Third-party risk management (tprm) solution with support and maintenance – 3-Year contract (RAF/2026/00054)

The Road Accident Fund (RAF) seeks to appoint a service provider for the provision of a third-party risk management (TPRM) solution including support and maintenance for three years. The solution must cover the full third-party lifecycle: onboarding, due diligence, risk assessment, monitoring, remediation, reporting, and offboarding. It must support automation, integration, scalability, and reporting, and include governance deliverables such as policy, framework, procedures, and reporting templates. The initiative aims to improve consistency, visibility, accountability, and oversight of third-party risks across the organisation.

Publication date: 27 August 2026. Non-compulsory briefing session: 04 September 2026 at 11:00 AM, held on Microsoft Teams (link provided). Closing date for bid questions and enquiries: 11 September 2026. Publication date for Questions & Answers: 17 September 2026. Closing date: 02 October 2026 at 11:00 AM.

A non-compulsory briefing session will be held on Microsoft Teams on 04 September 2026 at 11:00 AM. Link: https://teams.microsoft.com/meet/393631099183776?p=IzrDsZnKpQTPEj1kyA

Bid enquiries: Ntanganedzeni Mutheiwana, email: [email protected]. No telephonic enquiries will be entertained. All questions/enquiries must be forwarded in writing to the email address above. Questions received after 11 September 2026 will not be entertained. Questions and Answers will be published on the RAF website and eTender portal.

Bids must be hand-delivered or couriered to the tender box at the Road Accident Fund (RAF), Eco Glades 2 Office Park, 420 Witch-hazel Avenue, Centurion, 0046, on or before the closing date and time. Faxed or emailed bids will not be accepted. Submit an original bid document plus a soft copy enclosed in the same envelope. The envelope must be clearly marked with the tender number and description. Bids must be submitted on the official forms provided (not re-typed). Late bids will not be considered. Bids must remain valid for 90 days from the closing date. Returnable documents include: SBD 1, SBD 3.1 (pricing schedule – firm prices), SBD 4 (declaration of interest), SBD 5 (National Industrial Participation Programme), SBD 6.1 (preference points claim form), proof of CIDB registration (if applicable), the specification document, the general conditions of contract, a Tax TCS PIN (or CSD number), a joint venture agreement (if applicable), and proof of CSD registration. All SBDs must be completed, attached, and signed. Failure to provide or comply with any required particulars may render the bid invalid.

Mandatory returnable documents: SBD 1, SBD 3.1/3.2/3.3, SBD 4, SBD 5, SBD 6.1, CIDB registration (if applicable), specification document, general conditions of contract, Tax TCS PIN, joint venture agreement (if applicable), and CSD registration. All SBDs must be signed and submitted.

The applicable preference point system is the 80/20 system. Price is allocated 80 points and specific goals 20 points. Specific goals include: South African citizens who had no franchise in national elections prior to the 1983 or 1996 Constitution (10 points), women (8 points), and persons with disabilities (2 points). Bidders must claim points and provide supporting documentation. Failure to submit proof or documentation required to claim specific goals will be interpreted as not claiming those points. The evaluation criteria published with the Request for Bid will be used to assess bidders' responses; no amendments are allowed after the closing of the bid.

The service provider must deliver a fit-for-purpose Third-Party Risk Management (TPRM) framework and a technology-enabled solution covering the full third-party lifecycle: onboarding, due diligence, risk assessment, monitoring, remediation, reporting, and offboarding. The solution must support automation, workflow management, integration with existing RAF systems (including SAP, Microsoft Entra ID / Active Directory, Microsoft 365, Intune, vulnerability management tools, cloud platforms, document repositories, and the RAF GRC platform), and real-time visibility of third-party risks. It must be deployed as Software as a Service (SaaS) supporting integrations with hybrid cloud and on-premises services. The bidder must disclose hosting location, cloud provider, data residency, backup and disaster recovery locations, and any cross-border transfer of RAF data. The solution must support a central repository of third-party information, risk assessments, supporting documentation, remediation actions, and reporting outputs. It must support role-based reporting, dashboards, analytics, and structured reporting for management, EXCO, and Board. The bidder must provide a data migration approach for historical third-party information, including data quality requirements, cleansing assumptions, migration responsibilities, risks, and dependencies. The solution must support clear assignment of responsibility and accountability, including third-party owner, business owner, contract owner, and risk owner. The service provider must facilitate knowledge transfer, skills development, and sustainable capability within RAF to manage third-party risks independently post-implementation.

The service provider must deliver both a fit-for-purpose TPRM framework and a technology-enabled solution. Required governance deliverables include TPRM policy, framework, procedures, risk tiering methodology, assessment questionnaires, workflow and escalation matrix, reporting templates, training material, and implementation report. The platform must support capabilities such as risk assessment, monitoring, profile management, onboarding/offboarding, workflows, exception management, remediation, connectors, access controls, document management, analytics, collaboration portal, AI, mobility, integration, security certifications, continuous monitoring, and workflow customisation. The solution must be deployed as SaaS supporting integrations with hybrid cloud and on-premises services. The bidder must disclose hosting location, cloud provider, data residency, backup and disaster recovery locations, and any cross-border transfer of RAF data. The solution must support secure integration with relevant RAF systems through APIs, connectors, file-based interfaces, or other approved methods. The bidder must provide a data migration approach covering supplier master data, third-party profiles, contracts, supporting documents, existing assessments, open issues, remediation actions, and historical records. The solution must support clear assignment of responsibility and accountability across the third-party lifecycle, including third-party owner, business owner, contract owner, and risk owner.

The bidder must be an eligible, registered service provider in terms of the applicable laws of the country. The bidder must have a business continuity management plan available for inspection. The RAF seeks a strategic partner with deep subject matter expertise, proven methodologies, and a track record of delivering robust TPRM solutions. The service provider must facilitate knowledge transfer, skills development, and sustainable capability within RAF to manage third-party risks independently post-implementation.

The bidder must be an eligible, registered service provider in terms of the applicable laws of the country. The bidder must have a business continuity management plan, which must be available for inspection by the RAF during the subsistence of rendering services. The evaluation criteria published with the Request for Bid will be used to assess bidders' responses; no amendments are allowed after the closing of a bid.

Only firm prices will be accepted. Non-firm prices (including prices subject to rates of exchange variations) will not be considered. Prices must be quoted in RSA currency and include all applicable taxes (VAT, PAYE, income tax, UIF, and skills development levies). All delivery costs must be included in the bid price. Bidders must complete the pricing schedule (SBD 3.1) indicating item, quantity, description, and bid price. Bidders must indicate whether the offer complies with the specification(s) and any deviations. The successful bidder will be required to sign a written contract form (SBD 7).

Bidders must be registered on the National Treasury Central Supplier Database (CSD). Bidders must submit a valid Tax TCS PIN issued by SARS to verify tax status; where no TCS PIN is available, a CSD number must be provided. In bids involving consortia, joint ventures, or sub-contractors, each party must submit a separate Tax TCS PIN / certificate / CSD number. Bidders must not be persons in the service of the state, nor companies with directors who are persons in the service of the state, nor close corporations with members who are persons in the service of the state. Bidders must not be listed on the Register for Tender Defaulters or the List of Restricted Suppliers. Bidders must have a business continuity management plan available for inspection by the RAF during the contract period. Proof of CIDB registration is required if applicable. If the bidder is a joint venture, consortium, or other unincorporated grouping, a copy of the joint venture agreement must be provided. Proof of authority to sign the bid (e.g., company resolution) must be submitted. Returnable forms: SBD 1 (invitation to bid), SBD 3.1 (pricing schedule – firm prices), SBD 4 (declaration of interest), SBD 5 (National Industrial Participation Programme), SBD 6.1 (preference points claim form). All SBDs must be completed, attached, and signed.

No specific health and safety requirements are stated in the document beyond the general requirement that the service provider must support business continuity and operational resilience by verifying that critical suppliers can recover from disruptions and deliver consistently. The solution must support the management of third-party risks related to cybersecurity, privacy, data protection, operational resilience, and business continuity.

No specific environmental impact or sustainability requirements are stated in the document. The TPRM solution must support the management of third-party risks including cybersecurity, privacy, data protection, operational resilience, financial sustainability, legal and regulatory compliance, reputational, and performance and service delivery risks.

The contract will be for a period of three (3) years. The successful bidder will be required to sign a written contract form (SBD 7). The bid is subject to the Preferential Procurement Policy Framework Act, 2000, the Preferential Procurement Regulations, 2017, the General Conditions of Contract (GCC), and any applicable special conditions. Bids must be valid for 90 days from the closing date. The National Industrial Participation (NIP) Programme applies to contracts with imported content equal to or exceeding US$10 million; the NIP obligation is 30% of the imported content. Successful bidders with contracts exceeding R10 million must report details to the Department of Trade and Industry within five working days after award. The NIP obligation agreement is between the dti and the successful bidder and does not involve the purchasing institution. The successful bidder must submit a performance guarantee to the dti as part of the NIP process.

Bids must be valid for 90 days from closing date. Proposals must be hand-delivered or couriered to the tender box at the RAF office, Eco Glades 2 Office Park, 420 Witch-hazel Avenue, Centurion. Faxed or emailed bids will not be accepted. Bidders must submit an original and a soft copy. The successful bidder will be required to sign a written contract form (SBD 7). The bid is subject to the Preferential Procurement Policy Framework Act, 2000, the Preferential Procurement Regulations, 2017, the General Conditions of Contract (GCC), and any applicable special conditions.

Bidders must be registered on the Central Supplier Database (CSD) and be tax compliant. Bidders must submit a valid Tax TCS PIN or CSD number. Bidders must not be persons in the service of the state or have directors who are. Bidders must have a business continuity management plan available for inspection. Bidders must not be on the National Treasury register of Restricted Suppliers or Tender Defaulters. Bidders must submit all required SBD forms completed, attached, and signed. Proof of CIDB registration is required if applicable. If a joint venture, consortium, or other unincorporated grouping, a copy of the joint venture agreement must be provided. Proof of authority to sign the bid (e.g., company resolution) must be submitted.

Bid enquiries: Ntanganedzeni Mutheiwana, email: [email protected]. No telephonic enquiries. Closing date for questions: 11 September 2026. Q&A publication: 17 September 2026. Questions and Answers will be published on the RAF website and eTender portal.