a supplier you use often. Not the tidy ones.

2. Find the order. The purchase order, or whatever authorised the spend. An email counts if that is genuinely how it works.

3. Find proof it arrived. Delivery note, signed slip, goods received note. Something recorded at the time, by a person, saying the goods were physically there.

4. Find the invoice you paid. The one the payment actually went against, not the statement.

5. Line them up and check three things. Do the quantities agree. Does a reference number run through all three so you can get from invoice back to order without asking anyone. Can you tell who recorded receipt, and when.

6. Time it. Under twenty minutes for all three, and agreeing, means your controls work. Longer than that, or a missing delivery note, or quantities that differ and nobody noticed, is the same exposure at a size you can still fix.

If it failed, what to change. Capture receipt once, when it happens, against the order, by someone who can see what was ordered while they count what arrived. A phone at the gate does this. So does a printed order, provided whoever keys it afterwards keys it against that order number instead of typing a fresh entry.

Split who changes bank details from who releases payment. In most small businesses that is one person, and it is the single control that stops a supplier-payment redirection. If you only have one finance person, the second approval is a call to a number you already had on file, never the number on the new invoice.

Measure your quote-to-cash gap with ten jobs. Take the last ten jobs you finished. Write the date the work was done and the date the invoice went out, and average the difference. Six days on a business invoicing R2 million a month is roughly R400 000 permanently out of reach.

Keep records for the reopening window, not the filing window. Most businesses keep five years from filing. If an assessment can be reopened beyond three years where non-disclosure is alleged, the records proving you disclosed properly are the ones that need to still be findable.

Put a renewal date in the calendar the day you sign. Every software subscription, with a reminder six weeks out. Nobody renegotiates a renewal they forgot was coming, which is precisely why auto-renew pricing works the way it does.

Re-quote anything with storage in it. Enterprise SSD pricing sits about 6.5 times above where it was in the third quarter of 2025 and rose again in July. A quote from earlier this year is not a basis for a decision.