Internal audit services for national school of government – 3-Year tender (NSG/BID/02/2026/2027)

Closing date and time: 02 September 2026 at 11:00.

Non-compulsory briefing session: 18 August 2026 at 11:00 via Microsoft Teams.

• Join link: https://teams.microsoft.com/meet/360795370411538?p=vg2zfpoFsimL4ivH5V
• Meeting ID: 360 795 370 411 538
• Passcode: Qk2hw2nK

Bid validity period: 120 days from closing.

Bidding procedure enquiries:

• Contact person: Me Roos
• Email: [email protected] or [email protected]
• Fax: 012 441 6089

Technical enquiries:

• Contact person: Takalani Madzole
• Email: [email protected]
• Fax: 012 441 6151

Submission address: Bid box at ZK Matthews Building, 70 Meintjies Street (walk-in) or 20 Greeff Street (visitor parking), Trevena/Sunnyside, Pretoria.

Returnable documents (Annexure A checklist) — all must be completed, signed and submitted by the closing time:

• SBD 1 (Invitation to Bid): bidder and contact details, signed as the offer cover page.
• SBD 3.3 (Pricing Schedule): pricing submission, to be placed in a separate envelope.
• SBD 4 (Declaration of Interest): discloses any state employment or connections; false disclosure disqualifies.
• SBD 6.1 (Preference Points Claim): claims B-BBEE points under the 80/20 system.
• Proof of CSD registration.
• Legislative requirements documents, company profile, proof of registration with relevant professional bodies.
• Latest three years' reviewed or audited financial statements, or an auditor's going-concern confirmation.
• Technical documentation and evidence as per the Terms of Reference for Phase II desktop evaluation.
• Bidders must present to the evaluation committee (Phase III).

Submission channel: Bids must be deposited in the bid box at the ZK Matthews Building, 70 Meintjies Street (walk-in) or 20 Greeff Street (visitor parking), Trevena/Sunnyside, Pretoria.

Disqualification risks:

• Late bids are not accepted for consideration.
• Bids must be on official forms, not re-typed.
• Failure to provide or comply with any required particulars may render the bid invalid.
• The NSG may contact bidders after closing to correct incomplete or unsigned administrative documents, in line with PAJA.

Returnable documents: Bidders must submit SBD 1, SBD 3.3, SBD 4, SBD 6.1, proof of CSD registration, legislative requirements documents, company profile, proof of registration with relevant institutions, pricing submission, and latest three years' financial statements. Technical documentation and evidence as per the Terms of Reference must be submitted for Phase II.

Evaluation is phased:

• Phase I: Mandatory bid requirements — administrative compliance (SBD forms, CSD registration) and mandatory requirements (legislative documents, company profile, professional registration, pricing, financial statements).
• Phase II: Technical evaluation — desktop evaluation against Annexure C criteria.
• Phase III: Price and preference points under the 80/20 system (80 points price, 20 points specific goals).
• Phase IV: Presentation to the evaluation committee.

Preference points (specific goals, max 20 points):

• Black-owned: up to 8 points (100% black-owned = 8 points).
• Black women-owned: up to 5 points (100% = 5 points).
• Black youth: up to 4 points (100% = 4 points).
• Black people with disability: up to 3 points (100% = 3 points).

Proof required for each claimed goal (e.g., CIPC certificate, IDs, disability proof). Failure to submit valid proof means points not allocated.

Mandatory requirements for bidders:

• At least five years' recent experience in internal auditing as a company.
• At least three years' public sector experience in assurance reviews, ICT, financial, financial reviews and forensic.
• Key personnel must meet specified qualifications and experience (see technical specifications).
• Submit an organogram with CVs, and a list of contactable references (Annexure D) — at least three or five clients; NSG cannot be used as a reference.
• Demonstrate audit methodology, skills transfer plan, and understanding of government practices.

Disqualification: Failure to disclose all CSD-registered active companies linked to directors leads to disqualification.

Scope of work — the service provider will conduct internal audit projects according to the approved internal audit plan, covering:

• Assurance audits of operational areas: training and delivery, quality assurance and accreditation, HR management, asset management, supply chain management, procurement, and contract management.
• Internal financial controls, supply chain management (including probity audits of tender processes), and financial statement reviews.
• Performance information reviews: strategic and annual performance plans, and reliability of quarterly performance reports.
• ICT audits: general controls, application controls, network security, ICT governance, SDLC, post-implementation reviews; knowledge of Microsoft Dynamics, BAS, PERSAL, LOGIS and SAGE PASTEL; network vulnerability assessments.
• Enterprise risk management audits.
• Combined assurance, including inputs to policies, frameworks and plans.
• Governance and ethics audits.
• Compliance audits (PFMA, Treasury Regulations, OHS).
• Determination tests for irregular, fruitless and wasteful expenditure, or material irregularities referred by the AGSA.
• Audit technical opinions.
• Consulting/advisory services, including policy and procedure reviews.
• Quality assurance reviews and internal quality assessments.
• Performance audits (economy, efficiency, effectiveness).
• Ad-hoc audits as requested.

Key performance indicators:

• Review and update Internal Audit and Audit Committee Charters annually.
• Conduct risk-based audit assessments quarterly.
• Develop a three-year rolling audit plan and an annual internal audit plan, with costing at an average hourly tariff based on 1300 hours per annum.
• Produce quality-assured audit files, working papers, audit programmes, draft and final reports, follow-up of prior year findings, customer satisfaction surveys, and quality review checklists.
• Quarterly progress reports to the Audit Committee; annual close-off report.
• Liaise with the Auditor-General to align audit work and minimise duplication.

Independence requirements:

• Service provider must have no executive or managerial powers, no involvement in day-to-day operations, and no responsibility for developing or implementing new systems.
• Internal auditors must be independent of audited activities, with unrestricted access to information.
• Serious defects in internal controls must be reported immediately to the Accounting Authority or Audit Committee, and to the Deputy Director: Internal Audit.

Bidders must demonstrate the audit approach and methodology to be used in planning and conducting audits, provide a detailed plan of how and when work will be conducted, and demonstrate understanding of skills transfer to NSG staff. Bidders will be expected to do a presentation to the evaluation committee.

Competency and expertise requirements: The bidder must ensure availability of team members with specified qualifications and experience, including Internal Audit Engagement Director/Manager (CA/CIA with 5 years' experience), Internal Audit Team members (degree with 3 years' experience), ICT Manager (CISA with 5 years' experience), ICT Audit Team members (CISA with 3 years' experience), Forensic Manager (CFE with 5 years' experience), Forensic Team members (CFE with 3 years' experience), and Quality Control Reviewer (IIA certification with 5 years' experience). Preference given to firms registered with PAAB, IIA, or IPFA. Bidders must submit an organogram, CVs, client references, and demonstrate at least 5 years' experience in internal auditing as a company.

The bidder must maintain a quality assurance methodology/plan designed to assist the NSG Internal Audit function in adding value and providing assurance that services conform to IIA Standards and Code of Ethics. Certified personnel must perform final quality review on all audit files and reports.

Pricing and payments: Bidders must take note of prescribed rates set out by the Auditor General and use them as a guideline to develop a detailed costed activity plan per year over three years and an annual audit plan. Invoices will be payable upon receipt of the complete project file by the NSG.

Pricing format: SBD 3.3 Pricing Schedule, to be submitted in a separate envelope (Annexure B).

Pricing basis: Bidders must use the Auditor-General's prescribed rates as a guideline to develop a detailed costed activity plan per year over the three years, and an annual audit plan.

Payment terms: Invoices are payable upon receipt of the complete project file by the NSG, after it has passed all relevant internal processes.

No bonds or guarantees are specified in the document.

Mandatory registrations:

• Central Supplier Database (CSD) registration — proof must be submitted; NSG verifies tax compliance via CSD or SARS.
• Tax compliance: valid SARS Tax Compliance Status PIN or printed TCS certificate; for consortia/JVs/subcontractors, each party must provide their own.
• Bidders must not be persons in the service of the state, nor have directors/members who are.

Returnable forms (each one line):

• SBD 1 (Invitation to Bid): bidder and contact details, signed as the offer cover page.
• SBD 3.3 (Pricing Schedule): pricing submission.
• SBD 4 (Declaration of Interest): discloses state employment or connections; false disclosure disqualifies.
• SBD 6.1 (Preference Points Claim): claims B-BBEE points under the 80/20 system.

Professional registrations:

• Preference given to firms registered with PAAB, IIA or IPFA.
• Preference given to firms with a dedicated internal audit business unit and staff registered with IIA.
• Membership of IIA, SAICA or ISACA is required.

Financial statements: latest three years' reviewed or audited financial statements, or an auditor's going-concern confirmation.

Other: proof of authority to sign (e.g., company resolution) must be submitted.

Compliance audits must include knowledge of the Occupational Health and Safety Act and other relevant laws and regulations.

No specific OHS plan or safety requirements are stated beyond this.

Contract period: The NSG will enter into a Service Level Agreement with the successful bidder for a period of three years. The NSG reserves the right to terminate the agreement for any reason by giving three months' written notice.

Special conditions of contract: The bid is subject to the General Conditions of Contract and the Preferential Procurement Policy Framework Act. The Special Conditions of Contract prevail over the General Conditions in case of conflict. Bidders must be registered on the CSD and tax compliance status will be verified.

Mandatory requirements: Bidders must be registered on the Central Supplier Database (CSD), comply with tax obligations, and submit SBD 1, SBD 3.3, SBD 4, and SBD 6.1. Bidders must provide proof of registration with relevant professional bodies, company profile, pricing submission, and latest three years' reviewed or audited financial statements or going concern confirmation.

Evaluation criteria: The bid will be evaluated in phases: Phase I Mandatory Bid Requirements, Phase II Technical Evaluation (desktop evaluation), Phase III Price and Preference Points (80/20 criteria), and Phase IV Presentation. Bidders will be expected to do a presentation to the evaluation committee.