Engineering the Forensic Analysis Workbench

South Africa's public procurement system processes hundreds of billions of Rand annually. With that volume comes risk: bid rigging, fronting, tender splitting, conflicts of interest, and other irregularities that undermine the integrity of the procurement process. The challenge is not just detecting these patterns — it's doing so at scale across 47,000+ tenders and 55,000+ awards.

Tenders-SA's Forensic Analysis Workbench is the result. It provides procurement investigators, auditors, and suppliers with tools to screen suppliers, review awarding organisations, detect suspicious patterns, and generate AI-assisted case narratives — all from public award data.

Architecture: The Signal Stack

The forensic engine is organized into eight signal families, each covering a distinct category of procurement risk:

• Family A — Competition Signals: Market concentration (HHI), single-bidder rate, threshold proximity, bid splitting
• Family B — Price Signals: Pricing anomalies, cost deviations, margin analysis
• Family C — Process Signals: New entrant speed to award, repeat winner dependency, incomplete procurement cycles
• Family D — Entity Network: Multi-company directorships, address clusters, dormant company activation, post-award director resignations
• Family E — Integrity: OCPO restricted supplier status, World Bank debarment, deregistered entities
• Family F — Structural: Top-5 supplier share, procurement health scores, category dominance
• Family G — SA Legislative: PFMA threshold compliance, CIDB grading mismatches, Competition Act cartel indicators, SARS tax compliance signals
• Family H — Platform Integrity: Manual override detection, source-content tampering, canonicalization collisions

Each indicator is computed from the award data and mapped to a 4-band verdict: Clear, Watch, Elevated, or High Concern.

The Interpretation Layer

Raw forensic signals — like "HHI: 2,450" or "single_bidder_rate: 0.38" — are meaningless to most users. The interpretation layer translates every signal into a plain-English verdict with context:

Copy
1export type ForensicBand = 'clear' | 'watch' | 'elevated' | 'high_concern';
2
3export type ForensicSignalKey =
4  | 'composite_risk' | 'hhi' | 'single_bidder_rate' | 'threshold_proximity'
5  | 'bid_splitting' | 'new_entrant_speed' | 'repeat_winner_dependency'
6  | 'top5_share' | 'procurement_health' | 'ocpo_restriction'
7  | 'deregistered_entity' | 'poor_compliance' | 'disqualified_director'
8  | 'multi_company_director' | 'address_cluster' | 'dormant_activation'
9  | 'post_award_resignation';
10
11// Each signal has: meaning, whyItMatters, and normalAnchor thresholds
12export const SIGNAL_EXPLAINERS: Record<ForensicSignalKey, SignalExplainer> = {
13    hhi: {
14        label: 'Market Concentration',
15        meaning: 'Measures how concentrated the supplier market is for this category.',
16// ... (truncated)
Show More (19 more lines)
TYPESCRIPT

Each numeric signal has its own band-threshold logic. For example, the HHI (Herfindahl-Hirschman Index) uses standard Department of Justice thresholds: under 1,000 is competitive, 1,000–1,500 is moderately concentrated, 1,500–2,500 is concentrated, and over 2,500 is highly concentrated. The single-bidder rate uses a custom threshold calibrated against South African procurement data.

Score Breakdown and Drill-Down

Every supplier showing a risk band can expand to see the named contributors behind the score. Each contributor is tagged with its source: procurement-native (derived from award data), legislative (from SA laws and regulations), OCPO (from the restricted supplier list), or CIPC-bonus (from company registry data). This transparency lets investigators focus on the signals that matter most.

The Workbench UX

The workbench evolved significantly over several releases. The first version (July 2026) was a simple search that returned supplier and awarding organization pages. Subsequent releases added:

1. Searchable workbench — Browse suppliers and awarding organisations before opening a detailed risk page, with result rows showing award count, total value, and risk signals at a glance.
2. Entity comparison — Select 2–5 suppliers or organisations and compare award metrics side-by-side.
3. Buyer-supplier pair scans — Investigate the relationship between a specific buyer and supplier with linked awards, values, bidder counts, and OCPO context.
4. Evidence timeline — Awards, contract context, threshold signals, OCPO status, and procurement intelligence ordered by date.
5. CSV export — Export workbench results for offline analysis.
6. Pagination and interpretation — Full pagination with configurable page sizes, and every signal carries a 4-band verdict with plain-English meaning.

OCPO Restricted Supplier Cross-Referencing

A key feature is the integration with the OCPO (Online Central Procurement Organisation) restricted supplier database, synced daily from National Treasury. We cross-reference these restricted entries against the CIPC company registry to identify restricted suppliers even when the name format differs. When a restricted supplier appears on an award, we flag it with a red badge and surface the restriction details.

We also integrate the World Bank debarment list (refreshed weekly) for companies that operate in or bid on South African projects. The unified restricted-supplier status appears as a banner on every company profile — red for active restrictions, amber for expired, green for clean.

Performance Optimizations

The forensic analysis pages were among our most performance-sensitive routes. Several optimizations were required: the distinct-company count query was running a full GROUP BY without LIMIT across the entire awards table — replaced with SELECT DISTINCT; the related-companies widget was calling the full search pipeline instead of a lightweight lookup; CIPC enrichment count queries were running per-forensic-flag (5–6 times per page) instead of once; and we introduced debounced search that waits for users to finish typing before refreshing results.

Access Control and Tiers

Copy
1export const FORENSIC_CAPABILITIES = [
2    'fullRows', 'advancedFilters', 'compareEntities', 'pairScan',
3    'aiNarrative', 'exportEvidence', 'saveCase', 'monitoring',
4    'evidenceTimeline', 'restrictionPeriodAudit', 'buyerSearch',
5] as const;
6
7export function buildForensicCapabilities(
8    enabled: boolean,
9    proPlus: boolean
10): Record<ForensicCapability, boolean> {
11    const PRO_PLUS_FORENSIC_CAPABILITIES: ForensicCapability[] = [
12        'aiNarrative', 'monitoring', 'evidenceTimeline'
13    ];
14    return Object.fromEntries(
15        FORENSIC_CAPABILITIES.map(c => [
16// ... (truncated)
Show More (5 more lines)
TYPESCRIPT

Forensic features are tiered: AI case narratives, monitoring, and evidence timelines require Professional or Enterprise subscriptions. Basic search, result browsing, and signal display are available to all users. This ensures that procurement oversight tools remain accessible while advanced features are available for professional investigators.

What's Next

The forensic workbench continues to grow. We're building automated monitoring that alerts subscribers when a supplier they track triggers new risk signals, expanding the indicator set with machine learning-based anomaly detection, and developing a case management system that lets investigators group related findings into dossiers.