Industry

Risk, anti-corruption and compliance software for public bodies in Zambia

Ministries, statutory agencies and parastatals in Zambia operate under the Public Procurement Act administered by the Zambia Public Procurement Authority, the Anti-Corruption Act enforced by the Anti-Corruption Commission, the Data Protection Act No. 3 of 2021 for the personal data they hold, and the Cyber Security Act 2025 for systems designated as critical information infrastructure. In practice a public body needs a procurement-risk register with vendor due diligence, conflict-of-interest and gifts declarations from staff, screening of payees before public funds are disbursed, a records-management process for public-records requests, and mandatory training that can be evidenced.

ERMAML, the Ontech Risk & Compliance Suite, covers each of those in one platform with branch-level role-based access, so a line ministry, its departments and provincial offices work in one system while each sees only its own records. Procurement risk, attestations, pre-disbursement screening, records workflows, a critical-infrastructure control register and a learning module with a role-based course matrix are all part of the same register and audit trail.

Request a Demo See the product tour

ERMAML compliance register listing obligations by regulator

Key capabilities

Procurement-risk register

Procurement risks tracked live with vendor due diligence, replacing checklist-based control.

Anti-corruption attestations

Conflict-of-interest and gifts declarations captured through mandatory attestation workflows assigned by role.

Pre-disbursement screening

Payees screened against PEP and sanctions lists before public funds are released, with hits worked as cases.

Records and public-records requests

A records-management workflow with retention policy and an audit trail for handling requests.

Critical-infrastructure controls

Cyber Security Act obligations held as a control register with quarterly attestation.

Mandatory training

A learning module with a role-based course matrix that records completion for civil-service training requirements.

Department and branch scoping

Role-based access scoped to departments and provincial offices, with consolidated views for the accounting officer.

How it works

Departments, offices and roles are configured so that each unit sees only its own records.
Vendors are loaded into the register and screened; procurement risks are entered with owners.
Staff complete conflict-of-interest attestations and assigned training on a cycle.
Payees are screened before disbursement and any hits are reviewed under maker-checker control.
Records requests and incidents are worked as cases with retention rules applied.
The accounting officer and internal audit read consolidated reports from the same register.

Benefits

Controls that are demonstrable

Attestations, screening results and training records are logged and can be produced for the Auditor General or the ACC.

Screening before money leaves

Payee screening is preventive rather than a reconciliation exercise after payment.

One system across units

Departments and provincial offices share a platform without sharing each other's data.

Records handled to policy

Retention and request workflows apply the same rules every time.

Who it is for

Ministries and government departments with procurement and disbursement functions.
Statutory agencies and parastatals subject to the Public Procurement Act.
Internal audit units and integrity committees.
ICT and records units responsible for critical infrastructure and public records.

Zambia-specific considerations

Public procurement in Zambia is regulated by the Zambia Public Procurement Authority, and the Anti-Corruption Commission enforces the Anti-Corruption Act; both expect public bodies to manage conflicts of interest and vendor integrity in a documented way. ERMAML's attestation workflows and vendor register provide that documentation as a by-product of normal work.

Public bodies hold large volumes of personal data and operate systems that may be designated critical information infrastructure. The Data Protection Act No. 3 of 2021 and the Cyber Security Act 2025 both call for evidence of controls, which the platform's encryption, retention, erasure and attestation features are designed to produce.

How ERMAML addresses this

Branch-level access for line ministries

Departments and provincial offices work in one platform with role-based access scoped to their own records and consolidated reporting for the accounting officer.

Screening before disbursement

Payees are checked against PEP and sanctions lists before funds move, and hits are reviewed under maker-checker control with a full audit trail.

Attestation and training as routine

Conflict-of-interest declarations and mandatory courses are assigned by role and recorded automatically, so integrity evidence is produced continuously rather than assembled for an audit.

Frequently asked questions

What compliance obligations apply to public bodies in Zambia?

Public procurement is governed by the Public Procurement Act through the Zambia Public Procurement Authority, integrity by the Anti-Corruption Act enforced by the Anti-Corruption Commission, personal data by the Data Protection Act No. 3 of 2021, and critical information infrastructure by the Cyber Security Act 2025. Public bodies also answer to the Auditor General and their own internal audit.

Can ERMAML screen payees before public funds are paid?

Yes. Payees are screened against PEP and sanctions lists before disbursement. Any match is held as a case for maker-checker review, and the decision and evidence are recorded in the audit trail.

How are conflict-of-interest declarations managed?

Declarations are captured through attestation workflows assigned by role and repeated on a cycle. Exceptions escalate according to risk tier, and every declaration is time-stamped in the audit chain.

Can several departments or provinces use one deployment?

Role-based access is scoped by department or office, so each unit sees only its own vendors, cases and records while the accounting officer and internal audit see consolidated views.

Where is the platform hosted?

ERMAML is hosted in Lusaka at Infratel's Tier III data centre, with in-country data residency, PII column encryption and Data Protection Act aligned retention and erasure. On-premises deployment is also available for institutions that require it.

Sources

See ERMAML on your own data

Request a demo with Ontech Solutions in Lusaka and see sanctions screening, KYC, transaction monitoring, goAML reporting and the risk register working together in one platform.