Compliance management system for the IDC – provision, implementation, configuration, maintenance and support (RFP T61/11/26)

Closing date: 19 November 2026 at 11:00

Enquiry deadline: 11 November 2026 at 16:00

Issue date: 03 November 2026

Bid validity period: 120 days from closing date

Implementation to commence immediately upon award and complete within 6 months

Maintenance and support period: 3 years after implementation

Enquiries:

• Contact: Joseph Phiri
• Email: [email protected]

Enquiries must be in writing. Consolidated responses posted on IDC website (www.idc.co.za) under tenders within two days after the enquiry deadline.

Submission portal: https://idcza-my.sharepoint.com/:f:/g/personal/moitlisim_idc_co_za/IgAZuVeLZt5DRYOPcmYlsqQfAf75jZKuHkxFn06ZWtGZTFg

Submission method: electronic only, via the IDC dedicated SharePoint portal. Bids sent to any other platform are disqualified.

Submission portal: https://idcza-my.sharepoint.com/:f:/g/personal/moitlisim_idc_co_za/IgAZuVeLZt5DRYOPcmYlsqQfAf75jZKuHkxFn06ZWtGZTFg

Closing time: 19 November 2026 at 11:00 (before midday). Late bids are not considered.

File format: standard electronic formats (Microsoft suite or PDF). Inaccessible formats disqualify the bid.

File size: portal accepts up to 50MB. Bids larger than 50MB are not accepted.

Submit at least 30 minutes before the deadline to avoid technical issues.

Amended bids must be marked "Amendment to bid" and reach the portal before closing.

All documentation must be in English.

Bids from companies must be signed by a person authorised by a certified Board Resolution, submitted with the bid.

Returnable schedules (each clearly marked):

• Cover Page: RFP reference number, bid description, bidder's name.
• Schedule 1: Executive Summary and Annexure 2 (Acceptance of Bid Conditions and Bidder's Details).
• Schedule 2: certified Board Resolution; certified ID copy of company representative; Annexure 2; Annexure 3 (Tax Compliance); Annexure 4 (Bidder's Disclosure); Annexure 6 (BEE Commitment Plan); B-BBEE certificate or sworn affidavit (EME/QSE); Annexure 7 (Disclosure Statement); Annexure 8 (POPIA requirements, if applicable); financial statements; joint venture/consortium/subcontracting agreement if applicable.
• Schedule 3: Response to Section 2 (functional requirements) in the prescribed format, including Annexure 1.
• Schedule 4: Price Proposal, submitted as a separate file marked "Schedule 4: Price Proposal".

For consortia, joint ventures, or prime contractor with subcontractors, the above documents must be submitted for each member/party.

Disqualification risks:

• Incomplete or late bid responses (including missing schedules).
• Submission to any platform other than the specified portal.
• Non-compliant tax status (after notification and failure to remedy).
• Fraudulent, untrue, or inaccurate information.
• Failure to comply with mandatory requirements or POPIA requirements.
• Prime contractor holding a lower percentage of contract value than any subcontractor.

Evaluation process:

Phase 1 – Initial Screening: compliance with bid conditions, CSD registration, tax compliance, submission of required documents (ID copy, B-BBEE status, all annexures). Failure leads to disqualification.

Phase 2 – Technical/Functionality Evaluation (100 points):

• Mandatory Functional Requirements: must be met; failure disqualifies.
• Other Functional Requirements (60 points):
• Bidder's relevant experience in supply, configuration, implementation, support, and maintenance of compliance management systems: 20
• Project implementation plan: 10
• Skills transfer plan: 5
• Bidder's proposed system functionalities: 15
• Qualifications, experience, and skills of proposed personnel: 10
• Shortlisting for demonstration: score 42 out of 60 or more.
• Demonstration of proposed system functionalities: 40 points.
• Minimum overall qualifying score: 70% (70 out of 100) on functional/technical requirements including demonstrations. Bids below this are not considered for price and specific goals.

Phase 3 – Preference Point System (80/20):

• Price: 80 points
• Specific Goals: 20 points

Specific Goals breakdown (80/20 system):

• Black ownership: 10 points (100% black-owned: full 10; 51%-99.99%: 4 points)
• 30% Black women ownership: 5 points
• Any % ownership by Black Designated Groups: 2 points
• Promotion of SMMEs (EME or QSE): 3 points

Only enterprises with direct Black shareholding (exercisable voting rights) in the four categories qualify for Specific Goals points.

Phase 4 – Objective Criteria: contract awarded to highest scoring bidder unless an objective criterion justifies otherwise. Risk assessed: reputational risk (disclosure), concentration risk, financial capability, past performance in IDC contracts.

The IDC requires a comprehensive compliance management system to identify, assess, monitor, and report on compliance obligations across its operations and investment activities.

Key functional requirements:

• Business Regulatory Universe: single corporate regulatory universe; allocate legislation to SBUs/departments; manage and update; risk rating (inherent and residual) with auto-calculation; questionnaire and answer capturing; filtering and extraction; integration with Sentinel (regulatory monitoring service) with manual editing; AI-assisted interpretation of regulatory provisions.
• Compliance Risk Management Plan (CRMP): auto-populate from regulatory universe; identify and extract applicable legislation sections; editable fields; controls section; action plans ingested into issue log; sign-off workflow (CRAD heads, SBU/department heads); issue tracking record.
• Compliance Monitoring: create monitoring plans and templates (engagement letter, working paper, monitoring report, issue log, reporting/dashboards); workflow with approvals; automated escalation notifications.
• Training: capture and manage training plans (attendance registers, supporting materials in SharePoint); link to risk assessments and compliance gaps; planned annual and ad hoc training.
• Issue Logging: capture, categorise, track compliance issues; assign to department heads; real-time escalation to management.
• Reporting and Dashboards/Data Analytics: reports on training, regulatory universe, monitoring/issue register, risk exposure; dashboards with up-to-date status, filters by date, drill-down, overdue tasks.
• Audit Management: audit trail of all user actions; track changes to built-in forms.
• System Integration: integrate with Sentinel and Power BI; support cloud and/or on-premises architecture.
• Repository: central repository for compliance documentation and evidence (SharePoint); secure upload, version control, retention policies, search functionality.

Implementation and configuration:

• Detailed project implementation plan covering phases, timelines, configuration, integration, data migration, testing (UAT), training, go-live, post-implementation support.

Training and skills transfer:

• Train 7 IDC CRAD end users, system administrators, and super-users.
• Structured skills transfer to 3 IDC staff to enable independent administration and support.

Ad-hoc support: 600 hours over 3 years (Year 1: 250, Year 2: 200, Year 3: 150).

Bidders must provide a detailed and practical project implementation plan covering phases, activities, deliverables, timelines, milestones, configuration/customisation, integration, data migration, testing (UAT), training, go-live, and post-implementation support.

Skills transfer plan must demonstrate methodology, training activities, system administration and support knowledge, documentation, practical knowledge transfer, and measures for assessing effectiveness.

Bidders must respond to functional requirements with full and accurate answers, substantiating each response; failure to substantiate may lead to disqualification.

Bidder's relevant experience: Must have experience in supply, configuration, implementation, and support of compliance management systems. Provide three (3) contactable references confirming similar work within the last ten (10) years.

Key personnel requirements:

• Project manager: Degree in IT, Information Systems, or Project Management; minimum 5 years' relevant experience.
• Business analyst: Degree in IT, Information Systems, Business Analysis, or related; minimum 5 years' relevant experience.
• Compliance specialist: Degree in Law, Risk Management, Compliance, Auditing, Accounting, Governance, or related; minimum 5 years' relevant experience.
• Technical resource with experience in Power BI, SharePoint, and data migration.

Submit team structure, composition, and CVs of all key personnel.

IDC may consider bidder's professional conduct and experience with IDC over the past 5 years.

Implementation plan must address project phases, activities, deliverables, timelines, milestones, system configuration/customisation, integration with existing systems, data migration and validation, system testing including UAT, user training and knowledge transfer, go-live and deployment approach, post-implementation support and stabilisation.

Supplier performance management: SLA will measure, monitor, and assess supplier performance; successful bidder must provide a scorecard on how their service offering is measured.

Pricing must be VAT inclusive (where applicable) and in ZAR.

Costing model tables: Table A (Software licence and maintenance), Table B (Implementation, configuration, training, disbursements), Table C (Ad-hoc support 600 hours over 3 years).

Total Bid Price = sum of all tables (VAT incl.).

Rates must be firm for full contract period unless otherwise stated.

If bid price linked to exchange rate, specify portion.

Payments linked to approved deliverables, paid within 30 days of invoice.

IDC may consider AGSA circular on approved charge-out rates.

Disbursements must be clearly defined; if no fee, state "No Charge / Free of Charge". Failure results in penalty (highest bidder's cost plus 50% for price comparison).

Price Declaration Form must be completed and signed.

Pricing format: All prices VAT inclusive (where applicable) and quoted in South African Rand (ZAR).

Costing model:

• Table A – Software: licence fees (specify Cloud/SaaS or On-Premises, licensing model, annual licence costs for 10 users), maintenance and support for Years 1-3.
• Table B – Implementation, configuration, and training: rates per hour, number of resources, hours; training of 7 staff; disbursements.
• Table C – Ad-hoc support: 600 hours over 3 years (Year 1: 250, Year 2: 200, Year 3: 150).

Total Bid Price = Table A + B + C (VAT incl.).

Rates must be firm for the full contract period unless otherwise stated with basis for adjustment (e.g., CPI).

If bid price is linked to exchange rate, specify which portion.

Payments linked to approved deliverables, paid within 30 days from invoice date.

IDC may consider AGSA circular on approved charge-out rates for professional fees.

Disbursements (travel, accommodation, printing, etc.) must be clearly defined with assumptions. If no fee envisaged, state "No Charge / Free of Charge". Failure to do so results in IDC using the highest bidder's cost plus 50% for price comparison.

Bid validity: 120 days from closing date.

CSD registration: Bidders must be registered on the Central Supplier Database and submit CSD supplier number and unique registration reference number.

Tax compliance: Tax affairs with SARS must be in order; written confirmation of tax compliant status required. Non-compliant bidders may be disqualified.

B-BBEE: B-BBEE verification certificate required. EMEs (annual revenue < R10 million) and QSEs (annual revenue R10-R50 million) may submit a sworn affidavit confirming annual total revenue and black ownership. Misrepresentation is a criminal offence under the B-BBEE Act.

POPIA: Bidders must comply with POPIA requirements as listed in the RFP.

Company authorisation: Bids from companies must be signed by a person authorised by a certified Board Resolution; certified ID copy of company representative required.

Financial statements: Latest audited financial statements (where applicable) and/or independently reviewed financial statements and/or cashflow budget for new entities.

Bidding structure: Prime contractor must hold the highest percentage of contract value; otherwise disqualified. For consortia/JV/subcontracting, signed agreement required and documents for each party.

Enterprise and supplier development: Successful bidders may be required to mentor SMMEs and/or youth-owned businesses (subject to negotiation).

Promotion of emerging black-owned service providers: Bidders encouraged to partner with black-owned entities (50%+1 black owned and controlled) via JV or subcontracting; partnership proposal required.

The IDC's regulatory landscape includes environmental and social governance (ESG) standards, and the compliance management system must support adherence to these standards.

Bid validity: 120 days from closing date.

Successful bidder must conclude a Service Level Agreement (SLA) with IDC, which forms part of the supply agreement.

IDC may amend bid conditions, validity period, specifications, or extend closing date before closing; amendments posted on IDC website.

IDC may conduct site visits at bidder's offices or client sites.

IDC may request verification documents and conduct background checks including FICA on the bidding entity and its directors/trustees/shareholders/members.

IDC may consider bidder's professional conduct and experience with IDC over the past 5 years.

Bidder must prepare for a possible presentation within 5 days of notification, including practical demonstration.

Bidder's offer remains binding during the validity period.

Bidder accepts responsibility for price correctness and all obligations under the contract.

All costs of preparation and demonstration are for the bidder's account; supporting documentation becomes IDC property unless otherwise stated.

IDC may appoint any number of vendors to a panel if applicable.

IDC reserves the right not to accept the lowest priced bid or any bid in part or in whole.

Phase 1: Initial screening – compliance with bid conditions, CSD, tax, required documents.

Phase 2: Technical/Functionality – mandatory requirements must be met; other functional requirements (60 points) with shortlisting at 42 points; demonstration (40 points); minimum overall qualifying score 70%.

Phase 3: Preference points – Price 80, Specific Goals 20.

Phase 4: Objective criteria – risk assessment (reputational, concentration, financial capability, past performance).