ICT governance and controls audit services – RFP/2021/001484 (80/20 preference system)

Closing date: 28 September 2026 at 11:00. Audit review commences 05 October 2026 and must be completed by 27 November 2026.

Bidding procedure enquiries: Lungile Mokoena, SCM Specialist (Acting), telephone 012 423 5700/5800, email [email protected]. Submission address: The PSETA, Ground Floor, Woodpecker Building, 177 Dyer Road, Hillcrest Office Park, Pretoria.

Bids must be delivered to the PSETA, Ground Floor, Woodpecker Building, 177 Dyer Road, Hillcrest Office Park, Pretoria, by the closing time. Late bids will not be accepted. All bids must be submitted on the official forms provided and not re-typed. The following returnable documents are required: SBD 1 (Invitation to Bid, all sections completed), SBD 4 (Declaration of Interest, all sections completed), SBD 6.1 (Preference Points Claim, all sections completed), proof of Central Supplier Database registration, and proof of authority to sign (e.g., company resolution). Failure to submit any required document will render the bid invalid.

Evaluation is in two phases. Phase 1: functionality evaluation, minimum threshold of 70 out of 100 points. Bids below this are disqualified. Phase 2: 80/20 preference point system, with 80 points for price and 20 points for specific goals. Functionality criteria: (1) Qualifications of proposed team (weight 40): NQF Level 7 qualification in IT, Information Systems, Computer Science, Accounting Sciences, Auditing, or any IT-related qualification; NQF 8 or higher is an added advantage. (2) ISACA certifications (weight 20): at least 2 team members must hold CISA, CISM, or CRISC; more than 2 is an added advantage. (3) Experience of project team (weight 20): each member must have a minimum of 3 years ICT audit experience. (4) Experience of company/audit firm (weight 20): signed reference letters of completed ICT Governance and Controls audits in the past 5 years (2020 to date). (5) ISACA membership (weight 10): at least 2 team members must have active ISACA membership; additional memberships with IIASA, SAICA, EC-Council, IRMSA, ACFE, Ethics Institute of South Africa, or Compliance Institute are an added advantage.

The service provider will conduct an ICT Governance and Controls Review (Ref. 2026/27-16) as part of PSETA's approved 2026/2027 Internal Audit Plan, Quarter 3 deliverables. The audit objectives are to provide assurance on the adequacy and effectiveness of ICT Governance and Controls. Scope of work: Evaluate, Direct and Monitor Domain of COBIT; review Corporate Governance of ICT Policy Framework; ICT Continuity Planning; ICT Infrastructure Management; compliance with ICT Policies and Procedures; General and Application Controls; End User Support; IT Contract Management; follow-up of 2025/2026 internal audit findings on ICT (excluding cybersecurity-related findings). Key deliverables include: project kick-off meeting, completed declaration forms, audit planning memorandum, engagement letter, system description, audit programme, request for information, execution of audit programme with working papers, informal queries/draft findings, draft internal audit report, final internal audit report presented to CEO, client satisfaction survey, quality-assured audit file by 27 November 2026, and audit committee reporting on request. The service provider must be a registered entity or consortium with traceable credentials and able to assume duties immediately. All work must follow PSETA's Internal Audit methodology and approved working paper templates. Payment is made only after deliverables are met. All information derived and produced during the assignment remains the property of PSETA.

Bidders must be tax compliant and submit a SARS Tax Compliance Status (TCS) PIN or proof of exemption, or a CSD number if registered on the Central Supplier Database. Bidders must not be persons in the service of the state, nor companies with directors or close corporations with members who are persons in the service of the state. Bidders must submit a B-BBEE status level verification certificate or sworn affidavit (for EMEs and QSEs) to claim preference points. The B-BBEE minimum level is 7. Returnable forms: SBD 1 (Invitation to Bid), SBD 4 (Declaration of Interest), SBD 6.1 (Preference Points Claim), and proof of CSD registration.

Preference points will be awarded based on the 80/20 or 90/10 preference point system as applicable. Bidders must indicate how they claim points for each preference point. The lowest/highest acceptable tender will be used to determine the accurate system once tenders are received.