Hosted risk management solution for bankseta – 5-Year appointment

Closing date: 10 December 2026 at 11:00

Non-compulsory virtual briefing: 20 November 2026 at 11:00

Final questions and answers emailed to BANKSETA: 26 November 2026 at 16:30

Tender evaluation, bidder verification and due diligence: 29 January 2027

Clarification presentations by service providers (if required): 11 February 2027

Provisional contract award: 19 February 2027

Contract signatures: 26 February 2027

Enquiries:

• Contact: Mr Jackie Kwinika
• Role: Specialist: Supply Chain Management Unit
• Email: [email protected]
• Copy email: [email protected]

Escalation contacts:

• Email: [email protected]
• Email: [email protected]

Submission address:

Eco Origin Office Park (use Gate 1)

Block C2

349 Witch-Hazel Avenue

Eco Park Estate

Highveld

Centurion, 0144

Submission method: physical delivery only. Fax, telex and email submissions are not accepted.

Envelope structure (each envelope clearly marked with the bid description, bid number BS/2026/RFB581 and bidder name):

• Envelope 1: Original submission, marked "Original".
• Envelope 2: One hard copy of the original plus one soft copy (preferably on a memory stick).
• Envelope 3: Pricing schedule (Annexure A), SBD 1 and the BANKSETA Preference Points Claim Document.

Delivery address:

Eco Origin Office Park (use Gate 1)

Block C2

349 Witch-Hazel Avenue

Eco Park Estate

Highveld

Centurion, 0144

Allow at least 30 minutes for security and navigation. Sign the submission register on delivery.

Returnable documents (all must be completed, signed and submitted):

• Proposal (response document) and pricing schedule – Annexure A. Failure to complete in the prescribed format leads to disqualification.
• SBD 1 (Invitation to Bid): bidder and contact details, signed as the offer cover page.
• SBD 4 (Declaration of Interest): discloses whether any director or shareholder is employed by the state or connected to anyone at BANKSETA.
• SBD 6.1 (Preference Points Claim): claims preference points under the 80/20 system; BANKSETA allocates no points for B-BBEE status level.
• BANKSETA Preference Points Claim Document.
• CSD report, or the CSD MAAA number if the report cannot be printed or provided at closing.
• Special conditions accepted by signing the last page.
• Datacentre hosting letter, contract or other proof that the proposed solution is hosted within South Africa.
• Proof that the bidder is a licensed reseller or licensed service provider of the proposed solution.
• Annexure B completed to confirm the proposed solution complies with the specification. Non-compliance leads to disqualification.
• For joint ventures: each partner must submit all listed documents plus the JV agreement.

Disqualification risks:

• Any returnable document omitted or unsigned.
• Pricing schedule not completed as per Annexure A.
• Annexure B not completed or showing non-compliance.
• Discrepancies between the original, copy and soft copy.
• Submission received after the closing time.

Evaluation is in four phases:

1. Compliance/eligibility – bids failing this stage are disqualified.
2. Technical/functionality – minimum threshold 70% (fall-back 65% if no bid reaches 70%).
3. Presentation/demonstration – minimum threshold 80% (fall-back 70% if no bid reaches 80%).
4. Price and BANKSETA preference points – highest total score wins.

Technical/functionality scoring (total 100):

• Track record of the bidder (reference letters): 35 points. Scoring: 0 letters = 0, 1 letter = 1, 2 letters = 3, 3 or more = 5.
• Experience and qualifications of personnel: 65 points.
• Team Leader: 25 points. Requires NQF Level 6 or higher qualification, project management certification (or NQF Level 6 project management qualification accepted as both), and IT project management experience. Scoring: 5+ years = 5, 3 to <5 = 3, 1 to <3 = 1, <1 = 0.
• Team Member 1 (implementation/development/enhancement): 20 points. Requires NQF Level 5 or higher and relevant experience. Scoring: 5+ years = 5, 3 to <5 = 3, 1 to <3 = 1, <1 = 0.
• Team Member 2 (support/maintenance): 20 points. Requires NQF Level 5 or higher and relevant experience. Scoring: 5+ years = 5, 3 to <5 = 3, 1 to <3 = 1, <1 = 0.

Presentation/demonstration scoring (total 100):

• Compliance Management Functionality: 20
• Risk Management Functionality: 20
• Business Continuity Functionality: 20
• Combined Assurance Functionality: 20
• Incident Management Functionality: 20

Price and preference points (80/20 system):

• Price: maximum 80 points.
• BANKSETA specific goals: maximum 20 points.
• Black person ownership (51% or more): 7 points.
• Women ownership: 4 points.
• Youth ownership (33% or more, persons 35 and below): 4 points.
• Persons with disabilities ownership (10% or more shareholding) or employment (5% or more permanent staff): 2 points.
• Small and medium businesses, co-operatives and NGOs (annual turnover up to R10 million, 100% South African owned): 3 points.

Minimum qualifying scores:

• Technical/functionality: 70% (fall-back 65%).
• Presentation/demonstration: 80% (fall-back 70%).

The BANKSETA requires a cloud-based Risk Management Solution hosted in South Africa, covering Risk, Compliance, Incident Management, Business Continuity and Combined Assurance modules.

Compliance Management:

• Use standard compliance checklists.
• Capture all applicable legislative requirements and associated compliance risks (BANKSETA provides the compliance universe).
• Alert compliance owners of compliance dates.
• Capture the BANKSETA compliance calendar.
• Provide alerts of legislative changes using external legislative databases.
• Capture the BANKSETA compliance risk register (template provided).
• Generate compliance reports and dashboards.

Risk Management:

• Central data repository for risk management.
• Complete audit trails and history of changes.
• Support strategic, operational, ethics and fraud risk registers.
• Structured risk assessment and control processes with configurable templates and workflows.
• Capture objectives, risk details, contributing factors, consequences, inherent rating, existing controls, residual rating, mitigation plans, timeframes, action owners and risk owners.
• Configurable risk appetite and tolerance information.
• Support Key Risk Indicators (KRIs) and thresholds.
• Configurable notifications, reminders and escalations for overdue or threshold-based actions.
• Dashboards, heat maps, trends and configurable risk reports.
• Compare progress status for two quarters.

Business Continuity:

• Capture business impact analysis.
• Capture business continuity test plans with timelines, allocated process owners and updating.
• Alerts, reminders and escalations for overdue continuity action plan reviews and unresolved findings.
• Generate reports and dashboards.

Combined Assurance:

• Capture and monitor combined assurance plan.
• Generate reports and dashboards.

Incident Management:

• Capture and monitor reported incidents.
• Generate reports and dashboards.

Training:

• Workshop training.
• Train 30 users in year 1.
• Train 4 system administrators in year 1.
• Additional training billed under enhancement and support hours.

Hosting, support and maintenance:

• Secured hosted solution, cloud-based and hosted in South Africa.
• Configure 30 user devices.
• Annual disaster recovery testing.
• At least 97% system availability.
• Accessible via Chrome, Edge and Safari.
• Annual license subscription for 3 years for 30 users.
• Monthly reports: risk and compliance management, system technical, system availability, system health check, user review.
• Risk register updates.
• Migrate risk management data from manual to the new system.
• All BANKSETA data remains BANKSETA property; on contract expiry or termination, provide complete, accurate and usable data handover.

The bidder must present a live system demonstration covering the modules and functionalities listed in the evaluation criteria. The presentation must be at most 2 hours, with additional time for questions. The bidder must create test transactions to demonstrate all capabilities. The system must be ready for presentation, and the bidder will be given 7 working days' written notice before the presentation.

Bids are evaluated by an Evaluation Committee and tabled before the Bid Adjudication Committee (BAC).

Bidders must not contact BANKSETA on any matter from closing until adjudication is complete; attempts to influence evaluation may result in rejection.

Reference letters:

• Provide reference letters as proof of work on implementation, development, enhancement, support or maintenance of a risk management solution or GRC solution.
• Letters must be on client letterhead, signed and dated, indicate the work done, and include client contact details (name, telephone/mobile, email).
• Scoring: 0 letters = 0 points, 1 letter = 1 point, 2 letters = 3 points, 3 or more = 5 points.

Team composition (minimum three members, one role per person):

• Team Leader: NQF Level 6 or higher qualification in any field, project management certification (or NQF Level 6 project management qualification accepted as both), and IT project management experience. Must be an employee, director or owner of the bidder. Scoring: 5+ years = 5, 3 to <5 = 3, 1 to <3 = 1, <1 = 0.
• Team Member 1: NQF Level 5 or higher qualification and experience in implementation, development or enhancement of risk management or GRC solutions. Scoring: 5+ years = 5, 3 to <5 = 3, 1 to <3 = 1, <1 = 0.
• Team Member 2: NQF Level 5 or higher qualification and experience in support or maintenance of risk management or GRC solutions. Scoring: 5+ years = 5, 3 to <5 = 3, 1 to <3 = 1, <1 = 0.

Foreign qualifications must be accompanied by a SAQA evaluation report.

Submit detailed project lists for each team member using the provided tables (Table A, Table 1, Table 2, Table 3). Failure to submit qualifications means experience will not be considered.

System availability: At least 97%.

Annual disaster recovery testing required.

Monthly reports required: system availability, system health check, user review, and risk and compliance management reports.

System must be accessible via Chrome, Edge and Safari.

Pricing format:

• Complete the pricing schedule exactly as per Annexure A. Failure to comply leads to disqualification.
• Prices remain fixed for each year indicated for the contract duration.
• No pricing adjustments after contract signature; all pricing elements must be disclosed.
• Show VAT separately.
• Provide a total bidding price.
• Include sufficient detail for BANKSETA to understand the pricing make-up.
• Document all pricing assumptions, excluded costs and estimated costs.
• BANKSETA assumes the pricing document is complete and covers all project costs.

No bid security, bonds, guarantees, retention or payment terms are stated in the document.

CSD registration:

• Must be registered on the Central Supplier Database (CSD) maintained by National Treasury.
• BANKSETA will verify on CSD that the bidder and its directors are not restricted from doing business with the public sector, that tax status is compliant, and that no director or manager is a state employee without permission to do business with the state.
• Submit a CSD report, or the CSD MAAA number if the report cannot be printed or provided at closing.

Tax status:

• Tax compliance is verified via CSD; no separate tax clearance certificate is required.

B-bbee:

• BANKSETA allocates no preference points for B-BBEE status level. Preference points are awarded only for BANKSETA specific goals (black ownership, women ownership, youth ownership, disability, small business).
• Complete the BANKSETA Preference Points Claim Document.

Licensing:

• Must be a licensed reseller or licensed service provider of the proposed solution.

Hosting:

• Must provide proof (datacentre hosting letter, contract or other) that the solution is hosted within South Africa.

Joint ventures:

• Each JV partner must submit all required documents plus the JV agreement.

False information:

• Submitting false information may lead to disqualification, cancellation of award, and reporting to National Treasury.

Evaluation is in four phases: compliance/eligibility, technical/functionality, presentation/demonstration, and price with BANKSETA preference points.

Technical/functionality minimum threshold: 70% (fall-back 65% if no bid reaches 70%).

Presentation/demonstration minimum threshold: 80% (fall-back 70% if no bid reaches 80%).

Price and preference points: 80/20 system. Price maximum 80 points; BANKSETA specific goals maximum 20 points.

Scoring formula for functionality: Pf = (So/Ms) x Ap, where Ms = 5.

Bids failing any stage are disqualified from further evaluation.