Appointment of independent internal audit service provider – gauteng government tender

Issue date: 13 October 2026

Closing date and time: 30 October 2026 at 17:00

Briefing session: none scheduled

Validity period: 90 business days from closing date

Submissions

• Email: [email protected]
• Telephone: 012 748 6500

Technical enquiries

• Contact: Pontsho Mamabolo
• Role: Financial Accountant
• Email: [email protected]

No physical submission address — email only

Submission method: email only

Submission address: [email protected]

Subject line: SAC2610-016 INTERNAL AUDITORS

Closing: 30 October 2026 at 17:00

Required document bundle — minimum 5 labelled files:

1. Mandatory Documents
2. Company Profile
3. Technical project proposal (methodology and timelines)
4. Pricing (if separate from proposal)
5. References

Returnable forms (complete, sign, submit):

• SBD 4: Declaration of Interest — discloses state employment and related-party connections
• SBD 6.1: Preference Points Claim Form — claims B-BBEE points under 80/20 system
• SBD 8: Declaration of Bidder's Past Supply Chain Management Practices
• SBD 9: Certificate of Independent Bid Determination — certifies no collusion

Disqualification risks:

• Late submission (no exceptions)
• Email sent to any address other than [email protected]
• Missing or unsigned returnable forms
• Incomplete mandatory document bundle

Validity: 90 business days from closing date; may be extended on same terms if adjudication is delayed

Three-phase evaluation

Phase 1 — Mandatory compliance

• All administrative requirements must be met; any failure disqualifies the bid
• Only compliant bidders proceed to Phase 2

Phase 2 — Technical/Functionality (100 points)

Minimum qualifying score: 70/100

Criterion 1: Company Experience — 15 points

• 1–3 years internal audit services: 3
• 4–7 years: 6
• 8–10 years: 10

• 10 years: 15

• Required: company profile showing years in operation, years offering internal audit services, specialised skills and value-added services

Criterion 2: Public entity audit experience (>R15m revenue) — 20 points

• 0 references: 0
• 1–2 references: 5
• 3–4 references: 10
• 5–6 references: 15

• 6 references: 20

• Reference letters must: be on client letterhead, not older than 5 years, show client name, project description, revenue, year conducted, contactable reference name and title

Criterion 3: Staff Complement — 20 points

• 0–10 staff: 5
• 11–30 staff: 10
• 31–50 staff: 15

• 50 staff: 20

• Required: staff description including office support and IT systems used for audit delivery

Criterion 4: Team Expertise — 25 points

• Partner, Internal Audit Project Manager, Internal Audit Supervisor, Internal Auditor, ICT Specialist: 15
• Same plus 2 Internal Auditors: 20
• Same plus >2 Internal Auditors: 25

Criterion 5: Methodology and Approach — 20 points

• No or inadequate proposal: 0
• Basic proposal with limited detail: 5
• Partial proposal with examples but lacking detail: 10
• Fully compliant proposal with detailed plan and examples: 20

Phase 3 — Price and B-BBEE (100 points)

Preference system: 80/20

• Price (detailed budget breakdown): 80 points
• B-BBEE (status level verification certificate): 20 points

Client: South African Council for Natural Scientific Professions (SACNASP), a regulatory entity of the Department of Science, Technology and Innovation

Contract duration: 3 years from SLA signature, subject to satisfactory annual performance review by AR&ICT

Reporting lines: functionally to Audit, Risk & ICT Committee (AR&ICT); administratively to Chief Executive Officer

Core scope

• Risk-based assurance and advisory services on governance, risk management and internal controls
• General internal audit application and control review
• IT governance review
• Risk maturity assessment with analysis, strategic risk identification and presentation to Council with proposed way forward
• Advice on improvement actions; assessment or monitoring of implementation (management retains implementation responsibility)
• Project plan for improvement plan implementation, for AR&ICT sign-off

Key deliverables

• Three-year strategic internal audit plan and annual work programme (AR&ICT approval)
• Annual internal audit plan (AR&ICT approval)
• Internal audit charter — annual development and review (AR&ICT approval)
• Internal audit methodology — annual development and review (AR&ICT approval)
• Disaster recovery and business continuity adequacy assessment
• Internal audit engagements (planning, execution, reporting) per approved annual plan and methodology
• Regular progress meetings and periodic status reports to AR&ICT
• Internal audit reports for all completed engagements, with facilitated management and auditee discussions
• Quarterly AR&ICT attendance to present reports, findings, emerging risks and management action plan status
• Probity audits on procurement processes and bid evaluations per approved procurement plan, pre-award, with outcomes reported to AR&ICT
• Audit findings register — development, maintenance, update; quarterly progress reports on management action implementation
• Complete internal audit records per approved methodology and records management framework
• Follow-up reviews on corrective action implementation and effectiveness
• Risk management framework assessment (risk appetite, tolerance, profile) with independent assurance and recommendations
• Proactive identification and communication of emerging risks and control weaknesses
• Annual reporting on independence, resources, performance and IIA Standards and Code of Ethics compliance
• Private session with AR&ICT without management present

Confidentiality: separate non-disclosure agreement required; no third-party information sharing without written SACNASP consent

The bidder must submit a comprehensive technical project proposal covering methodology and timelines against the scope of work. Scoring: no proposal (0), basic with limited detail (5), partial with examples but lacking detail (10), fully compliant with detailed plan and examples (20). The proposal must address: risk-based three-year strategic and annual internal audit planning; charter and methodology development and annual review; engagement execution; progress reporting; findings register management; follow-up reviews; and proactive risk identification.

Company experience: submit profile showing years in operation and years rendering internal audit services, with specialised skills and value-added services. Public entity references: minimum revenue threshold R15 million; letters on client letterhead under 5 years old showing project description, revenue, year conducted, and contactable reference. Team composition must demonstrate: partner or equivalent, internal audit project manager, internal audit supervisor, ICT specialist, and internal auditors — with scoring tiers at 1, 2, and more than 2 internal auditors.

Internal audit records must be complete, accurate and maintained per approved Internal Audit Methodology and the organisation's records management framework. The provider must report annually on independence, resources, performance and compliance with applicable Institute of Internal Auditors Standards and Code of Ethics.

Pricing format: detailed budget breakdown inclusive of VAT

Pricing must include: professional fees and disbursements

No bid security, performance bond, retention or guarantee requirements stated

No turnover or financial capacity threshold stated

No payment terms stated

B-BBEE preference points: 20 of 100 points (Phase 3, 80/20 system)

Mandatory registrations and status

• CSD: valid, active Central Supplier Database registration number
• SARS: valid original Tax Clearance Certificate or Tax Compliance Status (TCS) PIN

Professional registration

• Valid proof of registration or membership in good standing with IIA SA, IRBA, SAICA, or another SACNASP-approved professional body relevant to internal audit services
• If relying on a director, partner or proposed engagement partner's registration: submit that individual's proof of registration/membership in good standing

B-bbee

• Valid B-BBEE verification document required: original or certified copy of valid B-BBEE certificate, or original affidavit signed and stamped by Commissioner of Oaths per current B-BBEE regulations
• B-BBEE status level contributes 20 points under 80/20 preference system

Returnable forms

• SBD 4: Declaration of Interest
• SBD 6.1: Preference Points Claim Form (Preferential Procurement Regulations 2022)
• SBD 8: Declaration of Bidder's Past Supply Chain Management Practices
• SBD 9: Certificate of Independent Bid Determination

No CIDB grading required (professional services, not construction)

No local content percentage stated

No CIPC registration explicitly required beyond company registration number on SBD 6.1

B-BBEE verification document mandatory: original or certified copy of valid B-BBEE certificate, or original Commissioner of Oaths affidavit per current regulations. Under Phase 3 evaluation, B-BBEE status level verified by certificate contributes 20 points within the 80/20 preference point system.

Contract term: 3 years from SLA signature. Renewal into years 2 and 3 contingent on satisfactory performance reviewed by AR&ICT per Governance Framework and contract management requirements. Confidentiality and non-disclosure agreement mandatory; no third-party disclosure without SACNASP written consent.

Phase 2 technical/functionality minimum: 70/100. Company experience (15 points) scored by years of internal audit service provision. Public entity audit experience above R15m revenue (20 points) scored by number of compliant reference letters on client letterhead within 5 years. Staff complement (20 points) scored by headcount including office support and IT systems description. Team expertise (25 points) scored by depth of key personnel including partner, project manager, supervisor, ICT specialist and internal auditors. Methodology and approach (20 points) scored by proposal completeness against scope of work. Phase 3: 80/20 preference system — price 80 points, B-BBEE status 20 points.