Panel of internal audit service providers for PRASA (3-Year co-sourcing contract)

Compulsory briefing session: 17 July 2026 at 10:00, Umjantshi House Auditorium, 30 Wolmarans Street, Braamfontein, Johannesburg. Closing date for questions: 03 August 2026. Closing date for PRASA responses to questions: 07 August 2026. Bid submission deadline: 13 August 2026 at 12:00. Validity period: 180 business days from closing date. Bidders may be requested to extend validity at the same terms if evaluation is not finalized.

For queries: Patrick Masumbuka, email: [email protected] or [email protected]. For complaints: [email protected] (include bid description, reference number, closing date, supplier name, contact details, and complaint details). Submission address: The Secretariat/Tender Office, 30 Wolmarans Street, Umjantshi House, Braamfontein, Johannesburg.

Submit bids in two sealed envelopes/boxes: Volume 1 (Envelope 1) for technical and compliance responses (Part A: Mandatory Requirements, Part B: Technical/Functional Response), and Volume 2 (Envelope 2) for financial proposals and specific goals (Part C). Include 1 original and optional copies, plus an electronic version on a clearly labeled memory card/external drive. Required returnable documents: Tender Form (Pricing Schedule) Form C, SBD 4 (Bidder’s Disclosure), SBD 6.1 (Preference Points Claim Form), Annexure B1 (Pricing Schedule), Annexure C (CV Formats). Deliver to: The Secretariat/Tender Office, PRASA Tender Box, Main Entrance, Umjantshi House, 30 Wolmarans Street, Braamfontein, Johannesburg. Late submissions or incorrect addresses will be disqualified. Bidders must sign all forms in black ink. Non-original documents must be certified as true copies by a Commissioner of Oaths. Responses must be in English, A4 format (A3 for graphics), neatly bound, consecutively numbered, and structured per RFP requirements. Amendments to the Draft Contract (Annexure D) must use track changes and be in unprotected Word format. Failure to provide mandatory returnable documents may result in disqualification.

PRASA seeks to appoint a panel of co-sourced internal audit service providers for 36 months to augment its Group Internal Audit (GIA) capacity. The panel will address critical skills gaps in GRAP (Financial Audit), Engineering (Electrical, Mechanical, Built), ICT, Cybersecurity, Data Analytics, ESG, and Real Estate. Scope includes: Integrated Operational Reviews, Asset Management Reviews, Supply Chain Management (SCM) audits, Internal Financial Controls, Performance Information audits, PFMA Compliance Reviews, Property Management Reviews, and Proactive Assurance for High-Value/High-Risk Tenders. Providers must offer specialized expertise (e.g., cybersecurity, cloud computing, data analytics, ESG frameworks, rail engineering) and tools (e.g., Power BI, Arbutus, SQL, ACL). The panel will enable scalability, flexibility, improved audit coverage, and knowledge transfer. Current GIA team includes roles like Chief Audit Executive, IT Auditors, and Forensic Investigators but lacks depth in specialized areas. Co-sourcing will support PRASA’s mandate under the PFMA and Legal Succession Act.

Bidders must submit clear, concise responses with a structured methodology. Include an executive summary and address each RFP requirement succinctly. Use numbered headings, bullet points, and sections. Responses must align with RFP terminology and definitions. For the Draft Contract (Annexure D), bidders may propose amendments/deletions using track changes. Final evaluation may involve presentations or negotiations, with a 90/10 scoring methodology applied.

PRASA seeks providers with expertise in: Cybersecurity (vulnerability assessments, penetration tests, cloud audits), Data Analytics (Power BI, Arbutus, SQL, ACL), Financial Audits (GRAP, IFCs), Specialized Industry Audits (rail engineering, real estate, ESG), Proactive Assurance (high-value tenders, probity reviews), and PFMA/Treasury Regulations compliance. Providers should have prior experience in these areas and the ability to transfer skills to PRASA’s internal team. Key personnel qualifications must align with the scope of work.

GIA operates under revised Global Internal Audit Standards but lacks expertise in cybersecurity, data analytics, GRAP, and specialized engineering/real estate audits. Co-sourced providers must adhere to these standards and provide quality assurance for: Integrated Operational Reviews, Asset Management, SCM, Internal Financial Controls, Performance Information, PFMA Compliance, Property Management, and Proactive Assurance for High-Value Tenders. Providers should introduce intelligent systems, tools, and methodologies to enhance audit quality, efficiency, and risk anticipation.

Pricing must be submitted in Volume 2 (Envelope 2) as Part C: Financial Proposal and Specific Goals. Include Annexure B1 (Pricing Schedule) and Tender Form C. PRASA may request annual financial statements for due diligence. Bid bonds may be required. Pricing must remain valid for 180 business days from closing date. PRASA reserves the right to negotiate market-related prices with top bidders. Changes to bid rates post-closing are not permitted unless contractually allowed.

Submit pricing in Volume 2 (Envelope 2) as Part C: Financial Proposal and Specific Goals. Include Annexure B1 (Pricing Schedule) and Tender Form C. PRASA may request annual financial statements or other documentation for due diligence. Bid bonds may be required where applicable. PRASA reserves the right to negotiate market-related prices with top-scoring bidders. Changes to bid rates after closing date or award will not be accepted unless the contract allows it. Payment terms and financial stability will be assessed. Validity of returnable documents: 180 business days from closing date.

Mandatory compliance: Register on National Treasury’s Central Supplier Database (CSD) at https://secure.csd.gov.za and provide Supplier Number and Unique Registration Reference. Tax Compliance: Must be compliant with Income Tax Act and VAT Act. Provide Tax Compliance Status (TCS) PIN or Tax Clearance Certificate. Foreign bidders must also comply. For Joint Ventures/Consortiums: Each party must register on CSD and provide tax compliance proof. Submit SBD 1 (CSD verification) and SBD 4 (Bidder’s Disclosure) as essential returnable documents. B-BBEE: Submit SBD 6.1 (Preference Points Claim Form) per PPPFA. Professional registrations and certifications may be required for specialized audits (e.g., cybersecurity, ESG). Confidentiality agreements may be required. Protection of Personal Data: PRASA and bidders must process personal data per applicable laws.

Specialized audits may include rail engineering/environmental landscapes. Providers must address emerging risks in these areas, including compliance with environmental regulations and sustainability standards (e.g., GRI, ESG frameworks). Co-sourcing will support PRASA’s ability to audit environmental impacts and related controls.

PRASA reserves the right to: modify RFP requirements, withdraw/amend the RFP, reject non-compliant proposals, disqualify late submissions, request additional documents, withdraw the RFP, award contracts post-closing, or make no award. Contracts may include clauses for performance bonds, validity periods (180 business days), and confidentiality. Bidders must sign confidentiality undertakings and return all PRASA-provided confidential information on demand. Contracts will be governed by South African law. PRASA is not liable for bidder costs. Successful bidders must comply with all applicable laws and regulations.

Evaluation uses a 90/10 methodology: 90 points for technical/functional responses (Part B) and 10 points for financial proposals/specific goals (Part C). PRASA may negotiate BAFO if no proposal meets requirements. Evaluation committees will declare conflicts of interest and ensure transparency. Final evaluation may include Supplier Development and Specific Goals Improvement Plans. All bidders must submit SBD 6.1 (Preference Points Claim Form) per PPPFA.

The document provided is Annexure C - CV Format only. This annexure outlines the required format for submitting personnel CVs for the internal audit service panel.

Key CV submission requirements:

• Bid Category must be specified
• Firm Name must be provided
• Full Name and Surname of proposed resource required
• Proposed Role must align with the specification
• Academic and Professional Qualifications must be captured
• Experience summary required including years of exposure in the bid category
• Clients where audit/consulting work was performed must be listed

Experience table format required:

• Description of work performed / Name of audit or consulting work
• Client/Entity name
• Year work was performed (start to end date with day, month, year)
• Role on the project
• Contact person name
• Contact details

Clarification deadline: Before 12:00 on 03/08/2026. Closing time: 12:00 on 13/08/2026.

Clarification deadline: Before 12:00 on 03/08/2026.

PRASA (PRASA Rail) contacts: Patrick Masumbuka ([email protected]), Lucille Nkosi ([email protected]). Copy submissions to the Buyer.

Appointment of a panel of internal audit service providers. Services to be provided as and when needed over a period of three (3) years.

PRASA (PRASA Rail) contacts: Patrick Masumbuka ([email protected]), Lucille Nkosi ([email protected]). Copy submissions to the Buyer.

Mr Bonginkosi Zimase — Chief Audit Executive. Email, phone, and address not provided in this document.

This document is Annexure F (Pricing Schedule) only. Full submission guidelines are not contained in this document. Bidders must obtain the complete tender documentation for submission requirements.

Staff categories required for pricing: Engagement Partner/Director, Associate Partner/Director, Senior Audit Manager, Audit Manager, Specialists, Lead Auditor/Audit Supervisor, Senior Internal Auditor, Internal Auditor (completed training). Staff levels are illustrative only — bidders with different naming conventions must indicate accordingly.

This section contains only pricing schedule tables. No specific experience or qualification requirements are stated in this document.

Pricing schedule structure requires hourly rates for 8 staff levels across 3 operational years (Year 01, Year 02, Year 03). Each line item must include: Equivalent staff as per bidder experience, Hourly rate, Discount, Cost excl VAT, Total cost inc VAT. Required totals: Total fees (line 10) and Disbursement estimates (line 11). Proposed 3-year fee total, less discount offered, sub-total excluding VAT, VAT at 15%, and total tendered price inclusive of VAT must be calculated. Escalation percentage for Year 3 must be disclosed. Fees must comply with SAICA guidelines or National Treasury-approved rates.

Pricing is compulsory and must be completed without alterations — failure results in disqualification. Hourly rates must be based on SAICA guidelines for work performed on behalf of the Auditor General, or rates approved by National Treasury. Unconditional discounts will be considered; conditional discounts will not unless they apply to invoice settlement. Escalation percentage for Year 3 (2027/2028/2029) must be indicated. Disbursements reimbursed according to government practices and National Treasury cost containment guidelines. VAT applicable at 15%.

No compliance requirements specified in this document.

Financial evaluation based on hourly rates. Pricing schedule completion is mandatory — incomplete or altered schedules will result in disqualification.

Closing date: 13 August 2026 at 12:00. Compulsory tender briefing session: 17 July 2026 at 10:00, Umjantshi House, 30 Wolmarans Street, Braamfontein, Johannesburg. Tender documents available for download from 03 July 2026 on the National Treasury eTender website: https://www.etenders.gov.za.

Compulsory tender briefing session: 17 July 2026 at 10:00, Umjantshi House, 30 Wolmarans Street, Braamfontein, Johannesburg. Bidders failing to attend will be disqualified. Attendance must be certified in Form D.

Bid box address: 30 Wolmarans Street, Umjantshi House, Braamfontein, 0001. Contact person and telephone number must be provided in the bid submission (Form F, Section 1).

Submit bids by the closing date and time (13 August 2026, 12:00) to the bid box at: 30 Wolmarans Street, Umjantshi House, Braamfontein, 0001. Bids must be submitted on the official forms provided (do not re-type). Late bids will not be accepted. Attendance at the compulsory tender briefing session on 17 July 2026 at 10:00 at Umjantshi House is mandatory; failure to attend will result in disqualification. Bidders must sign a written contract form (SBD7) if successful. Required returnable forms include: Form A (Invitation to Bid), Form B (Terms and Conditions for Bidding), Form D (Tender Briefing Session), Form E (Statement of Services Successfully Carried Out), Form F (Security Screening Form), Form G (Acknowledgment), SBD4 (Declaration of Interest), and SBD 6.1 (Preference Points Claim Form).

Required forms: Form A (Invitation to Bid), Form B (Terms and Conditions for Bidding), Form D (Tender Briefing Session), Form E (Statement of Services Successfully Carried Out), Form F (Security Screening Form), Form G (Acknowledgment), SBD4 (Declaration of Interest), SBD 6.1 (Preference Points Claim Form). Successful bidders must sign SBD7 (Contract Form).

Bidders must be tax compliant, registered on the CSD, not listed on tender defaulter or restricted supplier lists, and must provide proof of successfully completed services (Form E). Foreign suppliers must declare residency/establishment status. Specific goals require 51% black ownership (5 points) and B-BBEE Level 2 status (5 points) for maximum preference points.

The successful bidder will be appointed to a panel of internal audit service providers for a period of three (3) years, as and when needed. Bidders must provide a statement of services successfully carried out, including client details, nature of services, contract value, project period, and contact numbers. If space is insufficient, provide details separately. Bidders must also complete a security screening form, declaring no previous convictions, pending criminal/civil proceedings, or investigations against the company or its directors.

Bidders must submit a statement of services successfully carried out (Form E), including client name, nature of services, contract value, project period, and contact details. If space is insufficient, provide details separately.

Bidders must register on the Central Supplier Database (CSD) to upload mandatory information: business registration, directorship/membership/identity numbers, tax compliance status, and banking details. If not registered on CSD, mandatory information cannot be submitted with the bid. Bidders must ensure tax compliance and submit a Tax Compliance Status (TCS) PIN issued by SARS (via eFiling or printed copy). For consortia/JVs/sub-contractors, each party must submit separate proof of TCS/PIN/CSD number. If no TCS is available but the bidder is CSD-registered, provide the CSD number. Foreign bidders not resident in RSA with no branch, permanent establishment, or income source in RSA are exempt from TCS/PIN requirements. B-BBEE requirements: 5 points for 51% Black-owned entities (evidence: CIPC/B-BBEE certificate/affidavit), 5 points for B-BBEE Level 2 status (evidence: B-BBEE certificate/CIPC/affidavit). Bidders must declare no conflicts of interest, insolvency, liquidation, or involvement in tender defaulters/restricted suppliers lists.

Preference points for specific goals: 5 points for 51% Black-owned entities (evidence: CIPC/B-BBEE certificate/affidavit; JVs require consolidated scorecard). 5 points for B-BBEE Level 2 status (evidence: B-BBEE certificate/CIPC/affidavit; JVs require consolidated scorecard). Total: 10 points. Fraudulent claims may result in disqualification, penalties, or prosecution.

Bidders must register on the Central Supplier Database (CSD) and submit mandatory information (business registration, tax compliance, banking details). Tax Compliance Status (TCS) or PIN from SARS is required (via eFiling or printed copy). Consortia/JVs must submit separate proof for each party. Foreign bidders without RSA presence are exempt from TCS/PIN if no income source exists in RSA. Bidders must declare no convictions, pending proceedings, insolvency, or liquidation. Security screening and disclosure of conflicts of interest are mandatory.

The 90/10 preference point system applies. Price: 90 points (Ps = 90(1 - (Pt - Pmin)/Pmin)). Specific goals: 10 points (5 for 51% Black-owned entities, 5 for B-BBEE Level 2 status). Proof of claims is mandatory; failure to submit will result in zero points for specific goals. Fraudulent claims may lead to disqualification, penalties, or prosecution.