External quality assessment (saiv) for internal audit division – national tender

Closing date: 23 October 2026 at 11:00

RFQ issue date: 15 October 2026

No briefing session or site visit is stated.

Enquiries (general):

• Email: [email protected]
• Email: [email protected]
• Email: [email protected]

Bidding procedure enquiries:

• Contact: Supply Chain Management
• Email: [email protected]
• Telephone: 012 432 1300

Technical enquiries:

• Contact: Penelope Soyingwa
• Email: [email protected]
• Telephone: 012 432 1414

Submission:

• Method: online via e-Tender portal only
• No physical submissions accepted

Organisation address:

National Lotteries Commission

P.O Box 1556

Brooklyn Square 0083, Pretoria

Submission method: online via the e-Tender portal only; no physical submissions accepted.

Closing time: 23 October 2026 at 11:00 (South African Standard Time). Late submissions are rejected.

Bids must be submitted in English.

Returnable forms (all must be completed, signed and submitted):

• SBD 1 (Invitation to Bid): bidder and contact details, signed as the offer cover page.
• SBD 6.1 (Preference Points Claim): claims B-BBEE preference points under the 80/20 system.
• SBD 4 (Declaration of Interest): discloses whether any director or shareholder is employed by the state or connected to anyone at the NLC; false declaration disqualifies.
• POPIA Consent Form: original signed consent for processing of personal information.
• CSD registration proof and CSD Summary report.
• Valid SARS tax pin or TCS certificate.
• B-BBEE certificate or sworn affidavit (for EMEs/QSEs).
• JV agreement (if bidding as a joint venture).
• Pricing schedule (Annexure 1).
• Proof of lead validator's IIA recognition or equivalent quality-assessor training.
• CIA certification for one named team member.
• Company profile, CVs, reference letters, and methodology as per evaluation criteria.

Disqualification risks:

• Any returnable form omitted or unsigned.
• Late or incomplete submissions.
• Attempting to alter the terms and conditions or scope of work.
• Involvement in more than one bid for this RFQ.
• Failure to respond in writing to a request to extend the validity period.

Evaluation stages:

1. Administrative compliance: SBD 1, SBD 6.1, CSD registration, tax compliance, POPIA consent, B-BBEE certificate/affidavit.
2. Mandatory compliance: JV agreement (if applicable), SBD 4, returnable documents and pricing schedules, lead validator IIA recognition, CIA certification. Failure disqualifies.
3. Technical/functional evaluation (minimum qualifying score: 75/100):

• Company Experience (10%): scored on years of Internal Audit External Quality Assessment Review experience (0–5 points).
• Experience of Team Leader (10%): CV demonstrating internal audit and EQA review experience (0–5 points).
• Qualifications of Team Leader (10%): qualifications such as Honors/BTech, CIA, PEQA, master's degree (0–5 points).
• Experience and Qualifications of Project Team (20%): CVs of three proposed Internal Auditors (excluding team lead); average of their ratings (0–5 each).
• Written Reference Letters (15%): three contactable client references on company letterhead, not older than three years, for EQA services (1–5 points).
• External Quality Assurance Review (10%): evidence of company's own EQAR by IIA-accredited reviewer; score depends on overall opinion and age (0–5 points).
• Methodology and Approach (25%): SAIV methodology aligned with IIA Quality Assessment Manual; score based on completeness and quality (2–5 points).

4. Price (80 points) and specific goals (20 points) under the 80/20 preference point system.

Specific goals (max 20 points):

• Black ownership: 100% = 6 points; 51–99% = 4 points; less than 51% = 0.
• Black women ownership: 100% = 4 points; 30–99% = 2 points; less than 30% = 0.
• Black youth ownership: 100% = 4 points; 30–99% = 2 points; less than 30% = 0.
• Disability ownership: 20% or more = 4 points; more than 10% but less than 20% = 2 points; less than 10% = 0.

Evidence for specific goals: CSD report, B-BBEE certificate/sworn affidavit, or doctor's letter confirming disability.

Due diligence: NLC may conduct supplier due diligence before award or during contract, including site visits and review of court judgments/regulatory actions.

Contract and award: negotiation with lowest acceptable tenderer may occur; bidders may be asked for best and final offers.

The National Lotteries Commission requires appointment of a service provider to conduct an external quality assessment of its Internal Audit Division using the self-assessment with independent validation (SAIV) method, in terms of Standard 8.4 of the Global Internal Audit Standards.

Scope covers the entire Internal Audit Division, including operational and IT audit and forensic investigation work.

The service provider must:

• Validate the refreshed self-assessment across all five domains, 15 principles and applicable standards, documenting evidence, exceptions and conclusions at requirement level.
• Review mandate, charter, independence, BARC oversight, organisational positioning, ethics, strategy, risk-based planning, methodology, resources, competence, technology, stakeholder relationships, performance measures, QAIP and engagement delivery.
• Examine governance records, plans, policies, reports, quality reviews, follow-up processes and a risk-based sample of completed and current engagements; select additional files and workpapers independently.
• Review the 2025/26 readiness report and verify implementation of improvement actions.
• Conduct or independently validate confidential stakeholder surveys and interviews with BARC members, Commissioner, senior management, auditees, Internal Audit personnel and assurance providers.
• Assess the adequacy of the NLC self-assessment process, challenge unsupported conclusions, extend testing where evidence is insufficient.
• Identify successful practices, nonconformance, root causes, consequences and practical, prioritised recommendations.

Deliverables:

• Inception report (assessment period, work plan, team, sampling strategy, timetable).
• Working assessment matrix and evidence trail.
• Draft report for factual-accuracy checking.
• Final report addressed directly to BARC (executive summary, scope, methodology, overall SAIV conclusion, requirement-level results, prioritised recommendations, status of prior readiness actions).
• Presentation of final results by lead validator to BARC.

Deliverables must be editable electronic files, with signed final report in PDF.

Project duration: two months from appointment or SLA signing, as directed by NLC.

The bidder must propose a SAIV methodology aligned with the IIA Quality Assessment Manual, including inception and criteria mapping; independent document and file sampling; interviews and surveys; testing and triangulation; grading and quality review; factual verification; and final direct reporting. The proposal must explain sample selection, coverage of previously unreviewed files, evidence retention, treatment of conflicting evidence, and how work will expand if the self-assessment is incomplete. The validator retains autonomy over sample selection, findings and conclusion. Internal Audit will prepare and refresh the self-assessment, provide records and coordinate logistics. The appointed firm must not have undertaken the readiness assessment and must not be on any current NLC Internal Audit service-provider panel or provide internal audit, co-sourced or outsourced services to the NLC.

Lead validator must be recognised by IIA South Africa as an External Quality Assurance Reviewer, or provide evidence of equivalent current IIA-recognised quality-assessor training and competence. At least one named team member must hold an active Certified Internal Auditor (CIA) designation. The team collectively must have recent knowledge of the Standards, senior internal audit leadership experience, relevant public-sector or regulated-entity exposure, and prior EQA or SAIV experience. Named key personnel must be available for the engagement; substitutions require NLC approval and equivalent qualifications. Evaluation scoring for experience and qualifications: Company Experience (10%), Team Leader Experience (10%), Team Leader Qualifications (10%), Project Team Experience and Qualifications (20%).

Supplier performance: The NLC conducts regular performance reviews using supplier evaluation forms, with at least an annual review for contracts longer than a year and a review at completion for shorter contracts. Non-performance will be addressed with formal letters and remedial actions, with escalation if not adhered to.

Pricing schedule: refer to Annexure 1.

Price is scored out of 80 points under the 80/20 preference point system.

No bid security, bonds, guarantees, retention or payment terms are stated.

CSD registration:

• Compulsory registration on the Central Supplier Database (www.csd.gov.za).
• Provide CSD registration number and attach CSD Summary report.
• Must remain registered for the duration of the contract.

Tax compliance:

• Must be tax compliant at submission and for the duration of the contract.
• Provide valid SARS tax pin or TCS certificate.

B-bbee:

• Submit valid B-BBEE certificate or sworn affidavit (for EMEs/QSEs) to claim preference points.
• Specific goals points require evidence of ownership (CSD report, B-BBEE certificate/affidavit, doctor's letter for disability).

Professional registrations:

• Lead validator must be recognised by IIA South Africa as an External Quality Assurance Reviewer, or provide evidence of equivalent IIA-recognised quality-assessor training and competence.
• At least one named team member must hold an active Certified Internal Auditor (CIA) designation.

Other:

• POPIA consent form (original signed).
• SBD 4 declaration of interest.
• JV agreement if applicable.
• No entity may be involved in more than one bid for this RFQ.

General terms and conditions: The bid constitutes a binding offer for 60 days. No services to be rendered before an official Purchase Order is issued. The NLC reserves the right to amend, withdraw or terminate the RFQ. Precedence of documents: the RFQ takes precedence over other documents. Bidders shall not make news releases without consent. The NLC may conduct site inspections or call for supporting documentation. Bidders must be registered on the CSD and be tax compliant. The NLC may reject any bid, waive irregularities, or require presentations. Bids become the property of the NLC. Personal information is processed in accordance with POPIA. Bidders are prohibited from canvassing NLC officers between closing and award. The NLC may reject all bids when deemed necessary.

The NLC requires a validity period of 120 days from the closing date. Bidders may be requested to extend the validity period; failure to respond in writing will result in no further consideration. The project must be completed within two months. The successful bidder will commence work from the date of appointment until the last item has been delivered.

Service provider eligibility: Lead validator currently recognised by IIA South Africa as an External Quality Assurance Reviewer, or evidence of equivalent current IIA-recognised quality-assessor training and competence. At least one named assessment team member holds an active Certified Internal Auditor (CIA) designation. The team collectively has recent knowledge of the Standards, senior internal audit leadership experience, relevant public-sector or regulated-entity exposure and prior EQA or SAIV experience. Named key personnel available for the engagement; substitutions require NLC approval and equivalent qualifications.

Contract and award: Negotiation may occur after receipt of formal tenders and before conclusion of contracts with the lowest acceptable tenderer to obtain improvements in price, delivery or content. Bidders may be requested to provide best and final offers.