Request for quotation (RFQ) for a risk management workshop, risk maturity assessment and combined assurance review services

Advertised: 19 June 2026

Closing: 30 June 2026 at 11:00 am (no extensions indicated)

Supply Chain Management (SCM) – Email: [email protected] (copy: [email protected])

Technical enquiries – Email: [email protected]

Attention: Kagiso Themba

Address: Iziko South African Museum, 25 Queen Victoria Street, Cape Town, 8001

• Submit the completed RFQ, signed SBD 4 and SBD 6.1, company profile & methodology, CVs of key personnel, three reference letters, B‑BBEE certificate or sworn affidavit, and a declaration of independence.
• All documents must be emailed to the Supply Chain Management address: [email protected] (also copy [email protected]).
• Technical enquiries may be sent to [email protected].
• Required administrative documents (CSD report with valid tax pin, tax certificate, etc.) must be attached; failure to provide any will render the bid non‑responsive.
• Bids received after 30 June 2026 11:00 am will be disqualified.
• Do not alter the tender document apart from filling in bidder details and price; any other changes will lead to automatic disqualification.
• Suppliers listed on the Register of Tender Defaulters or the List of Restricted Suppliers are automatically disqualified.

Must be registered on the Central Supplier Database (CSD) with valid tax status. Must submit all mandatory administrative documents. Must declare no conflicts of interest. Bidders listed on tender defaulters or restricted suppliers registers will be disqualified.

Scope of Services:

1. Inception & preparation – kickoff meeting, confirm project plan, request list, develop workshop agenda, templates and presentation material.

2. Two‑day risk‑management workshop – facilitate sessions covering strategic/operational risk context, risk identification, cause‑effect analysis, likelihood/impact rating, existing controls, residual risk, risk appetite & tolerance, treatment actions, owners, timelines, alignment with Strategic Plan and Annual Performance Plan, and combined‑assurance principles.

3. Document review & finalisation – update Risk Management Policy, Strategy/Implementation Plan, Methodology & Rating Criteria, Strategic Risk Register, Operational Risk Registers, Risk Appetite & Tolerance Statement, Risk Heat Map, Reporting Templates/Dashboard, and any related governance terms of reference.

4. Independent risk‑tolerance & maturity assessment – apply a recognised risk‑maturity model, map risks to assurance providers (first, second, third line), identify gaps/duplication, produce a maturity rating, gap analysis, target maturity level and improvement roadmap.

5. Combined assurance review – develop a combined‑assurance matrix linking key strategic risks to assurance providers, identify coverage gaps and recommend enhancements.

6. Reporting support – prepare presentation material and technical support for EXCO, Audit & Risk Committee, Council or other designated governance bodies.

Deliverables must be clear, editable, internally consistent and ready for governance review.

1. Work Plan – detailed schedule showing all activities (inception, workshop preparation, two‑day workshop, document review, maturity assessment, combined assurance review, reporting), timelines, responsible personnel and deliverables.

2. Workshop Agenda – day‑by‑day agenda with objectives, participant list, topics, risk identification and rating processes, treatment planning and expected outputs.

3. Document Review Approach – systematic review of existing risk policies, registers and related governance documents, gap analysis and update methodology.

4. Maturity & Appetite Assessment – use of a recognised risk‑maturity model, checklist and scoring matrix to evaluate current state and define target maturity.

5. Combined Assurance Mapping – development of a matrix linking risks to assurance providers (first, second, third line) and identifying coverage gaps.

6. Reporting – production of governance‑ready reports, presentation packs and dashboards for EXCO, Audit & Risk Committee and Council.

• Minimum three (3) relevant assignments in the last five years covering ERM workshop facilitation, risk register review, risk governance documentation, risk maturity assessment, risk appetite/tolerance work, combined‑assurance framework review or governance reporting.
• Each assignment must be documented with client name, period, scope, deliverables and relevance.
• Key personnel CVs must demonstrate:

– Engagement lead with ≥7 years senior ERM/internal audit/combined‑assurance experience and relevant professional designation (e.g., CA(SA), CIA, CRMA, RIMS‑CRMP, CGIP).

– Specialists with proven experience in risk maturity assessment, risk appetite/tolerance, and combined‑assurance mapping.

• Provide evidence of public‑sector or regulated‑entity experience.
• Include three (3) reference letters confirming successful delivery of similar projects.

• Provide sample templates for all key outputs: risk register, risk treatment plan, risk appetite/tolerance schedule, maturity assessment report and governance reporting format.
• Assessment tools must include a clear checklist or scoring matrix for risk maturity and appetite/tolerance, showing criteria, evidence required and scoring methodology.
• Combined‑assurance tool must be a matrix linking strategic risks to assurance providers, indicating coverage gaps and duplication.
• Quality‑Assurance process must detail version control, internal review responsibilities, management sign‑off points and final acceptance criteria before submission to Iziko.
• All tools and templates must be submitted with the bid as supporting evidence; lack of any of these will result in reduced scores as per the detailed scoring guidance.

See the Financial Requirements section for the detailed pricing schedule. In summary:

1. Fixed fee – Inception & preparation.

2. Fixed fee – Two‑day workshop facilitation.

3. Fixed fee – Review & finalisation of risk documents.

4. Fixed fee – Independent risk‑tolerance & maturity assessment.

5. Fixed fee – Combined assurance framework & plan.

6. Fixed fee – Close‑out report & governance presentation.

7. Disbursements – disclosed upfront, capped at 5 % of total fixed fees, payable only with prior written approval.

8. Total cost (excl. VAT), 9. VAT @15 %, 10. Total cost (incl. VAT).

All prices must be inclusive of VAT and any incidentals (travel, equipment, etc.).

Pricing Schedule (all amounts inclusive of VAT unless stated otherwise):

1. Fixed fee – Inception meeting, project plan, information request, workshop agenda & templates.

2. Fixed fee – Facilitation of the two‑day workshop (preparation, material, attendance register, facilitation notes).

3. Fixed fee – Review & finalisation of risk‑related documents (policy, strategy, methodology, registers, appetite/tolerance statement, heat map, reporting templates).

4. Fixed fee – Independent risk‑tolerance and maturity assessment (assessment report, gap analysis, improvement roadmap).

5. Fixed fee – Combined assurance framework & plan (matrix, assurance plan).

6. Fixed fee – Close‑out report and governance presentation pack.

7. Disbursements – disclosed upfront, capped at 5 % of the total fixed fees; payable only with prior written approval.

8. Total cost (excl. VAT), 9. VAT @15 %, 10. Total cost (incl. VAT).

Pricing must be presented on company letterhead with a full cost breakdown, resource categories, rates and assumptions. The total evaluated bid price will be used for the 80 % price‑point calculation under the 80/20 preference system. No variation allowed after award.

• Central Supplier Database (CSD) registration with valid supplier number and tax status verification PIN.
• Valid tax certificate or tax PIN.
• B‑BBEE certificate or sworn affidavit confirming status level.
• Completion of SBD 4 (Bidder’s Disclosure) and SBD 6.1 (Preference Points Claim Form).
• No listing on the Register of Tender Defaulters or List of Restricted Suppliers.
• All key personnel must provide CVs demonstrating relevant qualifications (e.g., CA(SA), CIA, CRMA, RIMS‑CRMP, CGIP, etc.).
• Declaration of independence/conflict‑of‑interest.
• Compliance with the Preferential Procurement Regulations 2022 (80/20 preference point system).

• Bidders must certify that the bid is prepared independently, without collusion or undue influence, and that no prohibited communications have occurred with competitors or Iziko officials (apart from clarification requests).
• Any breach of the above may be reported to the Competition Commission, the National Prosecuting Authority, or result in disqualification and possible blacklisting for up to ten (10) years under the Prevention and Combating of Corrupt Activities Act.
• The supplier must ensure that all personnel deployed to Iziko premises comply with Iziko’s occupational health and safety policies and any site‑specific safety requirements.

• The successful provider must sign a Project Charter before work commences – the charter will define objectives, scope, methodology, timelines, deliverables, roles, reporting protocols, confidentiality and quality‑assurance arrangements.
• Contract duration is the period required to complete all deliverables as set out in the Scope of Works (typically up to the final close‑out report).
• Termination: Iziko may terminate the contract for default (e.g., non‑delivery, breach of confidentiality, failure to meet agreed milestones) with written notice and a cure period as stipulated in the charter.
• Penalties: In the event of unjustified termination by the supplier, Iziko may retain any paid fees and claim liquidated damages for additional costs incurred.
• All deliverables become the property of Iziko upon acceptance; the supplier must provide source files in editable format.
• The supplier must comply with all applicable legislation (PFMA, PPFA, etc.) and maintain appropriate insurance coverage as required by Iziko.

Additional evaluation criteria (beyond the standard weighting) include:

• Demonstrated ability to produce governance‑ready reports and presentation packs.
• Evidence of best‑value approach – not merely lowest price but combination of expertise, experience and technical solution.
• Compliance with the Preferential Procurement Regulations 2022 (80/20 preference point system).
• Ability to meet the 60‑day validity requirement for the formal quotation.
• Adherence to the overall project charter and quality‑assurance processes.