Industry

Risk and compliance software for energy companies in Zambia

Energy undertakings in Zambia are licensed by the Energy Regulation Board (ERB) and submit periodic returns and tariff filings; their projects and operations are subject to environmental regulation administered by ZEMA, with impact assessments and licence conditions that need current evidence. As large procurers they also carry supplier due diligence and anti-corruption obligations under the Anti-Corruption Act, and their control systems are candidates for critical information infrastructure designation under the Cyber Security Act 2025.

ERMAML, the Ontech Risk & Compliance Suite, holds those obligations in one register: ERB return layouts with a submission calendar, a ZEMA evidence vault with versioning and renewal alerts, a vendor register with continuous sanctions and adverse-media screening of suppliers, a unified incident register linked to risk and control self-assessment, conflict-of-interest attestation workflows, and a critical-infrastructure control register with quarterly attestation.

Request a Demo See the product tour

Key capabilities

ERB returns and tariff filings

Return layouts aggregated from operational and financial data with a submission calendar, so filings are not rebuilt each quarter.

ZEMA evidence vault

Environmental impact assessment documents and licence-condition evidence kept with versions and renewal alerts.

Supplier due diligence

A vendor register with due diligence evidence and continuous screening of suppliers against sanctions and adverse media.

Operational risk and incidents

Outages and safety incidents recorded in one incident register and linked to the controls tested in RCSA.

Anti-corruption controls

Conflict-of-interest and gifts declarations captured through attestation workflows with risk-tier escalation.

Operational technology cyber risk

Cyber Security Act obligations for control systems held as a critical-infrastructure register with quarterly attestation.

How it works

Regulatory obligations to the ERB and ZEMA are entered into the compliance register with their filing calendar.
Existing suppliers are loaded into the vendor register and screened.
Operational incidents are logged as they occur and linked to the controls and risks involved.
Staff complete conflict-of-interest attestations on a cycle, with exceptions escalated by risk tier.
Critical-infrastructure controls are attested quarterly and evidence attached.
Returns, board risk reports and audit packs are produced from the same register.

Benefits

Filings on a calendar, not from memory

The compliance register tracks what is due to the ERB and ZEMA and who owns it.

Environmental evidence that is findable

Versioned documents with renewal alerts replace folders that go stale between audits.

Suppliers screened continuously

Sanctions and adverse-media checks run on the vendor register rather than once at onboarding.

Incidents linked to controls

Cause analysis connects outages to failed controls, which keeps board attention on the fix.

Who it is for

Generation, transmission, distribution and fuel companies licensed by the ERB.
Compliance and environmental teams responsible for ZEMA conditions.
Procurement and internal audit functions managing supplier and corruption risk.
Operational technology and cyber security teams.

Zambia-specific considerations

The Energy Regulation Board licenses energy undertakings and receives their returns and tariff filings, while ZEMA administers environmental assessment and licensing. Keeping both sets of obligations, their evidence and their calendars in one compliance register is the practical difference between audit-ready and scrambling.

The Anti-Corruption Commission enforces the Anti-Corruption Act, and large procurers are expected to manage conflicts of interest and supplier integrity. ERMAML's attestation workflows and vendor screening give an energy company a documented, repeatable process for both.

How ERMAML addresses this

Regulatory calendar for the ERB and ZEMA

Obligations, owners and due dates for both regulators sit in the compliance register with SLA alerts before a filing falls due.

Supplier integrity in the vendor register

Suppliers are screened against sanctions and adverse media continuously, and due diligence evidence and contracts are kept with the record.

Incident-to-control linkage

Every outage or safety incident is tied to the controls it exposed, feeding the next RCSA cycle and the board's risk report.

Frequently asked questions

Which regulators does an energy company in Zambia report to?

The Energy Regulation Board licenses energy undertakings and receives returns and tariff filings; ZEMA administers environmental assessment and licensing; the Zambia Public Procurement Authority and the Anti-Corruption Commission apply where procurement and public funds are involved. Companies should confirm current requirements with each regulator.

How does ERMAML manage ZEMA evidence?

Environmental impact assessment documents and licence-condition evidence are stored in a versioned vault with renewal alerts, linked to the obligations in the compliance register, so the current version is always the one an inspector sees.

Can it screen suppliers?

Yes. Suppliers in the vendor register are screened against sanctions lists and adverse media on a continuing basis, and due diligence evidence, risk score and contracts are held with each record.

Does it handle conflict-of-interest declarations?

Conflict-of-interest and gifts declarations are captured through attestation workflows assigned by role, with exceptions escalated according to risk tier and an audit trail of every declaration.

Is it relevant to operational technology security?

Obligations under the Cyber Security Act for critical information infrastructure, including control systems, are held as a control register with owners, evidence and quarterly attestation, and incidents are linked back to those controls.

Sources

See ERMAML on your own data

Request a demo with Ontech Solutions in Lusaka and see sanctions screening, KYC, transaction monitoring, goAML reporting and the risk register working together in one platform.