Engineering the Forensic Analysis Workbench

South Africa's public procurement system processes hundreds of billions of Rand annually. With that volume comes risk: bid rigging, fronting, tender splitting, conflicts of interest, and other irregularities that undermine the integrity of the procurement process. The challenge is not just detecting these patterns — it's doing so at scale across 47,000+ tenders and 55,000+ awards.

Tenders-SA's Forensic Analysis Workbench is the result. It provides procurement investigators, auditors, and suppliers with tools to screen suppliers, review awarding organisations, detect suspicious patterns, and generate AI-assisted case narratives — all from public award data.

The people who use the workbench are not always investigators in a formal sense. A small contractor deciding whether to enter a new category might run a quick check on the awarding organisation to see whether the same three suppliers have won every contract in that category for the past two years — a pattern that, while not proof of wrongdoing, tells a realistic bidder something important about how competitive the category actually is before they invest weeks preparing a bid. A supplier considering a joint venture partner might check that partner's award history for restriction flags before committing to anything in writing. And a genuine procurement investigator or journalist might use the same tools to build an evidence trail across dozens of related awards. The workbench is built to serve all three audiences from the same underlying signal stack, with access tiered by depth rather than by which audience you belong to.

Architecture: The Signal Stack

The forensic engine is organized into eight signal families, each covering a distinct category of procurement risk:

• Family A — Competition Signals: Market concentration (HHI), single-bidder rate, threshold proximity, bid splitting
• Family B — Price Signals: Pricing anomalies, cost deviations, margin analysis
• Family C — Process Signals: New entrant speed to award, repeat winner dependency, incomplete procurement cycles
• Family D — Entity Network: Multi-company directorships, address clusters, dormant company activation, post-award director resignations
• Family E — Integrity: OCPO restricted supplier status, World Bank debarment, deregistered entities
• Family F — Structural: Top-5 supplier share, procurement health scores, category dominance
• Family G — SA Legislative: PFMA threshold compliance, CIDB grading mismatches, Competition Act cartel indicators, SARS tax compliance signals
• Family H — Platform Integrity: Manual override detection, source-content tampering, canonicalization collisions

Each indicator is computed from the award data and mapped to a 4-band verdict: Clear, Watch, Elevated, or High Concern.

It is worth being explicit about what this signal stack is not. None of the eight families produce a legal finding of fraud, collusion, or corruption — they produce statistical indicators computed from public award data that correlate with known risk patterns in procurement research. A high single-bidder rate in a category might reflect genuine barriers to entry rather than collusion; a repeat winner might simply be the only qualified supplier in a niche technical category in a remote province. The forensic engine is deliberately conservative in how it labels findings, favouring words like "Elevated" and "Watch" over anything that implies certainty, because the entire point of the tool is to direct a human investigator's attention efficiently, not to replace their judgement.

The Interpretation Layer

Raw forensic signals — like "HHI: 2,450" or "single_bidder_rate: 0.38" — are meaningless to most users. The interpretation layer translates every signal into a plain-English verdict with context:

Copy
1export type ForensicBand = 'clear' | 'watch' | 'elevated' | 'high_concern';
2
3export type ForensicSignalKey =
4  | 'composite_risk' | 'hhi' | 'single_bidder_rate' | 'threshold_proximity'
5  | 'bid_splitting' | 'new_entrant_speed' | 'repeat_winner_dependency'
6  | 'top5_share' | 'procurement_health' | 'ocpo_restriction'
7  | 'deregistered_entity' | 'poor_compliance' | 'disqualified_director'
8  | 'multi_company_director' | 'address_cluster' | 'dormant_activation'
9  | 'post_award_resignation';
10
11// Each signal has: meaning, whyItMatters, and normalAnchor thresholds
12export const SIGNAL_EXPLAINERS: Record<ForensicSignalKey, SignalExplainer> = {
13    hhi: {
14        label: 'Market Concentration',
15        meaning: 'Measures how concentrated the supplier market is for this category.',
16// ... (truncated)
Show More (19 more lines)
TYPESCRIPT

Each numeric signal has its own band-threshold logic. For example, the HHI (Herfindahl-Hirschman Index) uses standard Department of Justice thresholds: under 1,000 is competitive, 1,000–1,500 is moderately concentrated, 1,500–2,500 is concentrated, and over 2,500 is highly concentrated. The single-bidder rate uses a custom threshold calibrated against South African procurement data.

Score Breakdown and Drill-Down

Every supplier showing a risk band can expand to see the named contributors behind the score. Each contributor is tagged with its source: procurement-native (derived from award data), legislative (from SA laws and regulations), OCPO (from the restricted supplier list), or CIPC-bonus (from company registry data). This transparency lets investigators focus on the signals that matter most.

The Workbench UX

The workbench evolved significantly over several releases. The first version (July 2026) was a simple search that returned supplier and awarding organization pages. Subsequent releases added:

1. Searchable workbench — Browse suppliers and awarding organisations before opening a detailed risk page, with result rows showing award count, total value, and risk signals at a glance.
2. Entity comparison — Select 2–5 suppliers or organisations and compare award metrics side-by-side.
3. Buyer-supplier pair scans — Investigate the relationship between a specific buyer and supplier with linked awards, values, bidder counts, and OCPO context.
4. Evidence timeline — Awards, contract context, threshold signals, OCPO status, and procurement intelligence ordered by date.
5. CSV export — Export workbench results for offline analysis.
6. Pagination and interpretation — Full pagination with configurable page sizes, and every signal carries a 4-band verdict with plain-English meaning.

OCPO Restricted Supplier Cross-Referencing

A key feature is the integration with the OCPO (Online Central Procurement Organisation) restricted supplier database, synced daily from National Treasury. We cross-reference these restricted entries against the CIPC company registry to identify restricted suppliers even when the name format differs. When a restricted supplier appears on an award, we flag it with a red badge and surface the restriction details.

We also integrate the World Bank debarment list (refreshed weekly) for companies that operate in or bid on South African projects. The unified restricted-supplier status appears as a banner on every company profile — red for active restrictions, amber for expired, green for clean.

Performance Optimizations

The forensic analysis pages were among our most performance-sensitive routes. Several optimizations were required: the distinct-company count query was running a full GROUP BY without LIMIT across the entire awards table — replaced with SELECT DISTINCT; the related-companies widget was calling the full search pipeline instead of a lightweight lookup; CIPC enrichment count queries were running per-forensic-flag (5–6 times per page) instead of once; and we introduced debounced search that waits for users to finish typing before refreshing results.

Access Control and Tiers

Copy
1export const FORENSIC_CAPABILITIES = [
2    'fullRows', 'advancedFilters', 'compareEntities', 'pairScan',
3    'aiNarrative', 'exportEvidence', 'saveCase', 'monitoring',
4    'evidenceTimeline', 'restrictionPeriodAudit', 'buyerSearch',
5] as const;
6
7export function buildForensicCapabilities(
8    enabled: boolean,
9    proPlus: boolean
10): Record<ForensicCapability, boolean> {
11    const PRO_PLUS_FORENSIC_CAPABILITIES: ForensicCapability[] = [
12        'aiNarrative', 'monitoring', 'evidenceTimeline'
13    ];
14    return Object.fromEntries(
15        FORENSIC_CAPABILITIES.map(c => [
16// ... (truncated)
Show More (5 more lines)
TYPESCRIPT

Forensic features are tiered: AI case narratives, monitoring, and evidence timelines require Professional or Enterprise subscriptions. Basic search, result browsing, and signal display are available to all users. This ensures that procurement oversight tools remain accessible while advanced features are available for professional investigators.

What's Next

The forensic workbench continues to grow. We're building automated monitoring that alerts subscribers when a supplier they track triggers new risk signals, expanding the indicator set with machine learning-based anomaly detection, and developing a case management system that lets investigators group related findings into dossiers.

Reading a Forensic Result Responsibly

For a supplier or small-business user encountering the workbench for the first time, the most useful habit is to always drill into the score breakdown rather than reacting to the headline band alone. A supplier flagged "Watch" because of a single elevated signal in Family C (process signals, like new-entrant speed to award) is in a very different position from one flagged "Watch" because of a Family E integrity signal tied to an active OCPO restriction — the first might simply reflect a genuinely fast, well-run procurement process, while the second is a hard fact about legal standing that should change how you engage with that entity entirely. The drill-down view exists precisely so that the headline band never has to be taken at face value; every contributor is tagged with its source family so you can judge for yourself how much weight a given signal deserves in your specific situation.

This also shapes how the workbench should be used before entering a competitive bid. Checking the awarding organisation's procurement health score and the category's market concentration (HHI) ahead of time gives a realistic sense of how open the category actually is, which is far more useful for deciding where to invest limited bid-preparation time than simply checking whether a tender exists. A category with a persistently low HHI and a healthy spread of winners is one where genuine competition on price and quality determines outcomes; a category dominated by one or two suppliers for years running is one where a new entrant needs a clear differentiator — better pricing, a compliance advantage, or a JV that closes a specific capability gap — to have a realistic shot.