GUIDES
By InsidEntity Editorial Desk · Sep 18, 2026 · 7 min read
A practical guide for investors, suppliers, job seekers and anyone about to hand a company their money, their stock or their time.
There is no single test that proves a company is legitimate. There is a sequence of checks that, taken together, either confirm the picture the company presents or expose the gaps in it. Seven checks cover most of what matters: registration, directors, auditor, filings, trading history, regulatory record and ownership.
None of these checks require paid tools. All of them are things a registrar, a stock exchange or the company itself is required to disclose.
1. Confirm the company is actually registered
Start with the basic fact of legal existence. In South Africa, every company is registered with the Companies and Intellectual Property Commission (CIPC), which assigns a registration number in the format YYYY/NNNNNN/NN. That number should appear on the company’s invoices, letterhead and website footer. If it does not, or the number does not match a real CIPC record, stop there.
Equivalent registries exist elsewhere: Companies House in the United Kingdom, the Secretary of State’s business registry in most US states, and the relevant companies registry in most other jurisdictions. A legitimate company can always point to where it is registered and under what number.
A registered number is a floor, not a ceiling. Registration confirms the entity exists. It says nothing about whether it is well run, solvent or honestly represented, which is why the next six checks matter.
2. Check who the directors actually are
A company is its directors in a way that is easy to forget when reading a glossy about page. Check who currently sits on the board, how long they have served, and what else they are connected to.
Three things are worth verifying specifically. First, whether any director has been disqualified from serving as a director, which is a matter of public record in most jurisdictions and an immediate red flag if found. Second, how many other boards each director sits on. A director spread across many boards has less time for any one of them, and the specific case of a director serving on too many boards, generally called overboarding, is one of the clearer warning signs governance analysts look for. Third, whether the directors have any disclosed relationship to each other beyond the board, such as being family members or having overlapping business interests, since undisclosed related-party structures are where a large share of governance failures start.
InsidEntity’s own Company Risk Rating scores exactly this: board independence, director capacity and shareholder influence, built from board and appointment data rather than a company’s own description of itself. The full methodology sets out how each pillar is scored and weighted.
3. Check the auditor and how long they have held the seat
If the company is required to be audited, find out who the auditor is and how long they have held the engagement. A short answer here is fine. A long, unbroken tenure without explanation is worth a second look, because auditor independence is widely understood to erode with time, which is why rotation rules exist in multiple jurisdictions.
Two specific things carry more weight than the audit opinion itself. An auditor resignation mid-engagement, especially one announced without a stated reason, is one of the more reliable early warning signs in corporate history: several of the largest accounting scandals of the past three decades were preceded by an auditor stepping down rather than signing off. And a qualified opinion or a going-concern warning in the audit report is the auditor formally stating that they have doubts about the numbers or the company’s ability to continue operating, which is a materially different situation from a clean, unqualified opinion.
4. Read the filings, not the summary
Annual financial statements, and for listed companies the results announcements filed with the exchange, are where the real detail sits. A results summary or a press release is written to be read quickly. The filing itself is written to satisfy a legal disclosure requirement, and that difference matters.
Three things are worth checking directly in the filing rather than trusting a summary of it. Whether revenue growth is matched by actual cash generation, since revenue can be recognised before cash changes hands and a persistent gap between the two is a classic earnings-quality flag. Whether the notes to the financial statements disclose related-party transactions, and on what terms. And whether the auditor’s report is unqualified, qualified, or carries a going-concern paragraph, which is usually stated in the first or second page of the report itself.
5. Check the trading and operating history
A company’s age and operating history are easy to fabricate in marketing copy and hard to fabricate in the public record. Check how long the company has actually been trading under its current registration, whether it has a verifiable physical address rather than only a virtual office, and whether it has a consistent operating history rather than a recent name change following some other event.
For listed companies specifically, check whether results have been released on time. A pattern of late or repeatedly restated results is a documented predictor of deeper problems, not an administrative inconvenience.
6. Check the regulatory and enforcement record
Search for the company by name against the relevant regulator or exchange’s own announcement archive. In South Africa that means the Stock Exchange News Service (SENS) for listed companies, and the relevant sector regulator for regulated industries such as banking, insurance or financial services. Look specifically for enforcement action, licence suspensions, or restatements of prior results.
This step also catches a narrower but important case: companies whose name closely resembles a real, reputable company. Confirming the exact registered name and number against the regulator’s own record is the single most effective defence against this.
7. Find out who actually owns it
Ownership and control are not always the same as the name on the door. Beneficial ownership registers, where they exist, disclose the natural persons who ultimately own or control a company, which can differ substantially from what a company’s own website discloses. A structure with several layers of holding companies is not automatically a problem, but it is a reason to ask who sits at the top of it before assuming you know.
For a company with public shareholders, the shareholder register and any disclosed concentration of ownership are part of the same picture. A single shareholder holding an outsized stake, or a controlling trust with the power to remove directors without a shareholder vote, changes who a company actually answers to in practice, regardless of what its board structure suggests on paper.
Putting the seven checks together
No single check settles the question on its own. A company can be properly registered and still poorly governed. It can have a well-known auditor and still be carrying an unqualified opinion that masks a genuine going-concern risk. The seven checks are cumulative: each one closes off a different way a company’s public presentation can diverge from its actual condition, and a company that passes all seven has been tested from enough angles that the remaining risk is the ordinary risk of doing business, not a hidden one.
This is also the logic behind building a rating from several independent measures rather than one. InsidEntity’s Company Risk Rating scores director independence, director capacity, auditor independence and shareholder influence as four separate pillars precisely because a company can look strong on any one of them while carrying real weakness on another. Search a company to see the pillar-by-pillar breakdown behind any rating referenced in this guide.
Independent research. Not financial advice. No allegation of wrongdoing is made against any individual or entity named.
Know more. Risk less. Decide better.
Sources: Companies and Intellectual Property Commission (CIPC), South Africa; Johannesburg Stock Exchange Stock Exchange News Service (SENS) requirements; InsidEntity Company Risk Rating methodology.