Professional and technical training for IT auditors and risk practitioners (group audit and risk) — 12-month programme of pre-selected courses

Compulsory briefing session

• Date: 27 October 2026 at 10:00
• Venue: Microsoft Teams meeting
• Meeting ID: 340 852 071 226 412 5
• Passcode: 9xi79XD2
• Attendance is compulsory; the briefing register must be signed. Bidders who do not attend are disqualified.

Closing

• Date: 30 October 2026 at 10:00
• Late submissions are not accepted.

Bid validity

• 90 days after the closing date.

Supply chain enquiries

• Contact: Josia Masenya
• Role: Supply Chain Management
• Telephone: (012) 358 0658
• Email: [email protected]

Technical enquiries

• Contact: Lebogang Dichaba
• Role: Technical official, Group Audit and Risk
• Telephone: (012) 358 5066
• Email: [email protected]

Submission address (online portal; physical address for correspondence)

Tshwane House

Supply Chain Management

320 Madiba Street

Pretoria

0001

GPS coordinates: 25.74431°S, 28.19464°E

Head office

City of Tshwane Metropolitan Municipality

Tshwane House

320 Madiba Street

Pretoria

0001

Tel: (012) 358 9999

Submission method

• Online submission through the City of Tshwane e-tender portal only. Bids must not be placed in the tender box.
• Portal link and registration are obtained from the City of Tshwane e-tender portal; responses must be uploaded before 10:00 on 30 October 2026.
• Late submissions are not considered.

Document format

• Complete the official forms by hand in black pen; retyped or scanned forms are not accepted.
• Price schedule errors must be struck through in ink and each alteration initialled.
• Correction fluid (Tippex or similar) is prohibited. An item priced with correction fluid is disregarded; a bill of quantities corrected this way causes the whole quotation to be rejected.

Returnable documents (all compulsory)

• Pricing schedule: every item in both categories must be priced; an incomplete schedule disqualifies the bid.
• MBD 1 (Invitation to Bid): bidder details and signed offer.
• MBD 4 (Declaration of Interest): discloses state employment and relationships with officials; failure to declare an interest in related companies disqualifies the bid.
• MBD 6.1 (Preference Points Claim): claims the 80/20 specific-goal points with supporting proof.
• MBD 7.2 (Contract Form – Rendering of Services): binds the successful bidder to the quoted prices and contract terms.
• MBD 8 (Declaration of Past Supply Chain Management Practices): declares any restriction, tender-default or fraud record.
• MBD 9 (Certificate of Independent Bid Determination): certifies the price was set without collusion.
• MBD 5 / audited financial statements where applicable.
• Company registration certificate (CIPC).
• Tax compliance status PIN or CSD number.
• B-BBEE certificate or sworn affidavit.
• Municipal account statements or lease agreement / councillor letter for rates and taxes.
• CSD summary report.
• Signed authorisation or delegation of authority where the signatory is not a director, member, owner or shareholder.
• Joint venture agreement signed by all parties, plus all of the above for each JV member, where bidding as a JV.

Disqualification risks

• Any compulsory returnable document missing, blank or unsigned.
• Forms completed in pencil, another ink colour, or with correction fluid.
• Failure to attend the compulsory briefing session and sign the register.
• Incomplete pricing schedule.
• Failure to declare interests in related companies on MBD 4.

Three-stage evaluation

1. Administrative compliance — responsiveness against the returnable documents checklist.
2. Mandatory requirements — experience, accreditation and trainer qualifications.
3. Preference point system — 80/20 in terms of the Preferential Procurement Regulations, 2022.

Scoring split

• Price: 80 points.
• Specific goals: 20 points.
• Total: 100 points.

Specific goals allocation

• B-BBEE status level: Level 1 = 8, Level 2 = 7, Level 3 = 6, Level 4 = 5, Level 5 = 4, Level 6 = 3, Level 7 = 2, Level 8 = 1, non-compliant = 0.
• EME and/or QSE status: 2 points.
• At least 51% women-owned: 2 points.
• At least 51% owned by people with disabilities: 2 points.
• At least 51% youth-owned: 2 points.
• Local economic participation: City of Tshwane 4 points, Gauteng 2 points, national 1 point.
• No proof submitted for a claimed goal means zero points for that goal.

Market analysis

• The City may test whether the quoted price is viable. A bidder who confirms it cannot deliver at its price is disqualified as non-responsive; one who confirms it can deliver signs a tightened contract with performance monitoring.
• The City may negotiate a market-related price with the highest, then second, then third ranked bidder; if no market-related price is agreed the quotation may be cancelled.
• The City is not obliged to accept the lowest or any bid, in whole or in part.

Purpose

• Appoint a service provider to deliver professional and technical training to Group Audit and Risk staff — IT auditors and risk practitioners — over 12 months, aligned to the work skills plan.
• Training supports continuing professional development and IIA/ISACA competency standards, and may be delivered online, physically or face to face.

Category A — IT training (12 candidates per course)

• Certified Information Systems Auditor (CISA)
• Certified in Risk and Information Systems Control (CRISC)
• Certified Information Security Manager (CISM)
• COBIT Framework Training

Category B — Risk management training (14 candidates per course)

• Project Risk Management
• Business Continuity Management
• Risk Appetite and Tolerance

Deliverables for each category

• Customised training material aligned to internal audit functions (Category A) or risk management functions (Category B).
• Delivery through workshops (physical or virtual), practical case studies and interactive sessions.
• Training manuals and materials for participants.
• Attendance registers and training evaluation reports.
• Certificates of completion.
• Presentation slides.
• Number of CPD points stated for each course.
• Number of training days stated.
• Cost outline and quotation inclusive of VAT.
• City of Tshwane vendor number.

Stakeholders

• Tshwane Leadership Management Academy (TLMA), Office of the City Manager, Audit and Performance Committee, Chief Audit Executive, City Manager, Integrated Risk Management Committee.

Quantities

• The City may increase or decrease quantities subject to budget availability.

Approach expected from the appointed provider

• Customise training material to the City's internal audit and risk management functions rather than using generic courseware.
• Deliver through workshops (physical or virtual), practical case studies and interactive sessions.
• State the number of training days and the CPD points awarded for each course.
• Supply training manuals, participant materials and presentation slides.
• Keep attendance registers and produce training evaluation reports after each course.
• Issue certificates of completion to participants.
• Focus content on strengthening IT audit technical competencies, applying risk-based audit methodology, governance and internal control understanding, audit reporting quality, IT and cybersecurity risk, and the risk management framework.

Bidder experience

• Demonstrated experience delivering the selected training courses.
• At least three contactable reference letters on the bidder's company letterhead for each category, covering completed or similar training work.

Training team

• CVs showing the experience of each training team member.
• Certified copies of qualifications; qualifications obtained outside South Africa require SAQA verification.
• Maximum of 5 years training experience per team member.

Category A qualifications

• Certified Information Systems Auditor (CISA) from ISACA.
• Certified in Risk and Information Systems Control (CRISC) from ISACA.
• Certified Information Security Manager (CISM) from ISACA.
• COBIT certificate from ISACA.

Category B membership and accreditation

• Current membership in good standing with IRMSA, IIA, BCI or another relevant institution.
• Accreditation from a relevant SETA.
• Assessor and moderator registered with ETQA.

Training accreditation and quality assurance

• Category A material must be certified or endorsed by ISACA, or SAQA accredited / accredited by a relevant SETA.
• Category B material must be certified or endorsed by IRMSA, or SAQA accredited / accredited by a relevant SETA.
• Category B trainers must hold current membership in good standing with IRMSA, IIA, BCI or another relevant institution.
• Category B providers must hold accreditation from a relevant SETA and use an assessor and moderator registered with the Education and Training Quality Assurance body (ETQA).
• Category A trainer qualifications must include CISA, CRISC, CISM and COBIT certification from ISACA.
• Training must be delivered to professional standards, with attendance registers, evaluation reports and certificates of completion issued.

Pricing structure

• Quote a unit price excluding VAT and a total excluding VAT per course, then VAT at 15% and the total including VAT.
• Quotation must be inclusive of VAT where indicated.

Category A — IT training (12 candidates per course)

• Certified Information Systems Auditor (CISA)
• Certified in Risk and Information Systems Control (CRISC)
• Certified Information Security Manager (CISM)
• COBIT Framework Training

Category B — Risk management training (14 candidates per course)

• Project Risk Management
• Business Continuity Management
• Risk Appetite and Tolerance

Rules

• Every item must be priced; an incomplete schedule disqualifies the bid.
• Corrections must be struck through in ink and initialled; correction fluid is prohibited and voids the affected item or the whole quotation.
• The City may increase or decrease quantities subject to budget availability.
• The bidder must supply its City of Tshwane vendor number.

Pricing

• Quote unit price excluding VAT and total excluding VAT for each course, then VAT at 15% and the total including VAT.
• Category A: 12 candidates per course across four courses.
• Category B: 14 candidates per course across three courses.
• All items must be priced; an incomplete pricing schedule disqualifies the bid.
• Quotation must be inclusive of VAT where indicated.

Payment

• Payment within 30 days after receipt of an invoice.

Securities

• No bid security, performance guarantee or retention is stated.

Financial capacity

• Signed audited annual financial statements for the most recent three years, or from date of establishment for younger entities, or proof that the entity is not legally required to have its statements audited. Applies to tenders above R10 million in conjunction with MBD 5.

Price viability

• The City may conduct a market analysis and negotiate a market-related price; a bidder unable to deliver at its quoted price is disqualified.

Registration and tax

• CSD registration with a valid CSD number is compulsory; only bidders registered on the Central Supplier Database are considered.
• Tax compliance status PIN, or CSD number where no TCS is available. Tax status must be compliant before award.
• CIPC company registration certificate.

Rates and taxes

• Municipal account statement for the bidding company not older than 3 months and not in arrears for more than 90 days, or a signed lease agreement, or a councillor's letter for bidders in informal settlements or rural areas.
• The same proof is required for all South African based owners, members, directors and major shareholders.

B-bbee

• Valid B-BBEE certificate, or a sworn affidavit for EMEs and QSEs, or a CIPC B-BBEE certificate, to claim preference points.
• B-BBEE level determines 0 to 8 of the 20 specific-goal points.

Mandatory experience and accreditation

• Demonstrated experience in the selected training courses, evidenced by at least three contactable reference letters on the bidder's letterhead for each category.
• Category A: training material certified or endorsed by ISACA, or SAQA accredited / accredited by a relevant SETA.
• Category B: training material certified or endorsed by IRMSA, or SAQA accredited / accredited by a relevant SETA.
• CVs of training team members showing experience, with a maximum of 5 years training experience, plus certified copies of qualifications; foreign qualifications require SAQA verification.
• Category A qualifications: CISA, CRISC, CISM and COBIT certificates from ISACA.
• Category B: current membership in good standing with IRMSA, IIA, BCI or another relevant institution; SETA accreditation; assessor and moderator registered with ETQA.

Declarations

• MBD 4: no bid accepted from a person in the service of the state; all directors, trustees, members and shareholders must be disclosed, including interests in related companies.
• MBD 8: declares any listing on the National Treasury database of restricted suppliers or the register for tender defaulters, or conviction for fraud or corruption in the past five years.
• MBD 9: certifies independent price determination with no collusive contact.

Joint ventures

• A JV agreement signed by all parties is required, and all compliance documents must be submitted for each JV member. The same JV must be maintained for the contract duration unless the City approves a change.

Contract duration

• 12 months from appointment.

Bid validity

• 90 days after the closing date; prices remain binding for that period.

Contract documents

• The signed MBD 7.2 contract form, the bidding documents, tax compliance, pricing schedule, preference claim, declarations of interest and past SCM practices, certificate of independent bid determination, special conditions of contract and the General Conditions of Contract form the agreement.

Pricing risk

• The bidder carries the risk of any error in prices, rates or calculations, and the quoted rates must cover all obligations under the contract.

Payment

• 30 days after receipt of an invoice.

Quantities

• The City may increase or decrease quantities subject to budget availability.

Market analysis

• Where a price is not viable, the City may require written confirmation of ability to deliver; refusal or inability results in disqualification as non-responsive. A bidder confirming delivery at that price enters a tightened contract, with non-performance handled through performance warnings and listing on the database of restricted suppliers.
• The City may negotiate a market-related price with the highest, second or third ranked bidder, and may cancel the quotation if no market-related price is agreed.

Award

• The City is not bound to accept the lowest or any bid, in whole or in part.

Joint ventures

• The same JV must continue for the contract duration unless the City approves a change.

Evaluation runs in three stages: administrative compliance, mandatory requirements, then the preference point system.

Preference points (80/20 system)

• Price: 80 points.
• Specific goals: 20 points.

Specific goals breakdown

• B-BBEE status level: Level 1 = 8, Level 2 = 7, Level 3 = 6, Level 4 = 5, Level 5 = 4, Level 6 = 3, Level 7 = 2, Level 8 = 1, non-compliant = 0.
• EME and/or QSE: 2 points.
• At least 51% women-owned: 2 points.
• At least 51% owned by people with disabilities: 2 points.
• At least 51% youth-owned: 2 points.
• Local economic participation: City of Tshwane 4 points, Gauteng 2 points, national 1 point.

Evidence

• Each claimed goal requires the stated proof; a claim without proof scores zero.
• The City may require a bidder to substantiate any preference claim before or after adjudication.