Internal audit services for the council for medical schemes, three-year contract (CMS032026/2027)

Compulsory briefing session (hybrid)

• Date: 13 November 2026 at 11:00.
• Venue: Block A, Eco Glades 2 Office Park, 420 Witch-Hazel Avenue, Eco Park, Centurion, 0157, or online.
• RSVP by 12 November 2026 to [email protected].
• Join 30 minutes before the start.
• Non-attendance is automatic disqualification.

Clarification questions

• Deadline: 25 November 2026.

Closing

• Date: 30 November 2026 at 11:00.

Document issue

• Tender documents available from 06 November 2026 on the CMS website and eTender portal.

Bid validity

• 120 calendar days from the closing date.

Tender enquiries

• Name: Mr Ludwe Madayi
• Email: [email protected]

Technical questions

• Name: Ms Nodolly Ndhlovu
• Email: [email protected]

Supply chain management enquiries

• Email: [email protected]

Briefing RSVP

• Email: [email protected]

Submission address

CMS Tender Box

Block A, Eco Glades 2 Office Park

420 Witch-Hazel Avenue

Eco Park

Centurion, 0157

Briefing venue

Block A, Eco Glades 2 Office Park

420 Witch-Hazel Avenue

Eco Park

Centurion, 0157

Submission method

• Hard-copy delivery only. Faxed and emailed bids will be rejected.
• Deliver to the CMS Tender Box, Block A, Eco Glades 2 Office Park, 420 Witch-Hazel Avenue, Eco Park, Centurion, 0157.
• Late bids are not accepted and are returned to the bidder.

Copies and packaging

• One signed original, two additional hard copies and a USB copy.
• Initial every page of the original bid and every additional submission.
• Seal the package and mark the outside with the RFP number.
• Place the pricing schedule in a separate sealed envelope marked "Envelope 2 – Pricing Proposal"; pricing must not appear anywhere else in the proposal or on the cover.

Proposal structure

• Envelope 1 (technical proposal): company-letterhead cover page showing company name, RFP number and bid description; table of contents; executive summary; Annexures A to H.

Returnable documents

• SBD 1 (Invitation to Bid, Annexure A): signed offer cover page.
• Proof of authority for the signatory, such as a company resolution (Annexure B).
• SBD 4 (Declaration of Interest, Annexure C): discloses state employment or connections to CMS officials.
• Mandatory evaluation documents (Annexure D).
• Technical/functional evaluation evidence (Annexure E).
• SBD 6.1 (Preference Points Claim, Annexure F) with the supporting ownership and B-BBEE proof.
• Proposal Adherence Checklist (Annexure G).
• SBD 3.3 pricing schedule and pricing template (Annexure H), in the separate sealed envelope.
• Subcontractor Identification form where subcontractors are used.
• CSD registration confirmation.
• SARS tax compliance status PIN or printed TCS certificate.
• Annexure K disclosure of relationships with any CMS-regulated entity.

Disqualification risks

• Bid received after the closing time.
• Any returnable form or annexure missing or unsigned.
• Pricing disclosed outside the sealed pricing envelope.
• Failure to attend the compulsory briefing session.

Evaluation runs in four phases; a bid must pass each phase to reach the next.

Phase 1 — Administrative

• All Section 4 and Section 5 documents submitted, completed and signed.
• Failure may disqualify the bid.

Phase 2 — Mandatory (pass/fail; any failure is automatic disqualification)

• At least two testimony letters for internal audit services delivered to public-sector clients, each issued within five years of the closing date, on the client's letterhead, showing the client's website, organisation name, contact person and contact details.
• Valid professional registration certificates or letters of good standing, valid on the closing date: Engagement Leader/Director — CA (SA) or CIA; Senior Audit Manager/Audit Manager — SAICA, SAIGA or IIA; Senior Auditor — SAICA, SAIGA or IIA; ICT Auditor — ISACA certificate.
• Attendance of the compulsory briefing session.
• Submission in the CMS Tender Box on or before the closing date and time.
• Audited financial statements for the past three years.

Phase 3 — Technical/functional (100 points; minimum qualifying score 75/100)

• Approach and methodology: 40 points, split 10 each for risk-based internal audit methodology including fraud risk assessment, ICT audit methodology, performance audit methodology, and internal financial controls including review of annual financial statements.
• Quality assurance reviews: 15 points. Two or more IIA-accredited independent external quality assurance certificates or letters with positive outcomes issued in the last ten years score 15; one scores 8; none scores 0.
• Experience and qualifications of the proposed team: 45 points.
• Engagement Leader internal audit experience: above 10 years 15; 8–10 years 10; 5–7 years 5; below 4 years 11 months 0.
• Senior Audit Manager/Audit Manager qualification: CIA 5; honours or postgraduate diploma in internal audit, finance or audit (NQF 8 or above) 3; degree, B-Tech or advanced diploma (NQF 7) 1; National Diploma (NQF 6) 0.
• Senior Audit Manager/Audit Manager experience: above 10 years 5; 6–9 years 3; 4–5 years 1; below 4 years 0.
• Senior Auditor qualification: honours or postgraduate diploma (NQF 8 or above) 5; degree, B-Tech or advanced diploma (NQF 7) 3; National Diploma (NQF 6) 1; matric (NQF 5) 0.
• Senior Auditor experience: above 10 years 5; 4–9 years 3; 2–3 years 1; below 2 years 0.
• Senior ICT Auditor ICT audit experience: 10 years and above 10; 6–9 years 7; 4–5 years 4; below 4 years 0.
• All qualifications must be certified copies not older than six months as at the submission date; older or uncertified copies attract scoring penalties.

Phase 4 — Price and specific goals (100 points)

• Price: 80 points.
• Specific goals: 20 points.
• Black ownership: 80–100% 5; 50–79.99% 4; 20–49.99% 3; 1–19.99% 1; below 1% 0.
• Company size: EME 3; QSE 2; Generic 1.
• Black women ownership: 75–100% 5; 51–74.99% 3; 1–50.99% 1; below 1% 0.
• Ownership by people with disabilities: 75–100% 3; 51–74.99% 2; 1–50.99% 1; below 1% 0.
• Youth ownership (under 35): 75–100% 4; 51–74.99% 3; 20–50.99% 2; 1–19.99% 1; below 1% 0.
• Only bidders who complete and sign SBD 6.1 are considered for preference points.
• CMS may require a bidder to substantiate any preference claim before adjudication.

Purpose

• Outsource the CMS internal audit function to a firm with specialist audit expertise, in line with Treasury Regulation 3.2.4.
• Contract period: three years, reviewed annually and monitored under SCM requirements.
• The function reports administratively to the Accounting Officer and functionally to the Audit and Risk Committee (ARC).

Knowledge expected

• Public Finance Management Act and National Treasury Regulations.
• Medical Schemes Act and its Regulations.
• Financial services and medical schemes industries and the regulatory environment.

Planning deliverables (prepared with management and the ARC, approved by the ARC)

• Rolling three-year strategic internal audit plan based on key CMS risks.
• Annual internal audit plan.
• Audit charter and audit strategy.
• Annual combined assurance plan.
• Per-audit scope, cost and timeline plans.
• Quarterly audit reports to the ARC on progress against the annual plan.

Audit coverage

• ICT systems, cybersecurity and data integrity reviews.
• Special assignments and investigations for the ARC or CEO.
• Fraud-detection audits.
• Financial control, procurement and SCM process reviews.
• Real-time probity reviews on tenders.
• Contract management, stakeholder management and compliance reviews.
• Performance information reviews.
• Review of annual financial statements against accounting standards.
• Follow-up on audit findings, project readiness reviews and business process reviews.

Operating requirements

• Provide independent assurance, advice, insight and foresight to the Board and Council.
• Evaluate controls over information systems, risk management, financial and operational information reliability, operational effectiveness, asset safeguarding and legal compliance.
• Report serious control defects or fraud immediately to the CEO and/or ARC only.
• Coordinate with internal and external assurance providers to avoid duplication.
• Meet the external auditors at least twice a year or as the ARC directs, and share plans, documentation, management letters and risk information.
• Perform work in accordance with the Global Internal Audit Standards.
• Maintain a professional team with the knowledge, skills, experience and certifications required by the audit charter, and ensure staff continuity.
• Replace team members only with people of equivalent qualification and experience.
• Disclose all relationships with CMS-regulated entities in Annexure K.

Team requirements

• Engagement Leader/Director: CA (SA) or CIA.
• Senior Audit Manager/Audit Manager: SAICA, SAIGA or IIA registration.
• Senior Auditor: SAICA, SAIGA or IIA registration.
• ICT Auditor: ISACA certificate.
• All core team members registered with the professional body regulating their services.

The internal audit function must give CMS independent, objective assurance, advice, insight and foresight, using a systematic, disciplined approach to evaluate and improve governance, risk management and control processes.

Approach and methodology (40 points)

• Risk-based internal audit methodology including fraud risk assessment: 10 points.
• ICT audit methodology: 10 points.
• Performance audit methodology: 10 points.
• Internal financial controls, including review of annual financial statements: 10 points.

Bidders must show an in-depth understanding of each audit type used by the CMS internal audit function.

Team experience and qualifications carry 45 of the 100 technical points.

Engagement Leader internal audit experience (15 points)

• Above 10 years: 15
• 8–10 years: 10
• 5–7 years: 5
• Below 4 years 11 months: 0

Senior Audit Manager/Audit Manager qualification (5 points)

• Cia: 5
• Honours or postgraduate diploma in internal audit, finance or audit (NQF 8 or above): 3
• Degree, B-Tech or advanced diploma (NQF 7): 1
• National Diploma (NQF 6): 0

Senior Audit Manager/Audit Manager experience (5 points)

• Above 10 years: 5
• 6–9 years: 3
• 4–5 years: 1
• Below 4 years: 0

Senior Auditor qualification (5 points)

• Honours or postgraduate diploma (NQF 8 or above): 5
• Degree, B-Tech or advanced diploma (NQF 7): 3
• National Diploma (NQF 6): 1
• Matric (NQF 5): 0

Senior Auditor experience (5 points)

• Above 10 years: 5
• 4–9 years: 3
• 2–3 years: 1
• Below 2 years: 0

Senior ICT Auditor ICT audit experience (10 points)

• 10 years and above: 10
• 6–9 years: 7
• 4–5 years: 4
• Below 4 years: 0

Supporting evidence

• Attach CVs and certified qualifications for each proposed team member.
• Certified copies must not be older than six months as at the submission date; older or uncertified copies attract scoring penalties.
• Valid professional registration certificates or letters of good standing must be valid on the closing date.

Pricing is submitted in a separate sealed envelope marked "Envelope 2 – Pricing Proposal", using SBD 3.3 and the Table 4 pricing schedule.

• Only firm prices are accepted; non-firm prices, including prices subject to exchange-rate variation, are rejected.
• Rates must include overheads and VAT.
• Provide hourly rates for the Engagement Partner, Manager, Senior Auditor, Senior ICT Auditor, Auditor and Specialists (e.g. tax, technical).
• Estimated hours are 2,700 per annum.
• Show Year 1, Year 2 and Year 3 totals including VAT and a grand total.
• The total bid price must allow for staff and other increases from Year 2 to Year 3.
• Provide a typical percentage distribution of person-hours across the team; this is indicative and not binding.
• State whether rates are firm for the full contract period; if not, give the adjustment basis, such as the consumer price index.
• Include a ceiling price covering all phases and expenses, inclusive of all applicable taxes.
• Travel and other expenses are recoverable only at actual cost, supported by proof with certified invoices.
• State the period needed to start after bid acceptance and the estimated person-days for completion.
• The offer must remain valid for 120 days from the closing date.

Pricing basis

• Internal audits are priced on hourly rates; budgets are set after the appointed auditor assesses the work.
• Submit a table of hourly rates per level of resource: Engagement Partner, Manager, Senior Auditor, Senior ICT Auditor, Auditor and Specialists (e.g. tax, technical).
• Rates must include overheads and VAT.
• Provide a typical percentage distribution of person-hours across the team for a job of this nature; this is indicative and not binding.
• Complete SBD 3.3 and the Table 4 pricing schedule, showing Year 1, Year 2 and Year 3 totals including VAT and a grand total.
• The total bid price must allow for staff and other increases from Year 2 to Year 3.
• Only firm prices are accepted; non-firm prices, including prices subject to exchange-rate variation, are rejected.
• State whether rates are firm for the full contract period; if not, give the adjustment basis, such as the consumer price index.
• Include a ceiling price covering all phases and expenses, inclusive of all applicable taxes.
• Travel and other expenses are recoverable only at actual cost, supported by proof with certified invoices.
• State the period needed to start after bid acceptance and the estimated person-days for completion.

Payment

• The bidder must propose a progress payment schedule tied to milestones in the scope of work or implementation schedule.

Financial capacity

• Submit audited financial statements for the past three years.

Bid validity

• The offer must remain valid for 120 days from the closing date.

Registration and tax

• Register on the National Treasury Central Supplier Database (CSD) and submit confirmation with the bid.
• Submit a SARS tax compliance status PIN or a printed TCS certificate; consortia, joint ventures and subcontractors each submit their own PIN, TCS certificate or CSD number.
• Bids from persons in the service of the state, or companies whose directors or members are, will not be considered.

B-BBEE and specific goals

• Submit a valid B-BBEE certificate or sworn affidavit; company-size points are allocated regardless of whether SBD 6.1 is claimed, but the certificate or affidavit is still required.
• Certified South African IDs of directors, owners or shareholders to claim black-ownership points.
• Medical certificate or letter from an accredited health professional to claim ownership-by-people-with-disabilities points.
• B-BBEE certificate or sworn affidavit, certified IDs and CIPC document to claim black-women-ownership points.
• Certified ID, sworn affidavit or CIPC document to claim youth-ownership points.
• Complete and sign SBD 6.1; missing proof means the specific-goal points are treated as unclaimed.
• A trust, consortium or joint venture qualifies as a legal entity only if it submits the required documents for each member.

Professional registration

• Engagement Leader/Director: CA (SA) or CIA.
• Senior Audit Manager/Audit Manager and Senior Auditor: SAICA, SAIGA or IIA.
• ICT Auditor: ISACA certificate.
• Valid certificates or letters of good standing, valid on the closing date, for each named team member.
• All qualifications submitted as certified copies not older than six months as at the submission date.

Joint ventures and subcontractors

• Submit a signed joint venture or consortium agreement setting out each party's roles and identifying the lead partner with power of attorney to bind the others.
• Every member must be registered with the specified professional body.
• Identify each subcontractor on the Subcontractor Identification form.

Contract conditions

• The successful bidder must maintain its B-BBEE status for the contract duration and provide a new tax clearance certificate when the previous one expires.
• The successful bidder is checked against the National Treasury Register of Defaulters and List of Restricted Suppliers.

The internal audit function must coordinate with and support CMS's other control and monitoring functions, including environmental control, alongside risk management, compliance, security, legal, ethics and external audit.

Contract term

• Three years, reviewed annually and monitored under SCM requirements.

Reporting lines

• Administrative reporting to the Accounting Officer; functional reporting to the Audit and Risk Committee.

Deliverables

• Rolling three-year strategic internal audit plan, annual internal audit plan, audit charter, audit strategy, annual combined assurance plan, per-audit scope, cost and timeline plans, and quarterly audit reports to the ARC.

Audit coverage

• ICT systems, cybersecurity and data integrity reviews; special assignments and investigations for the ARC or CEO; fraud-detection audits; financial control, procurement and SCM reviews; real-time probity reviews on tenders; contract, stakeholder and compliance reviews; performance information reviews; review of annual financial statements; follow-up on findings; project readiness and business process reviews.

Fraud reporting

• Serious control defects or fraud must be reported immediately to the CEO and/or ARC only, without disclosure to other staff.

Accountability

• The function is accountable to the ARC for assessing the adequacy and effectiveness of CMS controls and risk management, reporting significant issues, reporting on the annual plan and resource sufficiency, and coordinating with other control and monitoring functions.

Independence

• The function must be independent of the activities it audits and have unrestricted access to information.
• All relationships with CMS-regulated entities must be disclosed in Annexure K.

Team continuity

• Maintain a professional team meeting the audit charter's knowledge, skills, experience and certification requirements.
• Replace team members only with people of equivalent qualification and experience.

Standards and external audit

• Work is performed under the Global Internal Audit Standards.
• Meet the external auditors at least twice a year or as the ARC directs, and share plans, documentation, management letters and risk information.

Confidentiality and ethics

• Keep CMS proprietary and confidential information confidential, including after the contract ends, until it is lawfully public.
• Comply with CMS gift and conflict-of-interest policies and report any violation promptly.
• No marketing reference to CMS without written consent.

Contract conditions

• Liquidated damages: an amount payable or creditable to CMS will be negotiated for failure to meet the agreed implementation schedule.
• Payment: a progress payment schedule tied to milestones is negotiated; bidders should propose one in their bid.
• Prime sponsor terms: the award is subject to CMS's terms, and a bidder unable to accept them is non-responsive.
• The successful bidder must maintain its B-BBEE status for the contract duration and provide a new tax clearance certificate when the old one expires.

Rejection grounds

• Failure to follow the RFP rules, instructions or proposal format.
• Failure to sign the entire original bid documentation.
• Proof of collusion, in which case all bids involved are rejected.
• Non-compliance with the law, unauthorised additions or deletions, conditional or incomplete bids, or irregularities that make a bid ambiguous.
• A bid that reserves the right to reject an award or to contract on terms contrary to the RFP.

Contracting structure

• CMS prefers a single prime contractor; partners must bid through one established entity that is the sole point of contact and contracting authority.
• The prime contractor is responsible for all charges and for its subcontractors' work, and must identify each subcontractor on the Subcontractor Identification form.
• The signed contract is the entire agreement, incorporating the RFP and the accepted bid by reference.
• CMS may request additional information to verify a bidder's ability to deliver.
• Within ten working days after closure, CMS publishes the names of all bidders on its website; the successful bidder is checked against the Register of Defaulters and the List of Restricted Suppliers.
• Bidders must be registered on the CSD and submit confirmation with the bid.

Joint ventures

• Submit a signed joint venture or consortium agreement.
• Every member must be registered with the specified professional body.
• The agreement must set out roles and responsibilities and identify the lead partner with power of attorney to bind the others.

The 80/20 preference point system applies: price carries 80 points and specific goals 20 points.

• Only bidders who complete and sign SBD 6.1 are considered for specific-goal points.
• Specific-goal points are awarded for black ownership, company size (EME, QSE or Generic), black women ownership, ownership by people with disabilities and youth ownership, each on the scales set out in the evaluation criteria.
• CMS may require a bidder to substantiate any preference claim before adjudication.
• Missing ownership or B-BBEE proof means the related specific-goal points are treated as unclaimed.