Grc software solution – government tender in gauteng

Closing date: 11 September 2026. Closing time: 11h00. Bid validity: 180 days from closing date. Briefing session: not applicable (N/A). No site visit or clarification deadline stated.

SCM and Technical enquiries: Ntombizodwa Duma, telephone 011 545 1262, email [email protected]. No facsimile number. Submission address: Bid Box Marked 1, South African Civil Aviation Authority, BYLS Bridge Office Park, Olievenhoutbosch Road & Jean Ave, Centurion 0062. Prior access code arrangement required due to security: contact Betty Monyeki 082 885 4270 or Cynthia Motaung 083 461 6534.

Submission method: sealed envelope (one original and one copy) deposited in Bid Box Marked 1 at South African Civil Aviation Authority, BYLS Bridge Office Park, Olievenhoutbosch Road & Jean Ave, Centurion 0062. Envelope must be endorsed with bid number SACAA/GRC/00011/2026 - 2027, closing date, company name and return address. Courier deliveries must have bid description on the delivery note to ensure placement in the correct bid box. No bids by telegram, telex, email, facsimile or similar medium will be considered. Late bids will not be accepted. Amended bids may be submitted in an envelope marked "Amendment to bid" together with the original bid before closing time. Bid validity period: 180 days from closing date. Returnable forms (all must be completed, signed and submitted): SBD 1 (Invitation to Bid), SBD 3 (Pricing Schedule), SBD 4 (Bidder's Disclosure), SBD 6.1 (Preferential Procurement Points Claim). Disqualification risks: submission in wrong bid box, missing or unsigned returnable forms, late submission, incomplete price list.

Four-phase evaluation:

Phase 1 Part 1 (SCM Administrative Mandatory Compliance): CSD registration proof, completed and signed SBD 1, SBD 3, SBD 4, SBD 6.1, valid tax compliance (SARS TCS PIN or CSD number; each consortium/JV party separately). Bids from persons in service of the state or companies with directors who are state employees will not be considered.

Phase 1 Part 2 (Technical Mandatory Compliance): Valid OEM/Reseller Partnership letter/agreement/certificate confirming active partnership status; Project Team Leader must hold PMP, Prince2 or equivalent recognised project management certification (certified copies required). Non-submission results in disqualification.

Phase 2 (Technical/Functionality Evaluation) – minimum 65/100 to proceed:

• Company Technical Expertise (5-10 pts): ≥3 signed reference letters (≤3 years old) with services rendered, technology, duration, deliverables.
• Company Track Record & Experience (10-20 pts): >9 years = 20 pts; 5-9 years = 10 pts; <5 years = 0 pts.
• Proposed Solution (35-50 pts): must cover ≥70% of key functionalities with minimum points per module: BCM 2, Combined Assurance 2, Risk Management 12, Legal Compliance (incl. all 11 high-risk laws) 12, Internal Audit 12, OHS 1, Forensic Investigations 1, Reporting 5, Data Migration 2, Operational Performance Management 1. Risk Management, Legal Compliance, Internal Audit and Data Migration MUST score points (zero on any = automatic disqualification).
• Experience of Project Team Leader (5-10 pts): ≥10 years leading similar projects = 10 pts; 5-9 years = 5 pts; <5 years = 0 pts.
• Project Plan (10 pts): full plan with activities and timelines = 10 pts; missing/incomplete = 0 pts.

Phase 3 (System Demonstration) – minimum 30/50 to proceed: each module scored (Combined Assurance 1-2, Risk Management 6-10, Legal Compliance 6-10, Internal Audit 6-10, Quality Assurance 1-2, Forensic Investigations 1-2, OHS 1-2, Operational Performance Management 1-2, Business Continuity 1-2, Vendor Resilience 1-2, Reporting 2, Data Migration 3-4). Risk Management, Legal Compliance, Internal Audit and Data Migration must meet minimum cut-off.

Phase 4 (Price & Specific Goals): 80/20 preference point system (Price 80, Specific Goals 20) per PPPFA Regulations 2022. B-BBEE certificate/sworn affidavit required for preference points.

Off-the-shelf GRC software solution, modular design with modular pricing, for 5-year term. Must integrate: Business Continuity Management, Combined Assurance, Enterprise Risk Management, Legal Compliance Management, Internal Audit (incl. Data Analytics), Quality Assurance, Forensic Investigations, Occupational Health & Safety, Organisational Performance Monitoring. Generic requirements: web-based, configurable workflows, calculations, methodologies, hierarchy, virtual parameters, predictive analytics, password-controlled module access. Combined Assurance: objectives/sub-objectives/risks linkage, assurance responses, assurance levels vs top 10 risks, Combined Assurance Matrix, annual Combined Assurance Implementation Plan. Incident Logs: centralised log, criticality evaluation, assignment, status/resolution tracking, near misses, root causes, corrective actions, risk/control linking, recurring issue monitoring. Risk Management (full lifecycle): COSO & ISO31000 alignment, central risk repository, inherent/residual/target risk assessments with Risk Assessment Matrix, weighted scoring criteria, control capture/rating, KRI & key control monitoring, contributing factors, loss event capture/reporting, action assignment/tracking, risk stratification, impact-based analysis, automatic trigger reporting/reminders/escalation, action plan status. Legal Compliance (full lifecycle): GACP framework alignment (4 phases), integration/monitoring of 11 high-risk laws (BCEA, Civil Aviation Act, Employment Equity Act, OHSA, PRECCA, PAIA, PAJA, POPIA, LRA, PFMA, PPPFA), Civil Aviation Amendment Act 2021 checklist capability, legislation database maintenance, automated legislative change alerts, compliance checklist updates, CRMP development/assignment/tracking with risk assessments/control mapping/action plans, automated reminders/escalation, dashboards, standard/custom reports (PDF/Excel), email distribution of verification results, 2-way SMS bulk messaging, action management/status tracking. Internal Audit (full lifecycle): RM/IA coordination with cross-module access, standard audit process (strategic planning, assignment planning, execution, reporting, follow-up, stakeholder reporting), customisable methodology/templates, hour tracking vs estimates, auto-generated reports, additional risk/control capture with RM alignment, risk re-rating communication, electronic working papers, responsibility assignment/escalation, audit section synchronisation, email review notifications, read-only review notes, document attachment, finding rating, email comments from process owners (no licence required), audit team notifications, significant findings summarisation/tracking, implementation progress notifications/escalation, follow-up reports/audits, compliance tracking (PFMA, King V), archiving, data visualisation, Outlook integration, open findings management, findings register with filtering. Quality Assurance: QMS support (QA processes, RM, CAPA, continuous improvement), standard QA process (annual plan, planning, execution, reporting, follow-up, stakeholder reporting), user-friendly interface, audit trails, customisable methodology/templates, hour tracking, standard report templates, additional risk/control capture with RM alignment, risk rating, electronic working papers, responsibility assignment/escalation, section synchronisation, email review notifications, read-only review notes, document attachment, finding rating, email comments from process owners, audit team notifications, findings summarisation/tracking, implementation progress notifications/escalation, follow-up reports/inspections, compliance tracking (policies, procedures, ISO 9001), archiving, Outlook integration, open findings management, action status tracking. Forensic Investigations: centralised case management/evidence storage, case progress/milestone/deadline tracking, comprehensive reporting, investigative action logging, chain of custody for digital evidence, incident response strategies (workflows, communication plans, escalation), legal/regulatory compliance (POPIA), fraud risk assessment/management, digital evidence recovery/backup, real-time messaging/file sharing/task assignment. OHS: RM/OHS coordination, OHS regulations import/self-assessment, standard OHS process (inspections, incident reports), customisable methodology/templates, standard report templates, additional risk/control capture with RM alignment, risk rating, document attachment, finding rating, email comments from process owners, OHS team notifications, findings summarisation/tracking, implementation progress notifications/escalation, follow-up reports/inspections, compliance tracking (policies, procedures, ISO 45001), Outlook integration, open findings management, action status tracking. Operational Performance Management: objectives/sub-objectives/risks linkage, action plan capture, progress status reports, KPI monitoring/management, call lists, integration with strategic/operational risks & KRIs, KRI reporting, outstanding action management/status, project plan upload for quantitative indicators, evidence upload for achieved objectives. Business Continuity (full lifecycle): BIA & continuity plans, disruption tolerances (RPO, RTO, ART, MDL), ICT services list with restoration priority, testing module (desktop, continuity, scenario), automated workflows, document expiry email notifications, crisis management (teams, call lists, recovery plans, response actions, crisis diary, crisis communications, 2-way SMS), emergency notifications (stakeholder notification/confirmation, DR activation, off-site recovery invocation, automated alerts). Vendor Resilience: vendor BCM capability audit, vendor performance tracking/monitoring, ISO 22301 assessment (optional), RTO/RTC tracking. Reporting: standardised/custom reports on all devices, board-level consolidation, heat maps/customisable formats (pie, radar, spider, scatter, graphs), standard risk committee reports + customisable via wizards/builders. Training: face-to-face for internal staff pre-go-live, system administrator training (categories, fields, standard responses, user management), training manual and video for users. Migration: import of existing risk, QA, internal audit, governance/compliance, organisational performance data from BarnOwl system. Software specifications: Active Directory & Human Capital Database integration, SQL database, Windows OS. Maintenance & support: as-and-when-required basis at hourly rates (office hours, after-hours, weekends – bidders to specify rates). Licences: 129 full-access (1 admin, 48 power/rich, 80 lite) + 50 roaming (read & view) across modules as per detailed breakdown.

Company: minimum 5 years' experience deploying & supporting proposed COTS GRC software (5-9 years = 10 pts, >9 years = 20 pts, <5 years = 0 pts). Minimum 3 signed, dated, contactable reference letters on client letterhead not older than 3 years (3 letters = 5 pts, >3 letters = 10 pts, <3 letters = 0 pts). Letters must state services rendered, technology/proposed solution, duration, deliverables. Project Team Leader: minimum 5 years' experience leading implementation of similar GRC projects (5-9 years = 5 pts, ≥10 years = 10 pts, <5 years = 0 pts). Detailed CV required. Project Management certification (PMP, Prince2 or equivalent) mandatory for Team Leader.

Quality requirements embedded in technical specifications: QMS support per ISO 9001, standard QA process (annual plan, planning, execution, reporting, follow-up, stakeholder reporting), user-friendly interface, audit trails, customisable methodology/templates, hour tracking, standard report templates, electronic working papers, responsibility assignment/escalation, section synchronisation, email review notifications, read-only review notes, document attachment, finding rating, process owner comments (no licence required), audit team notifications, findings summarisation/tracking, implementation progress notifications/escalation, follow-up reports/inspections, compliance tracking (policies, procedures, ISO 9001), archiving, Outlook integration, open findings management, action status tracking. Also applies to Internal Audit and OHS modules with similar QA workflows.

Modular pricing required – bidders to indicate which modules are included/covered. SBD 3 (Pricing Schedule) must be completed. Maintenance and support on as-and-when-required basis at hourly rates: bidders must specify rates for office hours, after-hours and weekends. Licence quantities: 129 full-access (1 admin, 48 power/rich, 80 lite) + 50 roaming (read & view) across 12 modules as per detailed breakdown. No bill of quantities or fixed-price schedule provided in extracted text.

Pricing must be on a modular basis (bidders to indicate which modules are included). SBD 3 (Pricing Schedule) must be completed. Maintenance and support on an as-and-when-required basis at hourly rates – bidders must specify hourly rates for office hours, after-hours and weekends. No explicit bond, guarantee, insurance or financial capacity thresholds stated. Bid validity 180 days. 80/20 preference point system applies (Price 80 points, Specific Goals 20 points).

Mandatory: CSD registration (proof required, supplier number to be provided). Tax compliance: SARS TCS PIN or CSD number (each consortium/JV party separately). B-BBEE status level verification certificate or sworn affidavit (for EMEs/QSEs) required to claim preference points. Returnable forms: SBD 1 (Invitation to Bid – completed and signed), SBD 3 (Pricing Schedule – completed), SBD 4 (Bidder's Disclosure – completed and signed), SBD 6.1 (Preferential Procurement Points Claim – completed and signed). OEM/Reseller Partnership letter/agreement/certificate confirming active/valid partnership status. Project Team Leader: PMP, Prince2 or equivalent recognised project management certification (certified copies). No CIDB grading or professional body registration mentioned. Local content: not specified. Foreign bidders must complete questionnaire; if no RSA presence/income/tax liability, tax compliance PIN not required.

OHS module requirements: RM/OHS coordination, import of OHS regulations and self-assessment, standard OHS process (inspections, incident reports), customisable methodology/templates, standard report templates, additional risk/control capture with RM alignment, risk rating, document attachment, finding rating, email comments from process owners (no licence required), OHS team notifications, findings summarisation/tracking, implementation progress notifications/escalation, follow-up reports/inspections, compliance tracking (policies, procedures, ISO 45001), Outlook integration, open findings management, action status tracking. Occupational Health and Safety Act, 1993 included in 11 high-risk laws for Legal Compliance module.

Dispute resolution: negotiation within 10 days of notification; failing that, mediation under Arbitration Foundation of Southern Africa (AFSA) rules within 15 days; failing that, expedited arbitration under AFSA rules within 15 days. Single arbitrator appointed by agreement within 10 days or by AFSA Secretariat. Arbitration at Centurion, South Africa, in English. South African law applies. Parties entitled to legal representation. Arbitrator's award final and binding, may be made an order of court. Interim relief via High Court permitted. Interpretation: SACAA's interpretation of requirements prevails; bid conditions take precedence over other RFT documents. Contract form: successful bidder must complete and sign SBD 7. General Conditions of Contract (GCC) and any special conditions apply. Bidder must accept conditions of bid (signature, capacity, proof of authority e.g. company resolution).

See main evaluationCriteria section for full four-phase evaluation breakdown. Additional detail: Phase 2 technical/functionality scoring totals 100 points with minimum 65 to proceed. Phase 3 system demonstration totals 50 points with minimum 30 to proceed; Risk Management, Legal Compliance, Internal Audit and Data Migration must meet minimum cut-off within demonstration. Phase 4 uses 80/20 PPPFA formula: Ps = 80[1 - (Pt - Pmin)/Pmin]. Specific Goals allocation not further detailed in extracted text.